Data Protection Notice

This Data Protection Notice (“Notice”) explains how Enable Business Pte Ltd (“QuickHR”, “we”, “our”, “us”) collects, uses, discloses, and safeguards personal data in compliance with the Personal Data Protection Act 2012 (PDPA) and SS 714:2025 (Data Protection Trustmark).

This Notice applies to:

• 1. QuickHR as a Data Controller: for job applicants, employees, visitors and other individuals interacting directly with us; and
• 2. QuickHR as a Data Intermediary (Processor): for users of the QuickHR HRMS platform, where personal data is processed on behalf of our customers (the Data Controllers).

If you provide us with personal data relating to another individual (e.g., next-of-kin, referees), you represent and warrant that you have obtained that individual’s consent for the collection, use, disclosure, and processing of their personal data under this Notice.

Our role as a Data Intermediary and the specific responsibilities of both QuickHR and our Customers are governed by our Terms of Service and the accompanying Data Processing Addendum [DPA]. Any updates to this Notice will be posted here, with the ‘Last Updated’ date reflecting the latest revision.

International Data Protection Applicability

QuickHR’s services are primarily designed, hosted, and operated for customers in Singapore and the Asia-Pacific region. This Notice is primarily based on Singapore’s Personal Data Protection Act 2012 (“PDPA”) and SS 714:2025 requirements.

Where the EU General Data Protection Regulation (“GDPR”), UK GDPR, or similar overseas data protection law applies to a specific Customer, individual, or processing activity, QuickHR will apply appropriate additional safeguards to the extent required by applicable law and the relevant contractual terms, including the QuickHR Data Processing Addendum.

For Customer HRMS platform data, the Customer generally acts as the Data Controller, and QuickHR acts as the Data Intermediary or Processor. Detailed processor obligations, including documented instructions, sub-processor controls, cross-border safeguards, data subject assistance, breach notification, and post-termination handling, are set out in the QuickHR Data Processing Addendum.

Group Entities and Authorised Processing

Enable Business Pte Ltd operates as part of a corporate group. Where necessary, personal data may be processed by wholly owned affiliates or authorised support entities within the Enable group, strictly for the purposes of service delivery, operational support, and business continuity.

All such processing is governed by internal intra-group data protection agreements and managed under our Data Protection Management System aligned to SS 714:2025, ensuring equivalent standards of confidentiality, security, access control, auditability, and breach response.

A current list of approved affiliates and sub-processors (including processing locations) is available to Customers upon request. Sub-processor information is provided under confidentiality and does not amend or expand contractual obligations except as expressly set out in the Data Processing Addendum.

• 1. Collection of Personal Data

We collect personal data only where lawful, necessary, and reasonable for the purposes set out in this Notice. Personal data may be collected through:

• Submission of forms (e.g., job applications, service requests, onboarding documents)
• Contracts or agreements entered into with QuickHR
• Interactions with QuickHR staff via phone (which may be recorded for quality and training), email, live chat, or in person
• Use of QuickHR websites, HRMS platform, or mobile applications
• Responses to marketing or customer service outreach
• Referrals from business partners, agencies, or ex-employers with consent
• CCTV cameras, facial recognition, or event photography within our premises
• Visitors to our premises (e.g., visitor logbooks, security passes, CCTV)
• Governmental or regulatory authorities for compliance purposes
• Any other lawful means where consent is deemed or implied under the PDPA

• 2. Collection, Use, and Disclosure Without Consent

In certain limited circumstances, QuickHR may collect, use, or disclose personal data without consent, as permitted or required under the Personal Data Protection Act 2012 (PDPA) and other applicable laws. Examples include but are not limited to:

• Where it is necessary to respond to an emergency that threatens the life, health, or safety of an individual;
• Where it is clearly in the individual’s vital interests and consent cannot be obtained in a timely way;
• For the purpose of contacting the next-of-kin of an injured, ill, or deceased individual;
• Where required by law, regulation, or a court order.

QuickHR will only rely on such exceptions where strictly necessary and will notify the individual of the purpose as soon as practicable, unless exempted from doing so under the PDPA. For all other cases, QuickHR will seek consent before collecting any additional personal data or before using personal data for any new purpose not already notified. For employees, the collection, use, and disclosure of personal data is necessary to administer the employment relationship and fulfil legal obligations, and is therefore permitted without separate consent under the PDPA. This is further detailed in the Employee Handbook and HR policies.

• 3. Purposes of Processing

We process personal data for specific, legitimate purposes, including:

• Delivering services requested by customers and platform users (e.g., payroll processing, leave management, and employee onboarding)
• Managing your relationship with us (e.g., account administration, customer support)
• Verifying identity and access credentials (e.g., during account setup or for support requests)
• Managing employment, payroll, and HRMS platform functions for operational delivery
• Responding to queries, feedback, and complaints in a timely and documented manner
• Conducting audits, investigations, and compliance reviews for legal and regulatory obligations
• Generating reports and analytics for service improvements and customer insights
• Ensuring business continuity, disaster recovery, and risk management readiness
• Complying with applicable laws, regulations, and regulatory requests
• Supporting security threat monitoring, incident detection, and fraud investigations

Where Deemed Consent by Notification (DCbN) applies, it will be for limited purposes such as service analytics to improve functionality or security threat monitoring, in line with PDPA requirements.

• 4. Consent, Withholding, and Withdrawal

• 4.1 Purposes of Processing

  We process personal data for specific, legitimate purposes, including:

  For HRMS platform users (where QuickHR acts as a Data Intermediary):

  • Delivering HRMS services such as payroll, leave management, claims processing, and employee onboarding.
  • Supporting your employer (the Data Controller) with system administration, data security, and compliance reporting.
  • Providing customer support and technical assistance.

  For QuickHR’s own employees, job applicants, and visitors (where QuickHR acts as a Data Controller):

  • Processing job applications, employment records, payroll, and statutory submissions.
  • Managing employee benefits, training, and performance records.
  • Ensuring workplace safety, security, and compliance with applicable laws.

  For all interactions:

  • Verifying identity and access credentials (e.g., for account creation or support requests).
  • Responding to queries, feedback, and complaints in a timely and documented manner.
  • Conducting audits, investigations, and risk assessments.
  • Supporting business continuity, disaster recovery, and security incident response.
  • Complying with applicable laws, regulations, and legal obligations.

• 4.2 Withdrawal of Consent

  Individuals may withdraw consent at any time by writing to our Data Protection Officer (DPO) at the contact details below.

  For HRMS users, all consent withdrawal requests must be directed to your employer (the Data Controller). QuickHR will support the employer in fulfilling such requests in line with our contractual obligations. For QuickHR’s own employees, applicants, or visitors, requests may be made directly to our DPO. Where consent is withheld or withdrawn, QuickHR may be unable to deliver certain services to avoid exposing you, your employer, or QuickHR to operational or regulatory risk.

  We will process such requests within 30 calendar days and explain the consequences, including any impact on service delivery or legal rights.

• 5. Access and Correction of Personal Data

• As Data Intermediary, QuickHR supports Customers (Data Controllers) in fulfilling access or correction requests from their employees or platform users. These requests must be directed to the Customer’s HR department or administrator.
• As Data Controller, QuickHR will respond to access or correction requests within 30 calendar days. A fee may apply only if requests are manifestly unfounded, excessive, or repetitive.

• 6. Accuracy of Personal Data

• When acting as a Data Intermediary, QuickHR relies on employers (Data Controllers) to ensure Personal Data is accurate, complete, and up to date. When acting as a Data Controller, QuickHR takes reasonable steps to maintain accurate data for its employees, applicants, and other direct interactions.
• Individuals or Customers may request corrections where appropriate, and QuickHR will support such requests in accordance with our contractual obligations and applicable law.

• 7. Protection of Personal Data

QuickHR implements reasonable and appropriate technical and organisational measures to protect Personal Data against unauthorised access, collection, use, disclosure, copying, modification, disposal, loss, or similar risks.

These measures include, where applicable:

• role-based access controls and least-privilege access;
• encryption in transit and at rest;
• multi-factor authentication for administrative access;
• secure software development and change management practices;
• vulnerability assessments and penetration testing;
• access logging, monitoring, and audit trails;
• backup, disaster recovery, and business continuity controls;
• staff confidentiality obligations and security awareness training; and
• incident response and breach notification procedures.

Additional Data Protection Measures

QuickHR maintains an Information Security Management System and Data Protection Management System aligned with applicable security and data protection standards, including ISO 27001, MTCS SS 584, SS 714:2025, and the PDPA.

Where QuickHR acts as a Data Intermediary or Processor, QuickHR applies these safeguards in accordance with its contractual obligations to the Customer and the QuickHR Data Processing Addendum.

• 8. Incident Notification

QuickHR will notify the designated contacts of affected Customers (Data Controllers) within 24 hours of confirming a personal data breach. Customers are responsible for notifying their employees or end-users unless direct notification by QuickHR is legally required. All notifications will be handled in accordance with our Incident Response Policy and applicable laws.

• 9. Retention of Personal Data

QuickHR retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable laws and regulations. Specific retention timelines apply as follows:

• Operational Data: Payroll, leave, claims, and related HRMS data follow a standard 30-day export window post-termination. After this period, data is permanently deleted from production systems.
• Backups: Encrypted production backups are retained on a rolling 45-day cycle before being securely overwritten in the ordinary course of operations.
• CCTV Footage: Video footage from QuickHR premises is retained for 30 days, unless required for investigations or legal proceedings.
• Audit Logs: System audit logs are retained for 12 months to support security monitoring, forensic analysis, and compliance audits.

QuickHR reviews retention schedules periodically to ensure compliance with the PDPA, SS 714:2025, and other applicable standards, and securely deletes data when no longer required.

• 10. Cross-Border Data Transfers

QuickHR’s live production hosting and ordinary processing of Customer Personal Data are conducted in Singapore, using AWS Singapore Region infrastructure, unless otherwise expressly agreed in writing with the Customer.

QuickHR does not routinely transfer or store Customer Personal Data outside Singapore as part of normal production operations.

For disaster recovery, business continuity, severe cloud-region outage, legal compliance, security incident response, or other exceptional operational necessity, QuickHR may activate, replicate, restore, or process limited Customer Personal Data in an overseas recovery region or environment, including AWS regions outside Singapore.

Any such overseas processing will be limited to what is necessary for continuity, recovery, security, or compliance purposes, and will be subject to appropriate technical, organisational, and contractual safeguards designed to provide a standard of protection comparable to the PDPA, including encryption, access control, vendor due diligence, written data protection obligations, and documented internal approval.

Where GDPR, UK GDPR, or other overseas transfer rules apply to a specific Customer, QuickHR and the Customer may enter into the applicable Standard Contractual Clauses, UK International Data Transfer Addendum, or other lawful transfer mechanism by separate written agreement.

• 11. Third-Party Disclosures

QuickHR may disclose Personal Data only where necessary and in compliance with applicable laws. Disclosures are strictly limited to:

• Customers (Data Controllers): Where QuickHR acts as a Data Intermediary, Personal Data is disclosed only to the Customer who owns the data, in line with our contractual obligations.
• Third-Party Service Providers: Service providers engaged to support hosting, security, analytics, or other operational needs. All third-party service providers are bound by written data protection agreements imposing obligations no less stringent than those in this Notice, including confidentiality, security, and data handling requirements.
• Government or Regulatory Authorities: Where disclosure is required by law, regulation, or court order.
• Affiliates and Professional Advisors: Where necessary for legitimate business, legal, or compliance purposes, subject to equivalent confidentiality and data protection obligations.

QuickHR does not sell, rent, or trade Personal Data to third parties for marketing or commercial purposes.

• 12. Data Protection Officer (DPO)

For any enquiries, feedback, or data access/correction requests:

You may contact our DPO at dpo [at] quickhr.co, +65 6908 8158, or by mail at:

Enable Business Pte Ltd
60 Paya Lebar Road, #07-38
Paya Lebar Square
Singapore 409051

• 13. Updates to This Notice

QuickHR may update this Data Protection Notice from time to time to reflect changes in legal, regulatory, or operational requirements. Where material changes are made, we will notify Customers via email or platform alerts at least 30 days before the effective date. The effective date will always be stated at the top of this Notice.