Data Protection Policy

This policy explains how Inoetic Pte. Ltd. ("Inoetic", "we", "us") collects, uses, discloses and protects personal data under the Personal Data Protection Act 2012 of Singapore ("PDPA"). It covers our sports results database, its web portal and API, our website and our business dealings.

1. Who we are

2. Personal data we handle

a. Athletes and other competition participants. Our database records sports competition results that are already published by international federations, event organisers, national governing bodies and other public sources. For each result we may hold: - the participant's name; - sex or competition gender category; - nationality or the country they represent; - team or club; - the competition, event, round, result, score, ranking and medal; - where the source publishes them: date of birth, height and weight; - for para sport: the sport classification and impairment category that the governing body published.

We do not collect athlete data from the athletes themselves. We do not hold contact details, identification numbers, financial data or medical records for athletes.

b. Customers and portal users. When an organisation subscribes to our service, we hold the name, work email address, organisation and role of each person given access. We also hold sign-in records and the access tokens needed to keep a session secure.

c. Business contacts and enquiries. We hold names, work email addresses, phone numbers and correspondence with people who contact us or whom we deal with in the course of business.

d. Website and API technical data. Our servers and our hosting providers keep logs that may include IP addresses, browser type, request times and the pages or endpoints used. We use these logs to run, secure and troubleshoot the service.

3. How we collect it

• Athlete and results data: from official results publications, federation and event websites, and other public sources such as structured public reference databases. We record the source of each result so it can be traced and checked.
• Customer, user and business contact data: directly from you, or from your organisation when it arranges access for you.
• Technical data: automatically, when you use our website or API.

4. Why we use it

• Results database. We compile, verify, organise and provide sports results and statistics to our customers. These include sports bodies and public agencies, which use them for athlete development, performance analysis and sports administration.
• Providing the service. We create and manage accounts, authenticate users, give support and send service notices.
• Keeping the service secure. We prevent misuse, investigate incidents and maintain backups.
• Running our business. We handle enquiries, tenders, contracts, invoicing and record-keeping.
• Meeting legal obligations. We comply with the law and with lawful requests from authorities.

We do not sell personal data. We do not use personal data for marketing to athletes.

5. Consent, and when we rely on exceptions

• Customers, users and business contacts. We collect personal data with your consent, or where the PDPA otherwise allows us to, for example to perform a contract.
• Athletes and participants. We rely on the PDPA's exception for personal data that is publicly available, and only collect data that the source has made available to the public. We still apply our protection, accuracy, retention and correction obligations to this data.
• Business contact information. Where you give us your business contact information solely for business purposes, it is generally outside most PDPA obligations. We still protect it.

6. Who we disclose it to

• Customers. Our subscribing customers receive results data, including athlete names and the other published fields listed in section 2a, through the portal, API and exports. Customer contracts restrict use of the service to their own permitted purposes.
• Service providers. These include our hosting, content delivery, backup, email and software-development tool providers. They may only process personal data on our instructions and must protect it.
• Professional advisers, authorities and others. We disclose data where the law requires or permits it.

7. When we act for our customers

When a customer gives us personal data to process on its behalf, we act as its data intermediary. Examples include the user list for its staff, or data it asks us to load. In that role we: - process the data only on the customer's instructions; - protect it; - keep it only as long as needed; - notify the customer without undue delay if we have credible grounds to believe a data breach has occurred.

8. Transfers outside Singapore

Our database and application servers are hosted in Singapore. Some service providers may process data outside Singapore, for example: - our website and API are delivered through a global content delivery network; - our encrypted backups are kept in cloud storage.

Where personal data is transferred out of Singapore, we take appropriate steps, including contractual commitments, to make sure the recipient protects it to a standard comparable to the PDPA.

9. How we protect it

We use reasonable security arrangements suited to the data we hold. These include: - encrypted connections (HTTPS) for all portal and API traffic; - a private network tunnel between our delivery network and our servers; - authenticated access with expiring session tokens; - rate limiting of sign-in attempts; - databases that are not reachable from the internet; - access to production systems restricted to authorised personnel; - regular backups with restore testing.

10. Accuracy and corrections

Every result is linked to its source, and we correct errors when we find them or when they are reported to us. - Athletes. If you believe a record about you is wrong, contact our DPO and tell us the record and the correction. If an official source has corrected or withdrawn a result, we update our database to match. - Customers. When we correct personal data, we send the correction to organisations we disclosed that data to in the past year, unless they no longer need it.

11. How long we keep it

We keep personal data only for as long as it serves the purpose it was collected for, or as long as legal or business needs require. - Competition results. These are a historical record and are kept for as long as we provide the database. We review them regularly and update them when sources change. - Account, log, backup and business records. These are kept for set periods under our internal retention schedule, then deleted or anonymised.

12. Your rights

You may ask us to: - give you access to the personal data we hold about you, and tell you how it has been used or disclosed in the past year; - correct personal data about you that is inaccurate or incomplete; - withdraw consent you have given for our collection, use or disclosure of your data. We will tell you the likely consequences before acting on it.

Send your request to our DPO (section 1) and give enough detail for us to identify you and the records concerned. We may need to verify your identity. - Response time. We aim to respond as soon as reasonably possible and within 30 days. If we need longer, we will tell you within 30 days when we will respond. - Fees. We may charge a reasonable fee for an access request. If so, we will tell you the amount beforehand. - Refusals. Some requests may be refused where the PDPA allows it. If so, we will explain why.

13. Data breaches

We have a data breach management plan. If a data breach is likely to cause significant harm to the people affected, or affects 500 or more people, we will notify the Personal Data Protection Commission within the time the law requires. Where required, we will also notify the people affected.

14. Cookies and browser storage

Our portal does not use advertising or third-party tracking cookies. It uses your browser's storage only to: - keep you signed in during a browser session (the session token is cleared when the session ends); - remember display preferences, such as the columns you chose.

Our content delivery provider may set strictly necessary cookies for security and performance. Our website loads fonts and code libraries from third-party content networks, which receive your IP address when your browser requests them.

15. Young athletes

Results of young athletes are included where the competition organiser has published them, for example youth championships. We take extra care with this data and give priority to correction requests from young athletes and their parents or guardians.

16. Changes to this policy

We may update this policy from time to time. The current version, with its effective date, will be available on our website and on request.

17. Contact us

Questions, requests and complaints go to our Data Protection Officer:

Khoo Jie Xiong, Data Protection Officer Inoetic Pte. Ltd., 85 Tampines Street 62, #02-30, Singapore 529450 Email: [email protected]

If you are not satisfied with our response, you may contact the Personal Data Protection Commission (www.pdpc.gov.sg).