Data Protection Notice for Job Applicants and Employees

CCIS Singapore Pte Ltd (UEN 199205611D) (“CCIS”, “we”, “us” or “our”) respects your privacy. This Notice explains how we collect, use, disclose and protect the personal data of job applicants, employees, interns and former employees (“you”) under the Personal Data Protection Act 2012 (“PDPA”).

This Notice applies together with our general Data Protection Notice and any employment contract, staff handbook or policy that applies to you. If there is any conflict, this Notice applies to personal data collected in connection with recruitment and employment.

1. Personal data we collect

We collect personal data directly from you, including through application forms and online submissions on our website, email, recruitment platforms and interviews. We also collect it from referees and other third parties you authorise.

When you apply for a job with us, we may collect:

• your name, contact details (email, phone, address) and date of birth;
• your CV, education history, professional qualifications and certifications (for example, WSH auditor approval, auditor or lead auditor registration, WSHO registration);
• employment history, current and expected salary, notice period and availability;
• information from interviews, assessments and skills tests;
• information from referees you nominate; and
• nationality and work pass status, so we can assess your eligibility to work in Singapore.

We do not ask for your NRIC, FIN or passport number at the application stage. We only collect these when they are required, typically when you accept a job offer (for example, for CPF, IRAS, MOM work pass and insurance purposes).

If you join us, we will also collect information needed to manage your employment. This includes your NRIC/FIN, bank account details, emergency contacts, dependants’ details (where relevant for benefits or insurance), medical certificates and leave records, and employment, competency, training and performance records.

2. Why we collect, use and disclose your personal data

For job applicants, we use your personal data to:

• assess your suitability, eligibility and qualifications for the role you applied for, and for other suitable roles;
• communicate with you about your application and arrange interviews;
• carry out reference and background checks, where relevant to the role; and
• prepare and issue a job offer.

For employees, we use your personal data to:

• manage and administer your employment, including payroll, CPF contributions, tax reporting, leave, benefits, insurance and claims;
• manage performance, training, career development and discipline;
• meet accreditation and regulatory requirements. As an SAC-accredited auditing organisation and MOM-accredited training provider, we may need to submit the names, qualifications, experience and competency records of our auditors, consultants and trainers to bodies such as the Singapore Accreditation Council, the Workplace Safety and Health Council, SkillsFuture Singapore and the Ministry of Manpower;
• share relevant information relating to your role, qualifications, certifications and experience with clients where necessary to deliver our services;
• keep our workplace, systems and information secure, including monitoring the use of company email, devices and IT systems in line with our IT policy;
• comply with the law, including the Employment Act, the Income Tax Act, the CPF Act and the Employment of Foreign Manpower Act; and
• manage the end of your employment, including references and record keeping.

The PDPA allows organisations to collect, use and disclose personal data without consent in certain situations. These include evaluating a job applicant’s suitability, and managing or ending an employment relationship (where we will tell you the purposes). Otherwise, we will ask for your consent.

3. Who we may share your personal data with

Only where necessary for the purposes above, we may disclose your personal data to:

• government agencies and statutory boards (for example, MOM, CPF Board, IRAS, SkillsFuture Singapore);
• accreditation and scheme owners (for example, the Singapore Accreditation Council and the Workplace Safety and Health Council);
• our clients, as described in section 2;
• service providers who support our HR, payroll, IT, insurance, banking, recruitment and training functions; and
• professional advisers such as auditors and lawyers.

We require our service providers to protect your personal data and use it only for the purposes we specify.

4. Referees and third parties

If you give us the personal data of referees, emergency contacts or family members, please make sure they are aware of this and agree to us contacting them or using their information for these purposes.

5. How long we keep your personal data

• Unsuccessful applicants: we keep your application for up to 12 months after the recruitment exercise. After that, it is securely deleted or anonymised.
• Employees: we keep your records for as long as you are employed with us, and afterwards for as long as needed for legal, regulatory, accreditation and business purposes (for example, the record-keeping periods required under employment, tax and CPF laws).

When we no longer need your personal data, we securely dispose of it or anonymise it.

6. Protecting your personal data

We protect your personal data with appropriate administrative, physical and technical measures, including access controls on a need-to-know basis, secure storage and up-to-date security software. If a data breach occurs that is likely to cause you significant harm, we will notify you and the Personal Data Protection Commission as required under the PDPA.

7. Transfers outside Singapore

Some of our service providers (for example, cloud-based email, HR or payroll systems) may store data outside Singapore. Where this happens, we take steps to ensure your personal data receives protection comparable to that under the PDPA.

8. Your rights: access, correction and withdrawal of consent

You may ask us:

• for a copy of your personal data, and information on how it has been used or disclosed in the past year;
• to correct any error or omission in your personal data; or
• to withdraw your consent for any purpose that relies on consent.

Please send your request to our Data Protection Officer (details below). We will generally respond within 30 days, and we may charge a reasonable fee for access requests (we will tell you the fee first). If you withdraw consent, we will explain the likely consequences. For example, we may not be able to continue processing your application.

9. Contact our Data Protection Officer

Data Protection Officer, CCIS Singapore Pte Ltd
16 Jalan Kilang Timor, #08-03/04/05 Redhill Forum, Singapore 159308
Email: [email protected] · Tel: +65 6376 0550

10. Changes to this Notice

We may update this Notice from time to time. The latest version will always be on this page.

Effective date: 20 October 2026 · Last updated: 20 October 2026