Privacy Policy

1. Introduction

Singapore Spurs Supporters Club ("the Club," "we," "us," or "our") is committed to protecting the personal data of our members, website visitors, and event participants in accordance with the Personal Data Protection Act 2012 (No. 26 of 2012) of Singapore ("PDPA") and its subsidiary legislation, as administered by the Personal Data Protection Commission ("PDPC").

This Privacy Policy explains how we collect, use, disclose, and protect personal data through:

• Our website sgspurs.movit.asia ("the Website");
• Our online membership registration and management system ("the Membership System");
• Club events, meet-ups, ticket ballots, and merchandise sales;
• Our social media pages and communication channels (email, WhatsApp, Telegram, Facebook, etc.).

By registering as a member, using the Website, or otherwise providing us with your personal data, you acknowledge that you have read and understood this Privacy Policy and consent to the practices described herein.

2. Definitions

• "Personal Data" means data, whether true or not, about an individual who can be identified from that data, or from that data and other information to which we have or are likely to have access.
• "Member" means any individual who holds active, lapsed, or pending membership with the Club, in any tier.
• "Data Intermediary" means a third-party organisation that processes personal data on our behalf and on our instructions, but does not include an employee of the Club.
• "PDPA" means the Personal Data Protection Act 2012 of Singapore, as amended from time to time, and its subsidiary legislation.

3. Scope and Application

This Policy applies to personal data collected from:

• Prospective, current, and lapsed members of the Club;
• Visitors to the Website;
• Individuals who register for Club events, ballots, or merchandise orders;
• Individuals who contact the Club via any communication channel.

This Policy does not apply to third-party websites or services that may be linked from our Website. We encourage you to review the privacy policies of any third-party sites you visit.

4. Personal Data We Collect

Depending on your interaction with us, we may collect the following categories of personal data:

4.1 Membership Registration Data

• Full name (as per NRIC/FIN/passport)
• NRIC/FIN/passport number — collected and retained only where reasonably necessary to verify identity (e.g., to prevent duplicate memberships or for age-restricted event ballots) or where required by law, in line with the PDPC's Advisory Guidelines on the NRIC/FIN number. Where full verification is not required, we collect only the last 4 digits
• Date of birth
• Nationality
• Gender
• Mailing address
• Email address
• Mobile/contact number
• Membership tier and membership ID
• Emergency contact details (where provided)
• Photograph (for membership card, where applicable)

4.2 Payment and Transaction Data

• Payment method details (processed via third-party payment gateways; we do not store full credit/debit card numbers)
• Transaction history, membership fees paid, renewal dates
• Billing address

4.3 Website and Technical Data

• IP address, browser type, device information
• Login credentials (username, encrypted password)
• Cookies and similar tracking technologies (see Section 10)
• Pages visited, time spent, referral source, click patterns

4.4 Event and Engagement Data

• Event registration and attendance records
• Ticket ballot entries and outcomes
• Match-day survey responses or feedback
• Photographs and video footage taken at Club events (for publicity, subject to Section 6.4)

4.5 Communications Data

• Correspondence with the Club (emails, WhatsApp/Telegram messages, contact form submissions, committee meeting minutes involving members)
• Complaints, feedback, and enquiries

We do not knowingly collect sensitive personal data (e.g., health, religion, race) unless voluntarily provided by you (e.g., dietary or accessibility requirements for an event), and only for the specific purpose disclosed at the point of collection.

5. How We Collect Personal Data

We collect personal data through:

• Direct submission via online membership registration forms;
• Website account creation and login;
• Event sign-up forms and ballot applications;
• Email, phone, or in-person correspondence with committee members;
• Automated collection via cookies and analytics tools when you browse the Website;
• Payment gateway providers (transaction confirmation data only; we do not receive full card details).

6. Purposes for Collection, Use, and Disclosure

We collect, use, and disclose your personal data only for purposes that a reasonable person would consider appropriate in the circumstances, and for which we have obtained your consent (or which are permitted/required without consent under the PDPA), including:

6.1 Membership Administration

• Processing membership applications, renewals, and upgrades
• Verifying identity and eligibility for membership tiers
• Issuing and managing digital or physical membership cards
• Maintaining an accurate membership register

6.2 Transactions

• Processing payments for membership fees, merchandise, and event tickets
• Issuing receipts and maintaining financial records for accounting and audit purposes

6.3 Communications

• Sending administrative notices (renewal reminders, changes to Club rules, AGM notices)
• Responding to enquiries, feedback, and complaints
• With your separate consent, sending marketing and promotional communications (match viewing parties, merchandise launches, sponsor offers)

6.4 Events and Publicity

• Organising and managing Club events, ballots, and away-day trips
• Publishing photographs/videos from Club events on the Website, social media, or newsletters for publicity purposes (you may opt out — see Section 9)

6.5 Legal and Administrative Compliance

• Complying with applicable laws, regulations, and requests from public authorities
• Enforcing our Terms of Membership and Club rules
• Establishing, exercising, or defending legal claims

6.6 Website and System Improvement

• Website analytics and performance monitoring
• Detecting, preventing, and investigating fraud, unauthorised access, or security incidents
• Improving the functionality of the Membership System

We will not use your personal data for a new purpose not previously notified to you unless required or authorised by law, and we will seek fresh consent where necessary.

7. Legal Basis for Processing (Consent and Exceptions)

Under the PDPA, we rely primarily on your consent, given at the point of registration or when you provide your data, as the basis for processing. Consent may be given expressly (e.g., ticking a consent checkbox) or deemed (e.g., where you voluntarily provide data for a purpose reasonably necessary to conclude that transaction).

In limited circumstances, we may collect, use, or disclose personal data without consent where permitted under the PDPA, including:

• Where necessary for any investigation or proceedings;
• Where necessary to respond to an emergency that threatens life, health, or safety;
• Where required to comply with legal or regulatory obligations;
• Where the data is publicly available.

You may withdraw your consent at any time by submitting a written request to our Data Protection Officer (see Section 13). Please note that withdrawal of consent for certain purposes (e.g., processing of membership fees) may result in our inability to continue providing you with membership benefits, and we will inform you of the likely consequences before effecting your withdrawal request.

8. Disclosure of Personal Data to Third Parties

We do not sell your personal data. We may disclose personal data to the following categories of third parties, strictly for the purposes set out in Section 6:

All third-party service providers engaged by the Club are contractually bound to protect personal data to a standard comparable to the PDPA and to use it solely for the purposes we specify.

9. Your Rights

Subject to applicable exceptions under the PDPA, you have the right to:

• Access the personal data we hold about you and information on how it has been used or disclosed in the past year;
• Correct any error or omission in your personal data;
• Withdraw consent for the collection, use, or disclosure of your personal data (see Section 7);
• Object to your photograph/likeness being used in Club publicity materials;
• Request deletion of your personal data upon termination of membership, subject to our legal and administrative retention requirements (see Section 11).

To exercise any of these rights, please submit a request to our Data Protection Officer (Section 13). We will respond within 30 days. A reasonable administrative fee may apply for access requests, of which we will notify you in advance.

10. Cookies and Tracking Technologies

Our Website uses cookies and similar technologies to:

• Keep you logged in to the Membership System;
• Remember your preferences;
• Analyse website traffic and usage patterns.

You may disable cookies through your browser settings; however, this may affect your ability to use certain features of the Website, including logging into the Membership System.

11. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law, including:

• Active membership records: retained for the duration of membership and up to 5 years after lapse/termination, for historical and administrative continuity;
• Financial/transaction records: retained for a minimum of 5 years in accordance with accounting and tax record-keeping requirements;
• Website account data: retained until account deletion is requested, or 5 years of inactivity;
• Event photographs/videos: retained indefinitely for archival/publicity purposes unless an opt-out request is received.

Upon expiry of the relevant retention period, we will securely destroy or anonymise the personal data.

12. Protection of Personal Data

We implement reasonable technical, administrative, and physical security measures to protect personal data against unauthorised access, collection, use, disclosure, copying, modification, or disposal, including:

• Encrypted data transmission (HTTPS/TLS) across the Website and Membership System;
• Access controls and role-based permissions restricting data access to authorised committee members only;
• Secure, access-controlled hosting infrastructure with regular backups;
• Hashing/encryption of passwords; no storage of full payment card data;
• Periodic review of data protection practices and committee training on PDPA obligations.

No method of transmission or storage is 100% secure. In the event of a data breach that poses a risk of significant harm to affected individuals, we will notify the PDPC and affected individuals as required under the PDPA's mandatory data breach notification regime, without undue delay and in any case within 72 hours of assessing the breach as notifiable.

13. Data Protection Officer

In accordance with the PDPA, we have appointed a Data Protection Officer ("DPO") responsible for ensuring compliance with this Policy and the PDPA.

Data Protection Officer
Singapore Spurs Supporters Club
Email: admin@spurs-sg.org
Mailing Address: Club's Mailing Address

All requests regarding access, correction, withdrawal of consent, or complaints relating to personal data should be directed to the DPO.

14. Cross-Border Transfer of Personal Data

Where personal data is transferred to a server, service provider, or recipient located outside Singapore (e.g., cloud hosting, payment processors), we will ensure that the overseas recipient is bound by legally enforceable obligations to provide a standard of protection comparable to the PDPA, whether through contractual clauses, certification schemes, or equivalent mechanisms.

15. Children's Data

Where a family or junior membership category permits registration of a minor, personal data of the minor will only be collected with the consent of a parent or legal guardian, who shall be responsible for reviewing this Policy on the minor's behalf.

16. Marketing Communications and Opt-Out

Where you have consented to receive marketing communications (e.g., sponsor promotions, merchandise announcements), you may withdraw consent at any time by:

• Clicking "unsubscribe" in any marketing email; or
• Notifying the DPO directly.

We will process opt-out requests within a reasonable time and in any event within 10 business days, in accordance with the PDPA's Do Not Call and marketing consent provisions where applicable.

Where we send marketing messages to Singapore telephone numbers (SMS, calls, or messaging apps), we will check the Do Not Call ("DNC") Registry before doing so, unless you have given clear and unambiguous written consent to receive such messages from the Club, in which case the DNC Registry checks do not apply to us for that communication.

17. Governing Law

This Privacy Policy is governed by the laws of the Republic of Singapore, including the PDPA. Any disputes arising from or in connection with this Policy shall be subject to the exclusive jurisdiction of the courts of Singapore.

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our data practices or legal requirements. The updated Policy will be posted on the Website with a revised "Last Updated" date. Where changes materially affect how your personal data is used, we will notify active members via email prior to the changes taking effect.

19. Contact Us

If you have any questions, feedback, or complaints about this Privacy Policy or our data protection practices, please contact:

Singapore Spurs Supporters Club — Data Protection Officer
Email: admin@spurs-sg.org
Address: 26 Woodsville Close, #15-02 Singapore 357774

You also have the right to lodge a complaint with the Personal Data Protection Commission of Singapore (PDPC) at www.pdpc.gov.sg if you believe your personal data has been mishandled.

---

This Privacy Policy should be read together with the Club's Terms of Membership and Website Terms of Use.