Privacy & Data Protection

Overview

Elitez EOR ("we", "us", "our") is committed to protecting your personal data in accordance with the Personal Data Protection Act (PDPA). This Privacy Policy explains how we collect, use, disclose, and protect your information.

1. Data we collect

From employers (you):

• Name, email, phone, company name, and UEN
• Bank account details (for billing)
• Upload: CPF Form 90 or payroll record (for headcount verification)

From your employees:

• Full name, NRIC (collected at onboarding only, not on application forms)
• Date of birth, residency status, email
• Bank account details (for salary deposit)
• Monthly wages and salary information
• CPF contribution records

From your website visits:

• IP address, browser type, pages visited, and timestamps (for security and analytics)
• No cookies unless you sign in (Supabase session cookie only)

2. How we use your data

You (employer): We use your data to deliver the service—billing, account management, communicating updates, and complying with legal requests.

Your employees: We use employee data to compute CPF contributions, generate payslips, file CPF EZPay and IR8A, and maintain payroll records as required by law.

Legal basis: For employment-related data, the PDPA allows collection without consent where it is "necessary for the purpose of managing or terminating the employment relationship." We also collect under contract (to deliver payroll services to you).

3. Handling of NRIC

Collection: We collect NRIC only at onboarding, never on public forms or enquiry pages, per PDPA Advisory Guidelines.

Display: NRIC is masked as the last 4 characters only (e.g., *****567A). Full NRIC is never shown in the UI after initial entry.

Use: NRIC is used to verify employee identity and file CPF contributions. It is never used as a login factor or authentication method.

Storage: We do not keep scans of physical NRIC cards unless a work-pass process requires them.

4. Data retention

• Payroll records: 5 years from the relevant tax year (IRAS requirement)
• Employment records (MOM): Latest 2 years for current employees; last 2 years kept for 1 year after employee leaves
• CPF records: Retained as per CPF Board requirements (duration unconfirmed; assume 5+ years)
• Account data (employer): Retained for the duration of the contract plus 2 years unless you request deletion

5. Data security

We use:

• Supabase (secure cloud database) with encryption in transit and at rest
• Row-Level Security (RLS) to ensure only authorised staff can access your data
• Audit logging of all data access
• TLS 1.2+ for all connections
• Regular security reviews and penetration testing

No guarantee of absolute security. While we implement industry-standard measures, no system is 100% secure. We recommend using strong passwords and enabling two-factor authentication where available.

6. Data disclosure

We do not sell your data. We may disclose data:

• To your employees: Payslips (necessary for payroll)
• To CPF Board: CPF contributions and employee details (legal requirement)
• To IRAS: IR8A and employment income (legal requirement)
• To service providers: Instarem (payment processor), Supabase (database), and others as needed to deliver the service
• To legal authorities: In response to court orders or lawful requests

7. Breach notification

If a data breach occurs that causes significant harm or affects 500+ individuals:

• We will notify the Personal Data Protection Commission (PDPC) within 3 calendar days of confirming the breach
• We will notify affected individuals within 30 calendar days
• We will document the incident and provide remediation steps

8. Your rights under PDPA

• Access: You have the right to request a copy of your personal data. Contact privacy@elitez.ai.
• Correction: You can request correction of inaccurate data.
• Withdrawal of consent: Where consent was required, you may withdraw it (though this may affect our ability to serve you).
• Opt-out: You may opt out of certain non-essential processing (e.g., marketing emails).

9. Data Protection Officer

Placeholder: [DPO name and contact to be confirmed] or contact privacy@elitez.ai.

10. Cross-border transfer

Your data is processed in Singapore. If Supabase or our payment processor routes data outside Singapore for processing or backup, it remains subject to contractual safeguards equivalent to Singapore PDPA standards.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting the updated policy here.

12. Contact us

If you have questions or concerns about our data practices, please contact:

Email: privacy@elitez.ai
Or use our contact form.