Privacy policy

Data Protection Officer

We have appointed a Data Protection Officer who is responsible for ensuring our compliance with the PDPA. You may contact our Data Protection Officer about anything in this policy, to exercise your rights, or to raise a concern:

Data Protection Officer
Logical Systems Pte Ltd
60 Paya Lebar Road, #06-28, Singapore 409051
✉ dpo@logicalsystems.io
☎ +65 8569 3886

What we collect

When you send us an enquiry. Your name, email address, telephone number, country, the service you are interested in, and the content of your message. You also tell us whether you wish to receive further communications.

When you apply for a role. Your name, email address, telephone number, address, preferred office location, years of experience, industry experience, covering message, and the CV you attach. A CV often contains further information such as your employment history, education and qualifications. Please do not include identification numbers, financial details, photographs or health information — we do not need them to assess your application.

When you use our Customer Portal. If your organisation is our customer and invites you to the Customer Portal, we hold your name, business email address, the job title and phone number you give us, the language you choose for the portal, your sign-in details (your password only in a one-way hashed form, and the key of your authenticator app encrypted), the tickets, messages and files you send us, and security records of your sign-ins and of what is done in the portal.

Automatically, when you visit. Our hosting provider records your IP address, browser and device type, the pages you request, the date and time, and the page you arrived from. This is used to operate and secure the site.

When you send a form. To block automated spam, we keep a coded version of your IP address (a keyed hash, not the address itself) and the time you sent the form, so we can limit how many forms one network can send in an hour. It is deleted after one hour.

Website analytics. Our own analytics tool counts which pages are visited, how visitors found the site, and the type of browser, device and approximate country. It uses no cookies, and your IP address is shortened before it is stored, so the records do not identify you. See Cookies and tracking.

Cookies. See Cookies and tracking.

We do not collect personal data from you for any purpose other than those described in this policy, and we do not make automated decisions about you.

Why we collect it

Under the PDPA we must tell you the purposes for which we collect, use and disclose your personal data, and obtain your consent unless an exception applies. Our purposes are:

• Responding to your enquiry and providing information about our services.
• Assessing your application for employment, contacting you about it, and where you agree, keeping your details on file for future openings.
• Giving our customers’ contacts access to our Customer Portal, providing the support and information their organisation has asked for, and keeping the portal secure.
• Operating, maintaining and securing this website, and investigating misuse.
• Understanding, in anonymised and aggregated form, how this website is used, so we can improve it.
• Meeting our legal, regulatory and contractual obligations.

Where you submit a form, you give consent at the point of submission. Where we rely on an exception under the PDPA — for example the legitimate interests exception for website security logging — we have assessed that our legitimate interests outweigh any adverse effect on you.

For website analytics we rely on the same legitimate interests exception and, where European data protection law applies, on our legitimate interest in understanding how our website is used (Article 6(1)(f) GDPR). You can object at any time, as described under Cookies and tracking.

We do not sell personal data, and we do not share it for anyone else’s marketing.

Cookies and tracking

This website does not use cookies for analytics, advertising or tracking, and it does not load content from other companies’ servers. The only cookies it may set are strictly necessary ones, and these do not need your consent. Our customer and employee portals at portal.logicalsystems.io likewise set only cookies they need to work — to keep you signed in, to protect their forms and, if you choose a language there, to remember your choice for a year.

Analytics. We count visits with Matomo, an analytics tool that runs on our own hosting, so the data is not shared with any analytics company. It is set up without cookies; your IP address is shortened (the last two of its four parts are removed) before it is stored, and we use the results only in aggregate. Individual visit records are deleted after 180 days.

Your visits are not counted if your browser sends a Global Privacy Control or Do Not Track signal, or if JavaScript is switched off. You can also opt out here:

If we ever add an optional cookie, we will update this section first and ask for your consent before setting it. Refusing will be as easy as accepting, and you will be able to change your choice at any time.

Who we disclose to

We disclose personal data only to organisations that provide services to us, and only so far as they need it to provide those services. Each is bound by contract to protect it to a standard at least equivalent to our own obligations under the PDPA.

• Newfold Digital / Bluehost — hosting of this website and of our customer and employee portals, their server logs and our website analytics.
• Microsoft — Microsoft 365, which receives and stores enquiry and application emails, and the notices our staff receive from the Customer Portal.
• Our payroll and professional advisers — only where relevant to employment or a legal obligation.

We may also disclose personal data where we are required or permitted to do so by law, or to protect our legal rights.

Transfers outside Singapore

This website and our portals are hosted in the United States. Personal data you submit through them is therefore transferred outside Singapore.

Before transferring personal data out of Singapore we take steps, as required by section 26 of the PDPA and Regulation 10 of the Personal Data Protection Regulations, to satisfy ourselves that the recipient is bound to provide a standard of protection comparable to that under the PDPA. Where the transfer is also subject to European data protection law, we rely on the European Commission’s Standard Contractual Clauses supported by a transfer impact assessment. A copy of the relevant safeguards is available from our Data Protection Officer on request.

How long we keep it

We keep personal data only for as long as it is needed for the purpose it was collected for, or for as long as we are required to keep it by law. In practice:

• Enquiry correspondence — 24 months from our last contact with you.
• Unsuccessful job applications — 6 months from the date of our decision, unless you agree to a longer period.
• Applications kept on file for future roles — 12 months, after which we delete them or ask you again.
• Website and security logs — 12 months.
• Form spam protection — the coded version of your IP address, for one hour.
• Website analytics — individual visit records, with shortened IP addresses, for 180 days; aggregated statistics, which do not identify anyone, for as long as they are useful.
• Customer Portal accounts, tickets and attached files — as set out in the Customer Portal privacy notice.

When personal data is no longer needed for any legal or business purpose, we delete it or anonymise it.

How we protect it

We are certified to ISO/IEC 27001 and operate an information security management system covering the protection of personal data. Measures relevant to this website include:

• All traffic to this site is encrypted using TLS, and unencrypted requests are redirected to the secure address.
• Documents you send us, including CVs, are stored outside the publicly accessible area of the web server.
• Access to personal data is restricted to staff who need it for their role, using accounts protected by multi-factor authentication.
• We commission independent penetration testing of our public web presence.
• We maintain a documented process for assessing and responding to data breaches.

Your rights

Access. You may ask us for the personal data we hold about you and for information about how it has been used or disclosed in the year before your request.

Correction. You may ask us to correct an error or omission in your personal data. We will correct it unless we are satisfied on reasonable grounds that a correction should not be made, and we will let you know either way.

Withdrawal of consent. You may withdraw your consent to our continued collection, use or disclosure of your personal data at any time by writing to our Data Protection Officer. Before we act on a withdrawal we will tell you what the likely consequences are — for example, we may no longer be able to consider you for a role.

If European or United Kingdom data protection law applies to you, you may in addition ask us to erase your personal data, to restrict how we use it, to provide it to you or another organisation in a portable form, or to object to our use of it where we rely on legitimate interests.

To exercise any of these, write to dpo@logicalsystems.io. We may need to verify your identity first. We will respond within 30 days, or tell you within 30 days when to expect our response. There is no charge for a correction request; a reasonable fee may apply to an access request, and we will tell you the amount before proceeding.

Data breaches

If a data breach occurs that is likely to result in significant harm to affected individuals, or that is of a significant scale, we will notify the Personal Data Protection Commission and, where required, the individuals affected, within the timeframes set out in Part VIA of the PDPA. Where European data protection law applies, we will notify the competent supervisory authority within 72 hours of becoming aware of a breach unless it is unlikely to result in a risk to individuals.

Children's data

This website and our services are directed at businesses and working professionals. We do not knowingly collect personal data from children. If you believe a child has given us personal data, please contact our Data Protection Officer and we will delete it.

United States residents

Several states in the United States grant residents rights over their personal information. Most of these laws apply only to organisations above thresholds that we do not meet, and many exclude information collected in a business-to-business context. We nonetheless extend the following to residents of any US state, without requiring you to establish that a particular law applies.

You may ask us to confirm whether we hold personal information about you and to provide a copy; to correct it; and to delete it. You may also ask us not to use it for targeted advertising. We will not treat you differently for exercising any of these rights — you will receive the same service and the same pricing.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We have never done so. If that ever changes, we will update this policy and provide an opt-out before the change takes effect.

We honour the Global Privacy Control signal. If your browser sends one, we do not count your visits in our analytics and we treat it as an instruction to disable any non-essential cookies, without any further action from you.

To exercise any of these rights, write to dpo@logicalsystems.io. We will respond within 45 days, and will tell you if we need a further 45 days. You may use an authorised agent, in which case we may ask you to verify that you authorised them.

Complaints and changes

If you are unhappy with how we have handled your personal data, please contact our Data Protection Officer first — we would rather put it right directly. You also have the right to complain to the Personal Data Protection Commission of Singapore at www.pdpc.gov.sg. If you are in the European Economic Area or the United Kingdom, you may complain to the supervisory authority where you live or work.

We may update this policy from time to time. The date at the top shows when it was last changed. Where a change is significant we will take reasonable steps to bring it to your attention.