Privacy Policy

Nine Suites Construction Pte. Ltd. (UEN 202512784E) (“Nine Suites”, “we”, “us” or “our”) is a general building contractor registered in Singapore, with its registered office at 5 Tampines North Drive 5, Reebonz Building, Singapore 528548.

We are the organisation responsible for the personal data described in this policy. If you have any question about this policy or about how your personal data is handled, please contact us using the details at the end of this page.

This policy applies to:

• our website at https://ninesuites.com.sg and any page on that domain; and
• the Nine Suites mobile application (Android package sg.com.ninesuites.saas), which is a workforce and site-productivity application provided to our employees and to authorised personnel of our clients and subcontractors.

The Nine Suites application is an internal business tool. It is not a consumer product, it is not directed at children, and access requires an account issued by us or by the organisation that engaged us.

Through our website

• Contact details you choose to submit through an enquiry — such as your name, email address, telephone number, company name, and the content of your message.
• Technical information automatically recorded by our web server, such as IP address, browser type, referring page, and the date and time of your visit. This is used to keep the site secure and available.

Through the Nine Suites application

The application collects the following categories of data, in each case only from users who have signed in with an account issued to them:

• Account and identity data — your name, employee or worker identifier, work email address, job role, assigned project or site, and your employer or engaging organisation.
• Attendance and time records — clock-in and clock-out events, shift and timesheet records, leave applications and their approval status.
• Location data — the approximate or precise location of your device at the moment you record an attendance or check-in event, so that the record can be attributed to the correct work site. The application does not track your location continuously and does not record your location in the background.
• Camera and photographs — the camera is used to scan site QR codes and to let you attach photographs to a site or project report. Photographs are captured only when you actively take or select them.
• Files and documents — documents or images you attach to a report, and digital signatures you draw to acknowledge a record.
• Device and diagnostic data — device model, operating system version, application version, and crash and error reports, used to diagnose faults and improve reliability.
• Push notification identifiers — a device token used to deliver work-related notifications, such as an approval or a schedule change.

We use personal data for the following purposes:

• To respond to enquiries submitted through our website.
• To administer employment and engagement records, including attendance, timesheets, leave and payroll administration.
• To manage and supervise work on our project sites, including allocating personnel and verifying that work was carried out at the correct location.
• To meet workplace safety and health obligations and to maintain records required for site safety.
• To prepare, review and retain project and site reports.
• To operate, secure, troubleshoot and improve our website and the application.
• To comply with applicable law, and with the requests of regulators, government agencies and our clients where we are legally or contractually required to do so.

Where the PDPA requires your consent, we collect, use or disclose your personal data only with your consent, or where the PDPA otherwise permits us to do so — for example, where the data is reasonably required to manage or terminate an employment relationship.

We do not sell personal data, and we do not share it for advertising purposes. We disclose personal data only as follows:

• Your employer or engaging organisation — where you use the application as an employee of, or a worker engaged by, another organisation, your attendance, leave and report records are made available to that organisation’s authorised supervisors and administrators.
• Service providers — cloud hosting, database, crash-reporting, analytics and notification providers who process data on our behalf and under contract. These currently include Microsoft Azure and Google Firebase.
• Professional advisers — auditors, insurers and legal advisers, where required.
• Legal and regulatory recipients — where disclosure is required by law, by court order, or by a government or regulatory authority.

Some of our service providers store or process data outside Singapore. Where personal data is transferred out of Singapore, we take reasonable steps to ensure that the recipient is bound by legally enforceable obligations to protect the data to a standard comparable to that required under the PDPA.

We retain personal data only for as long as it is needed for the purposes described in this policy, or for as long as we are required to retain it by law — for example, employment, safety and tax records that must be kept for a prescribed period. When personal data is no longer required for any legal or business purpose, we take reasonable steps to destroy it or to remove the means by which it can be associated with an individual.

We apply reasonable administrative, physical and technical safeguards to protect personal data against unauthorised access, collection, use, disclosure, copying, modification, disposal or similar risks. These include access control on an as-needed basis, encrypted transmission over HTTPS, and account authentication for the application.

No method of transmission or storage is completely secure. Please keep your account credentials confidential and notify us immediately if you believe your account has been compromised.

Under the PDPA you may, subject to the exceptions in the Act:

• Request access to the personal data we hold about you, and information about how it has been used or disclosed in the past year.
• Request correction of personal data that is inaccurate or incomplete.
• Withdraw consent to our continued collection, use or disclosure of your personal data.

To make a request, contact us using the details below. We may need to verify your identity before responding, and we will respond within the timeframes required by the PDPA. Please note that withdrawing consent may prevent us from continuing to provide the application to you, and may affect an existing employment or contractual relationship.

The application requests device permissions for location, camera and file storage. You may grant or revoke each permission at any time through your device settings. If a permission is revoked, the corresponding feature — for example, recording a site check-in or attaching a photograph to a report — will not function, but the rest of the application will continue to work.

You may also uninstall the application at any time. Uninstalling stops any further collection of data by the application; it does not delete records already submitted to your employer or engaging organisation.

Our website uses only what is necessary to serve and secure the pages you request. We do not use advertising cookies and we do not use cookies to build a profile of you across other websites. You can configure your browser to refuse cookies; the site will continue to function.

Neither our website nor the application is directed at children. The application is issued only to persons who are lawfully engaged to work on our projects. We do not knowingly collect personal data from children.

We may update this policy from time to time. The revised version will be posted on this page with a new “last updated” date, and takes effect when posted. Where a change materially affects how we handle your personal data, we will take reasonable steps to bring it to your attention.