Scope and accountability
This policy explains how Business International Chambers Limited (“BIC”, “we”, “us”) manages personal data in accordance with Singapore’s Personal Data Protection Act 2012 (“PDPA”). It covers visitors, applicants, members, event participants, partners, referrers and people who contact us through the website.
Albert Lim is the appointed Data Protection Officer (“DPO”) for bichamber.com and BIC Connect. The DPO oversees privacy enquiries, access and correction requests, retention reviews and incident escalation.
Personal data we collect
- Website enquiries: name, email, optional phone and organisation, enquiry topic and message.
- Membership applications: identity and contact details, residency, date and country of birth, nationality, education, company and professional information, interests, photograph, referrer details, declarations, consent and electronic signature.
- Membership administration: application reference, membership type, approval, payment and membership records completed by authorised BIC personnel.
- Technical information: the page used to submit an enquiry, selected language and essential security or operational records.
We do not use the BIC membership declarations as BIC Connect registration fields.
Purpose, notification and consent
We collect, use and disclose personal data only for reasonable purposes that we notify to you, including assessing and administering membership, responding to enquiries, organising programmes and events, verifying identity, maintaining member records, providing requested introductions or services, preventing misuse, meeting legal obligations and protecting BIC’s systems and users.
The enquiry form consent is limited to responding to that enquiry. It is not consent for unrelated marketing. Where consent is required, you may withdraw it by contacting the DPO; withdrawal will not affect processing already lawfully carried out and may prevent us from continuing the relevant service.
Accuracy and minimisation
We request only information reasonably needed for the stated purpose. Applicants and members should provide accurate, complete and current details. You may ask us to correct an error or omission. Do not submit unnecessary confidential information through the general enquiry assistant.
Disclosure and overseas transfers
We do not sell personal data. We may disclose it to authorised BIC personnel and service providers that support hosting, storage, security, communications, events, professional advice or legal compliance, only where reasonably necessary and subject to appropriate safeguards.
If personal data is transferred outside Singapore, we will take steps required by the PDPA to ensure a standard of protection comparable to the PDPA. When you voluntarily open the language selector, visible page text may be processed by Google Translate. Form-entry fields are marked not to be translated; machine translation remains a convenience service and should not be used to submit sensitive information.
Protection and security configuration
- HTTPS encryption for information transmitted through the websites.
- Structured records stored in protected platform databases; uploaded membership photographs stored separately from public website assets.
- Member and administrator access protected by authentication and server-side authorisation checks.
- No public endpoint for reading membership applications or enquiries.
- Prepared database statements, input validation, size limits, same-origin mutation checks and automated spam fields.
- Sensitive form values excluded from translation and not placed in public URLs.
- Administrative access restricted to authorised personnel and reviewed when roles change.
No system is completely risk-free. We review safeguards and take reasonable steps to prevent unauthorised access, collection, use, disclosure, copying, modification, disposal or similar risks.
Retention and disposal
General website enquiries are configured with a 24-month retention period and are automatically removed after expiry when the enquiry register is next processed, unless an ongoing matter or legal or business need requires longer retention. Membership and account records are reviewed according to their status and retained only while needed for membership administration, contractual, accounting, dispute, regulatory or other legitimate legal or business purposes.
When retention is no longer necessary, we will delete, securely dispose of, or anonymise the data. Different record types may have different justified retention periods.
Access, correction and withdrawal
You may contact the DPO to request access to personal data under our control, information about how it was used or disclosed during the preceding year, correction of an error or omission, withdrawal of consent, or closure/deletion where applicable. Exceptions under the PDPA may apply. Please include your name, contact email, relevant reference number and enough detail for us to identify the record.
Marketing and Do Not Call
We will not treat an enquiry or membership-service consent as blanket marketing consent. Where BIC sends marketing messages to a Singapore telephone number, it will apply the PDPA’s Do Not Call requirements unless valid clear and unambiguous consent or another applicable exception exists. Every electronic marketing message should provide a practical way to opt out.
Data-breach management
Suspected personal-data incidents are escalated to the DPO for containment, assessment, remediation and documentation. Where a breach is notifiable, BIC will notify the Personal Data Protection Commission as soon as practicable and in accordance with the statutory timeline, and will notify affected individuals where required.
Changes and contact
We may update this policy when our services, practices or legal obligations change. The effective date above identifies the current version. Questions and PDPA requests should be sent to Albert Lim, Data Protection Officer.
For authoritative regulatory information, visit the Personal Data Protection Commission.