Privacy Policy

1. Scope of this Policy

This Policy applies to personal data collected through payroll.sg, including website visitors, employer account administrators, and employees whose details are processed through our cloud payroll system.

2. Personal Data We Collect

Depending on your interaction with payroll.sg, we collect the following categories of data:

• Employer & Administrator Information: Company name, UEN, business address, administrator name, business email address, contact phone number, and billing details.
• Employee Payroll Records: Full name, NRIC/FIN (masked and securely tokenized where appropriate), residential address, date of birth, nationality, residency status (Citizen, SPR Year 1/2/3, Work Pass holder), salary details, bank account numbers, CPF contribution figures, allowances, deductions, and leave/claims records.
• Technical & Usage Data: IP address, browser type, device information, operating system, and login audit timestamps.

3. Purposes for Collecting & Processing Data

We process personal data strictly for legitimate operational purposes, including:

1. Generating accurate monthly and ad-hoc payroll calculations;
2. Computing statutory employer and employee CPF contributions and Skills Development Levy (SDL);
3. Producing compliant itemised digital payslips under the Singapore Employment Act;
4. Generating IRAS Auto-Inclusion Scheme (AIS) tax reporting files (IR8A, Appendix 8A, Appendix 8B);
5. Preparing GIRO bank payment files for Singapore commercial banks (DBS, OCBC, UOB, etc.);
6. Providing responsive customer support and responding to employer inquiries;
7. Maintaining comprehensive audit logs for compliance verification.

4. Disclosure to Third Parties

We do not sell, rent, or trade your personal data to advertisers or unauthorized third parties. We may disclose data only to:

• Statutory Authorities: Singapore government agencies (CPF Board, Inland Revenue Authority of Singapore, Ministry of Manpower) when directed or authorized by the Employer;
• Trusted Service Infrastructure Providers: Secure cloud hosting, payment gateways, and transactional email services that operate under strict non-disclosure and data protection contracts;
• Law Enforcement & Regulatory Bodies: Only where strictly compelled by applicable Singapore laws, court orders, or subpoenas.

5. Data Security & Storage Protocols

We apply robust administrative, physical, and technical safeguards:

1. Data Encryption: All data in transit is encrypted using TLS 1.3 with 256-bit encryption. Data at rest is encrypted in secure Tier-3 Singapore data centers;
2. Role-Based Access Control: Strict permission barriers ensure employer users access only authorized employee data;
3. Multi-Factor Authentication (MFA): Available and enforced for administrative access;
4. Audit Logging: All changes to employee financial data are logged with timestamps and operator identity.

6. Data Retention & Disposal

Under Singapore Employment and Tax legislation, payroll records and payslips must generally be retained for up to 5 years. Upon subscription termination and expiration of statutory retention requirements, personal data is permanently deleted or anonymized using secure electronic shredding standards.

7. Your Rights (Access & Correction)

Under the PDPA, individuals have the right to request access to and correction of their personal data. For employee data stored within payroll.sg, employees should first contact their employer's HR administrator. If you are an account owner or wish to exercise statutory privacy rights directly, please contact our Data Protection Officer.