Privacy Policy

This Privacy Policy ("Policy") describes how Hey Rocket Pte Ltd ("Hey Rocket," "we," "us," or "our") collects, uses, discloses, and protects the personal data of individuals in accordance with Singapore’s Personal Data Protection Act 2012 ("PDPA") and Malaysia’s Personal Data Protection Act 2010.

This Policy applies to personal data that we collect, use, and store, including personal data handled by third parties acting on our behalf.

By using our services, including submitting your resume and job applications through our website, you agree to the collection, use, and disclosure of your personal data in accordance with this Policy.

Application of this policy

1. In order to provide our recruitment, employment, and workforce management services, Hey Rocket collects and processes personal data of individuals who are candidates, job applicants, contractors, and employees. Our services include:

Recruiting and placing individuals for job opportunities with our clients.
Acting as an Employer of Record (EOR) for individuals employed or engaged by Hey Rocket.
Providing payroll services and managing work pass processing.
Offering manpower outsourcing and contract staffing solutions.
Facilitating compliance with employment regulations, including foreign worker recruitment and work pass processing.

In the event we are unable to collect the required personal data from such individuals, we may not be able to proceed with the abovementioned services, including providing potential job placements, payroll processing, or employer-related services.

Personal Data

2. As used in this Policy, “personal data” refers to any data, whether true or not, that can be used to identify an individual. This includes:

2.1 Personal and Contact Information:

Full name or alias
Residential address, email, and phone number
Nationality and country of birth
Date of birth and gender
Photographs (if required for identification)

2.2 Employment and Professional Information:

Resume and job application details
Educational qualifications, professional certifications, and references
Employment history and work experience
Job preferences and salary expectations
Skills, languages, and competencies

2.3 Employment-Related Data (for EOR, Payroll & Contract Staffing):

Salary, benefits, tax, and bank account details
Work pass, visa, and immigration status (for foreign workers)
Work-related health issues (if required for workplace accommodations)
Next-of-kin and emergency contact details
Background checks, screening, or criminal records (if legally required)

3. The terms used in this Notice shall have the meanings given to them under the Personal Data Protection Act (PDPA) and any applicable data protection laws.

Collection, Use and Disclosure of Personal Data

4. We generally collect personal data through:

4.1 Direct interactions:

When you submit job applications, resumes, forms, or provide information via our website, job portals, recruitment events, or through direct communication (calls, emails, or messaging apps).

4.2 Third-party sources:

From job referral agencies, background check services, educational institutions, previous employers, or recruitment partners who are authorized to share your details with us.

4.3 Automated means:

When you visit our website, interact with our digital platforms, or use online job-matching services, certain data (e.g., IP address, browsing behavior, cookies) may be collected automatically.

5. Your personal data will be used for the following purposes:

5.1 Recruitment, Placement & Employment Services

Assessing your suitability for job roles and employment opportunities with Hey Rocket or our clients.
Matching your skills and preferences with job openings.
Conducting background checks, reference verifications, and employment eligibility screenings (if applicable).

5.2 Employment & Payroll Processing (for EOR & Contract Staffing)

Processing employment contracts, salary payments, tax filings, and statutory contributions.
Administering benefits, claims, and other HR-related services.

5.3 Work Pass & Immigration Processing (for Foreign Workers)

Assisting with work permit, visa applications, renewals, and compliance with local labor laws.
Coordinating with government agencies on employment-related matters.

5.4 Manpower Outsourcing & Client Services

Assigning and deploying workers to client projects or locations.
Managing workforce logistics, project coordination, and operational support.

5.5 Business Operations & Legal Compliance

Maintaining recruitment databases and business records.
Complying with labor regulations, employment laws, and contractual obligations.
Responding to audits, inspections, or legal inquiries.

5.6 Communication & Engagement

Providing job alerts, career advice, or industry-related updates.
Sending surveys, feedback forms, or conducting market research.

6. Your personal data may be shared with:

6.1 Employers & Clients

Companies hiring through Hey Rocket for job placement and manpower outsourcing services.

6.2 Business Partners

Authorized third parties, such as recruitment agencies, job portals, or background check providers.

6.3 Government & Regulatory Authorities

Ministries or agencies overseeing employment, work passes, taxation, or labor laws.

6.4 Service Providers

We may engage third-party vendors, including IT support, cloud storage providers, payroll processors, legal consultants, and cybersecurity firms, to support our business operations. These providers are contractually obligated to protect your data in compliance with relevant data protection laws.

7. The purposes listed in Clause 7 may continue to apply even in situations where your relationship with us (for example, pursuant to a contract) has been terminated or altered in any way, for a reasonable period thereafter (including, where applicable, a period to enable us to enforce our rights under a contract with you).

8. If you provide us with personal data of another person (for instance, a potential employee/referral), you are responsible for ensuring that such person is made aware of the data contained in this Notice and that the person has given you his/her consent for sharing the data with us.

9. In the case where we receive unsolicited personal data via email or any other communication channels that do not serve any legal or business purpose, the unsolicited personal data will not be retained and will be securely disposed of as soon as practicable.

Deemed Consent By Notification

10. We may collect, use, or disclose your personal data for purposes beyond the original intent when it is reasonable for our business operations. If we intend to rely on deemed consent by notification, we will:

10.1 Notify you through email, job application portals, or contractual agreements in cases where additional data processing is required.
10.2 Assess whether the intended collection, use, or disclosure poses no adverse effect on you.
10.3 Give you a reasonable period (e.g., 7 to 14 days) to opt out before we proceed with the new use of your data.

11. If you do not opt out within the provided timeframe, we will assume your consent to the notified purposes.

12. If you later decide to withdraw your consent, you may do so at any time by following the process outlined in the WITHDRAWING YOUR CONSENT section.

13. Examples where deemed consent by notification may apply include:

Job Matching & Employment Services: Sharing your resume and job application details with potential employers, clients, or hiring companies.
Payroll & Work Pass Processing: Submitting your details for salary payments, tax filings, CPF contributions (if applicable), and work pass applications.
Security & Compliance: Storing candidate data for compliance with local labor laws, industry regulations, or audit purposes.
Recruitment Communications: Sending job alerts, career updates, or employment-related notifications via email or messaging platforms.

14. After the lapse of the opt-out period, you may still withdraw your consent for any of these purposes. However, withdrawing consent may affect our ability to provide recruitment, payroll, or work pass services to you.

Reliance on the Legitimate Interests Exception

15. In compliance with the PDPA and relevant guidelines from the Personal Data Protection Commission (PDPC), we may collect, use, or disclose your personal data without explicit consent if it is necessary for our legitimate business interests and does not override your rights or interests.

16. Before relying on this exception, we will assess the potential impact on you and ensure that our legitimate interests outweigh any potential adverse effects.

17. Examples where we may rely on legitimate interests include:

Fraud Detection & Prevention: Identifying and mitigating fraudulent job applications or identity misuse.
Security & Access Control: Monitoring visitors and employees at our office premises for safety and compliance.
Recruitment Process Optimization: Analyzing job application trends to improve candidate placement and hiring strategies.
System Performance & Maintenance: Detecting, preventing, and resolving system errors or security threats.

18. If we rely on legitimate interest, we will take reasonable steps to protect your personal data and minimize any potential risks to your privacy.

Withdrawing Your Consent

19. You may withdraw your consent for the collection, use, and disclosure of your personal data at any time by submitting a written request. You may request to withdraw your consent at any time by contacting our Data Protection Officer (DPO) using the details provided below.

20. Upon receiving your request, we may require reasonable time (up to 14 calendar days) to process your withdrawal and notify you of any consequences. Depending on the nature of your request, this may affect:

Job applicants: We may be unable to assess your application or offer job placement opportunities.
Employees/Contractors: We may be unable to continue your employment or contract services.
Visitors to our office: We may be unable to grant access to our office premises due to security protocols.

21. Withdrawal of consent does not affect our right to continue collecting, using, or disclosing your personal data where permitted or required by law.

22. To withdraw your consent, Please contact us through our general inquiry form.

Access to and Correction of Personal Data

23. You may request to:

Access a copy of the personal data we hold about you.
Correct or update any of your personal data that is inaccurate or outdated.

24. To make an access or correction request, submit your request in writing or via email to our Data Protection Officer (DPO) at:
hello@heyrocket.com

25. We will respond to your request within 30 calendar days. If we need more time, we will notify you with an estimated timeline for our response.

26. If your request involves sensitive or extensive records, we may charge a reasonable fee to cover administrative costs. You will be informed of any fees before we process your request.

27. In some cases, we may be unable to provide certain personal data due to legal restrictions or if fulfilling the request would compromise another individual’s privacy. If we cannot fulfill your request, we will inform you of the reason (unless we are not required to do so by law).

28. Please note that depending on the request, we may only provide confirmation of the personal data held, rather than granting full access to original documents.

29. You may submit a request to access your personal data here: [Insert Access Request Form Link]

30. You may submit a request to correct your personal data here: [Insert Correction Request Form Link]

Protection of Personal Data

31. We implement appropriate administrative, physical, and technical measures to protect your personal data from unauthorized access, collection, use, disclosure, copying, modification, disposal, or similar risks.

32. Our security measures include, but are not limited to:

Access Controls: Only authorized personnel can access personal data.
Data Encryption: Sensitive information is encrypted where applicable.
Secure Storage: Personal data is stored on protected systems with security protocols.
Regular Security Reviews: We assess and update our security measures regularly.
Disposal of Data: We securely erase personal data when it is no longer needed.

33. While we strive to protect your personal data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security but are committed to continuously improving our safeguards.

Accuracy of Personal Data

34. We generally rely on the personal data provided by you (or your authorized representative). It is your responsibility to ensure that all personal data you provide to us is current, complete, and accurate.

35. If there are any changes to your personal data (e.g., change of contact information, employment details, or other relevant updates), please inform us promptly by contacting our Data Protection Officer (DPO) at the details provided below.

Retention of Personal Data

36. We retain personal data only for as long as necessary for business and legal purposes. Generally, job applicant data is kept for up to 12 months unless longer retention is required by law, regulations, or contractual obligations. Employee and contractor records may be retained longer for compliance with labor laws and tax regulations.

37. Once the personal data is no longer needed, we will take reasonable steps to delete, destroy, or anonymize it securely. However, some data may be retained for compliance, legal, or business purposes (e.g., fulfilling contractual obligations or resolving disputes).

Transfers of Personal Data Outside of Singapore

38. We may transfer, store, and process your personal data in countries outside of Singapore where our partners, clients, service providers, or data centers are located.

39. When transferring personal data overseas, we ensure that the recipient provides a standard of protection comparable to Singapore’s PDPA. This may be done through:

Contracts with data protection obligations aligned with Singapore’s PDPA.
Binding corporate rules or industry certifications.
Other legal exceptions permitted under applicable laws.

40. By submitting your personal data, you acknowledge and consent to such transfers where necessary for recruitment, placement, and HR-related services.

Data Protection Officer

41. If you have any inquiries, concerns, or requests related to your personal data, please contact us via our General Inquiry Form until a dedicated Data Protection Officer (DPO) is assigned.

Mailing Address:

Hey Rocket Pte Ltd
2 Kallang Avenue, #05-13 CT Hub,
Singapore 339407

42. When reaching out, please include:

Your full name and contact details.
A brief description of your inquiry or request.
Any relevant supporting documents (if applicable).

43. We treat all data protection inquiries seriously and will respond within a reasonable time.

Effect of Notice and Changes to Notice

44. This Privacy Policy applies in conjunction with any other policies, terms, or notices that relate to the collection, use, and disclosure of your personal data by Hey Rocket.

45. We may revise, update, or modify this Privacy Policy from time to time without prior notice.

46. You can check if there have been any updates by referring to the "Last Updated" date at the bottom of this Privacy Policy.

47. Your continued use of our services, website, or platform after any updates to this Privacy Policy constitutes your acknowledgment and acceptance of those changes.

Cookies and Tracking Technologies

48. Hey Rocket uses cookies and similar tracking technologies to enhance user experience, analyze website traffic, and improve our recruitment services.

49. Cookies may collect information such as your IP address, device type, browser information, and pages visited.

50. You can manage, block, or delete cookies via your browser settings or through our website’s cookie preference tool (if available). However, disabling certain cookies may impact your ability to use some website features.

51. By using our website, you consent to our use of cookies as outlined in this Policy.

Effective date: 18/03/2025

Last updated: 18/03/2025