Privacy Policy

ERP21 Pte Ltd (“ERP21”, “we”, “us”) operates the ERP21 Workforce platform (the “Platform”) to recruit, onboard, schedule and pay temporary event staff. This policy explains what personal data we collect through the Platform, why, how it is protected, and your rights under Singapore’s Personal Data Protection Act (PDPA). ERP21 Pte Ltd is a licensed employment agency (MOM Licence No. 16C7929).

1. What we collect

• When you apply: full name, mobile number, email address, date of birth (to confirm eligibility), whether you have worked with us before, your availability for the project dates, and a short introduction video or photo you choose to upload.
• When you are selected and onboard: NRIC/FIN number, residential address, bank account details for salary payment, and an emergency contact — as required for employment, MOM compliance and payment.
• Your signed contract (including your electronic signature, the time of signing and the IP address it was signed from).
• While you work: shift assignments, clock-in/clock-out times, the selfie photos you take when clocking in and out, and the approximate GPS location at clock-in (to confirm you are at your assigned venue).
• Payroll: hours worked, pay rates, payslips.
• Messages we send you (WhatsApp / email) and their delivery status; one-time verification codes.

2. Why we use it

• To assess your application and contact you about it.
• To prepare your employment contract and comply with Ministry of Manpower requirements.
• To schedule you, record attendance and calculate and pay your salary.
• To send you operational messages (selection, onboarding link, contract, schedule, payslip) via WhatsApp or email.
• To keep the Platform secure (audit logs of who changed what, one-time codes, login sessions).

We do not sell your data and we do not use it for advertising.

3. Who can see it

• ERP21 staff with a business need (recruiters, operations, finance). Access is role-based; NRIC numbers are masked for most staff, and every access to sensitive fields is logged.
• Service providers that host or deliver the Platform on our behalf: cloud hosting and database (Vercel, Supabase — data stored in the Singapore region), Meta (WhatsApp Business messages) and our email provider (Resend). They process data only on our instructions.
• The event client / venue may see your name and attendance where needed to run the event — never your NRIC or bank details.
• Authorities where required by law (e.g. MOM, IRAS, CPF Board).

4. How we protect it

Sensitive fields (NRIC, address, bank details, emergency contact) are encrypted in the database. Photos, videos and contracts are stored in private storage and served only through short-lived links. Staff accounts require two-factor authentication. Communications use HTTPS.

5. How long we keep it

Application and onboarding data is kept for the duration of the project and approximately six months after the project ends, then archived or deleted, except where a longer period is required by law (e.g. payroll and employment records, which are kept for the statutory period). Unsuccessful applications are kept for the same window so we can consider you for future projects, unless you ask us to delete them earlier.

6. Your rights

You may ask to access or correct your personal data, withdraw consent (which may mean we can no longer engage you), or ask us to delete data we are not legally required to keep. Contact our Data Protection Officer at abbas@erp21.com.sg or 6509 4221 (1 Eastwood Drive, Singapore 486528).

7. Messages and WhatsApp

By providing your mobile number you agree to receive operational messages about your application and work via WhatsApp (sent from our verified business number) or SMS, and by email. These are not marketing messages. You can reply STOP or contact us to opt out; note that we may then be unable to schedule you.

8. Changes

We may update this policy from time to time; the latest version is always at this address.