Introduction

Lucky Joint Construction Pte Ltd (“LJC”, “we”, “us” or “our”) respects your privacy and is committed to safeguarding the personal data entrusted to us.

This Privacy Policy explains how we collect, use, disclose, transfer, protect and retain personal data in accordance with the Personal Data Protection Act 2012 of Singapore (the “PDPA”) and its subsidiary legislation. It applies to personal data collected through this website (www.luckyjoint.com.sg) and through our related business dealings, including enquiries made by email, telephone or messaging channels.

By submitting personal data to us, or by continuing to use this website, you acknowledge that you have read and understood this Policy.

Data Protection Officer

In line with our accountability obligations under section 11(3) of the PDPA, we have appointed a Data Protection Officer (“DPO”) responsible for ensuring compliance with the PDPA.

You may contact our DPO on any matter relating to this Policy or your personal data:

The Data Protection Officer
Lucky Joint Construction Pte Ltd
17 Tuas Avenue 3, Singapore 639414
Email: dpo@luckyjoint.com.sg
Telephone: +65 6284 0288

What is personal data

“Personal data” means data, whether true or not, about an individual who can be identified from that data, or from that data together with other information to which we have or are likely to have access.

Personal data we collect

Data you provide to us directly

Website enquiry form. When you submit the enquiry form on our Contact Us page, we collect your name and email address (both mandatory), together with the subject and contents of your message, and any other information you choose to include.

Direct correspondence. When you contact us by email, telephone, WhatsApp or through our social media pages, we collect your name, contact details and the contents of your communication.

Business and project dealings. In the course of tendering for, negotiating and delivering projects, we may collect the names, job titles, business contact details and correspondence of individuals representing our clients, consultants, sub-contractors, suppliers and business partners.

Career enquiries. Where you write to us at careers@luckyjoint.com.sg, we collect the personal data contained in your email, resume or CV which may include your name, contact details, education, employment history, qualifications, certifications and any other information you choose to submit.

Data collected automatically

When you browse this website, our servers and service providers may automatically log technical data including your IP address, browser type and version, operating system, device type, referring URL, pages visited, and date and time of access. This data is used for security, diagnostics and understanding site usage. It is generally not used to identify you personally, though in some circumstances it may constitute personal data under the PDPA.

Data from third parties

We may receive personal data from third-party sources such as your employer or organisation, publicly available business directories, industry bodies, referral partners, and government or statutory agencies in connection with tenders and projects.

Business contact information

Under section 4(5) of the PDPA, most of the PDPA’s Data Protection Provisions do not apply to business contact information which means an individual’s name, position, business telephone number, business address, business email and similar information that is not provided solely for personal purposes.

Because our work is business-to-business, much of the data we handle is business contact information. Nevertheless, as a matter of good practice, we apply the standards set out in this Policy to business contact information as well.

Purposes for which we use personal data

We collect, use and disclose personal data for the following purposes:

Responding and engaging

• Responding to your enquiries, requests, feedback and complaints
• Providing quotations, proposals and tender submissions
• Communicating with you about our services

Delivering our services

• Establishing and managing business relationships with clients, consultants, sub-contractors, suppliers and partners
• Planning, executing, supervising and maintaining projects
• Managing site access, safety, quality assurance and incident reporting
• Processing orders, invoicing, payments and accounts

Recruitment

• Assessing suitability for employment and processing job applications
• Conducting reference, background, qualification and right-to-work checks (where lawful and with appropriate consent)

Business administration and improvement

• Maintaining records, conducting internal audits and quality management (including in support of our ISO and BCA certifications)
• Improving our website, services and customer experience
• Managing and securing our IT systems
• Marketing and communications (only where you have consented, or where permitted by law)
• Sending you company updates, newsletters, project news and invitations to events

Legal and regulatory

• Complying with applicable laws, regulations, codes of practice, licensing conditions and industry standards
• Responding to requests from courts, regulators, law enforcement or government agencies
• Establishing, exercising or defending legal claims
• Preventing, detecting and investigating fraud, misconduct or unlawful activity

We will not use your personal data for any purpose other than those notified to you, unless we obtain your consent or are permitted or required to do so by law.

Consent

How we obtain consent

We collect, use and disclose personal data where you have given consent, where consent is deemed under the PDPA, or where collection, use or disclosure without consent is permitted or required by law (including under the First and Second Schedules to the PDPA — for example, where it is necessary for legitimate interests, for business improvement, or in an emergency).

Deemed consent. Where you voluntarily provide your personal data to us for a purpose that is reasonably obvious in the circumstances, for example, submitting your email address so that we can reply to your enquiry, you are deemed to consent to our collection, use and disclosure of that data for that purpose.

Withdrawing consent

You may withdraw your consent to our collection, use or disclosure of your personal data at any time by giving us reasonable notice in writing to our DPO.

Upon receiving your request, we will inform you of the likely consequences of withdrawal, which may include our being unable to respond to your enquiry, continue providing services, or proceed with your job application. We will process your request within a reasonable time, and generally within thirty (30) days. If we require longer, we will inform you of the time by which we will respond.

Please note that withdrawing consent does not affect our right to continue collecting, using or disclosing personal data where such collection, use or disclosure is required or authorised under the PDPA or other written law.

Disclosure of personal data

We do not sell or rent personal data. We may disclose personal data to:

• Our employees, officers and authorised representatives, on a need-to-know basis
• Related corporations, joint venture partners and consortium members, in connection with a project
• Clients, main contractors, consultants and sub-contractors, where necessary for project delivery, site access or compliance
• Third-party service providers who perform functions on our behalf including IT, website hosting, email, cloud storage, telecommunications, security, HR, insurance, banking, audit and professional advisory services
• Government agencies, statutory boards and regulators including IMDA, BCA, MOM and others where required for licensing, permits, compliance, workplace safety or statutory reporting
• Courts, tribunals, law enforcement agencies and legal advisers, where necessary to comply with legal obligations or to protect our rights
• A purchaser or successor entity, in connection with any merger, acquisition, restructuring or sale of assets

Where we engage third parties to process personal data on our behalf, we require them by contract to protect that data to a standard comparable to that required under the PDPA, and to use it only for the purposes we specify.

Third-party services embedded in this website

Our website incorporates services provided by third parties. When these load, the third party may receive your IP address and set cookies. Their handling of your data is governed by their own privacy policies, over which we have no control.

Cookies and similar technologies

Cookies are small text files placed on your device when you visit a website. We and our service providers may use cookies and similar technologies to:

• Enable essential website functionality and security
• Remember your preferences
• Understand how visitors navigate and use our website, so that we can improve it

Most browsers allow you to view, manage, delete and block cookies through their settings. Please note that disabling cookies may affect the functionality of parts of this website.

Transfers of personal data outside Singapore

Some of our service providers including cloud hosting, email, video hosting and mapping services may store or process personal data on servers located outside Singapore.

Where we transfer personal data overseas, we comply with the Transfer Limitation Obligation under section 26 of the PDPA and the Personal Data Protection Regulations 2021. We take reasonable steps to ensure that the recipient is bound by legally enforceable obligations to provide the transferred data with a standard of protection at least comparable to that under the PDPA for example, through contractual clauses, binding corporate rules, or a certification under a recognised framework.

Protection of personal data

We implement reasonable administrative, physical and technical measures to protect personal data in our possession or under our control against unauthorised access, collection, use, disclosure, copying, modification, disposal or similar risks. These measures include:

• Restricting access to personal data on a need-to-know basis
• Access controls, authentication and password policies
• Encryption of data in transit (this website is served over HTTPS)
• Secure disposal of physical and electronic records
• Confidentiality obligations in employment and vendor contracts
• Staff awareness and training on data protection
• Periodic review of our security arrangements

However, no method of transmission over the internet or method of electronic storage is completely secure. While we strive to protect your personal data, we cannot guarantee absolute security, and any transmission of data to us is at your own risk.

Accuracy of personal data

We take reasonable steps to ensure that personal data we collect is accurate and complete, particularly where it is likely to be used to make a decision affecting you or is likely to be disclosed to another organisation.

You are responsible for informing us of any changes to your personal data so that our records remain accurate and up to date.

Retention of personal data

We retain personal data only for as long as it is necessary to fulfil the purposes for which it was collected, or as required or permitted by applicable law.

We will cease to retain personal data, or remove the means by which it can be associated with particular individuals, as soon as it is reasonable to assume that the purpose of collection is no longer served by retention, and retention is no longer necessary for legal or business purposes.

Data breach notification

We maintain a data breach management plan. In the event of a data breach, we will assess it promptly and, where the breach is a notifiable data breach under Part 6B of the PDPA — namely one that results in, or is likely to result in, significant harm to affected individuals, or that is of a significant scale (affecting 500 or more individuals), we will:

• Notify the Personal Data Protection Commission as soon as practicable, and in any case within three (3) calendar days of determining that the breach is notifiable; and
• Notify affected individuals as soon as practicable, where the breach is likely to result in significant harm to them, unless an exception under the PDPA applies.

Your rights: access and correction

Subject to the PDPA, you may:

Request access to personal data about you that is in our possession or under our control, and information about the ways in which it has been or may have been used or disclosed by us within the past year.

Request correction of any error or omission in your personal data. Where we make a correction, we will send the corrected data to every other organisation to which the data was disclosed within a year before the correction, unless that organisation does not need it for any legal or business purpose.

How to make a request. Please submit your request in writing to our DPO at the contact details in Section 2, with sufficient detail for us to locate the data and verify your identity.

Our response. We will respond within thirty (30) days where practicable. If we are unable to do so, we will inform you of the time by which we will respond. A reasonable fee may be charged for access requests to cover the costs of processing; we will inform you of the fee in advance and proceed only upon your agreement.

Exceptions. We may be unable to fulfil a request in certain circumstances set out in the PDPA,  for example, where the data is subject to legal privilege, where disclosure would reveal confidential commercial information that could harm our competitive position, where it would threaten the safety of another individual, or where the request is frivolous or vexatious. Where we refuse a request, we will notify you of our reasons.

Do Not Call Provisions

We comply with the Do Not Call (“DNC”) Provisions in Part 9 of the PDPA. We will not send specified marketing messages to Singapore telephone numbers registered with the DNC Registry unless we have obtained your clear and unambiguous consent in written or other accessible form, or unless an exemption applies (such as the ongoing-relationship exemption for messages sent to an existing subscriber about related products or services).

Where we send you a marketing message, we will identify ourselves and provide contact details, and, where required, an opt-out facility. You may unsubscribe at any time using the opt-out mechanism provided or by writing to our DPO.

Third-party websites

Our website contains links to third-party websites and platforms, including MyCareersFuture, Facebook, LinkedIn, X (formerly Twitter), Instagram and WhatsApp. This Policy does not apply to those sites. We are not responsible for their content or privacy practices, and we encourage you to review their privacy policies before providing them with personal data.

Minors

This website is directed at businesses and professional audiences and is not intended for individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected such data, please contact our DPO and we will take steps to delete it.

Changes to this Policy

We may update this Policy from time to time to reflect changes in our practices or in applicable law. The revised version will be posted on this page with an updated “Last updated” date and will take effect from the date of posting. We encourage you to review this page periodically. Where changes are material, we will take reasonable steps to notify you.

How to contact us

For questions, feedback, requests or complaints relating to this Policy or your personal data, please contact:

The Data Protection Officer
Lucky Joint Construction Pte Ltd
17 Tuas Avenue 3, Singapore 639414
Email: dpo@luckyjoint.com.sg
Telephone: +65 6284 0288

We will endeavour to respond to all enquiries promptly.

Complaints

If you are dissatisfied with how we have handled your personal data or your request, please first raise the matter with our DPO so that we have an opportunity to resolve it.

Governing law

This Policy is governed by and shall be construed in accordance with the laws of the Republic of Singapore.