Privacy Policy

Last updated: *Required

1. Who we are and what this policy covers

This Privacy Policy explains how the DR Pacific Holdings group ("we", "us", "our") collects, uses, discloses and protects personal data under Singapore's Personal Data Protection Act 2012 ("PDPA").

It is one policy for the whole group, because our businesses work together and share the same customer records. It applies to:

• dredugroup.com, operated by DR Pacific Holdings Pte Ltd (迪傲太平洋控股有限公司), UEN 200821037N, No 99 Rangoon Road, Singapore 218384 (study planning, school applications, student passes, courses and related services);
• vinga.com.sg, operated by *Required (legal name and UEN) (student hostels, arrival, visa, insurance, health support and student-life services);
• our Web App and the Vinga mobile app (Google Play, App Store and Huawei AppGallery); and
• our offices, hostels, events, telephone lines and messaging accounts.

Each company named above is a separate organisation under the PDPA. When you deal with one of them, that company collects your personal data, and section 6 explains how it is shared with the other companies in the group.

2. Personal data we collect

Depending on the services you use, we may collect:

• Identity: name, date of birth, gender, nationality, photograph, and passport details. We collect a passport, NRIC or FIN number only when a law requires it (for example, a student pass or long-term visit pass application) or when we must verify your identity to a high degree of fidelity, as the PDPC's Advisory Guidelines on NRIC and other national identification numbers require.
• Contact: address, email, telephone number, and messaging IDs (WhatsApp, WeChat, LINE, KakaoTalk and similar).
• Parent and guardian: the name, relationship and contact details of a student's parent or guardian.
• Education: school records, transcripts, certificates, test results (for example AEIS), course choices and applications.
• Immigration and travel: student pass, long-term visit pass and visa details, flight and arrival details.
• Health and insurance: vaccination records, medical information you give us so that we can arrange medical support, and insurance policy details. We treat this data as sensitive and limit who can see it.
• Accommodation: hostel booking, room, meals and stay records, and CCTV images in our hostels and offices.
• Payments: fees, invoices and payment records. Card payments are processed by our payment provider; we do not store full card numbers.
• Account and app: login details for the Web App and mobile app, application status and messages you send us.
• Online: IP address, device and browser information, pages viewed and how you reached our sites, collected through cookies and similar technologies (section 8).
• Agents and partners: the contact and business details of education agents and partners who use our Agent Portal.

3. Students under 18

Many of our students are under 18. For a student under 18, we ask a parent or legal guardian to give consent on the student's behalf and to receive our communications, unless the student is old enough to understand the nature and consequences of giving consent and the law allows the student to consent personally. A parent or guardian may contact us at any time to access, correct or withdraw consent for their child's personal data.

4. Why we use your personal data

We use personal data to:

1. answer enquiries and hold online or in-person consultations and information sessions;
2. plan studies, and prepare and submit applications to schools, universities and course providers;
3. apply for student passes, long-term visit passes, visas and related permits with the Immigration and Checkpoints Authority and other authorities;
4. provide hostel accommodation, meals, cleaning, laundry, guardian and pastoral care, airport pickup and arrival services;
5. arrange insurance, medical appointments, vaccination certification and health support;
6. provide tuition, preparatory courses, activities, study tours and competitions;
7. process payments, issue invoices and keep accounts;
8. run our Web App, mobile app and Agent Portal, including your account and application status;
9. keep our hostels, offices and systems safe, including by CCTV;
10. meet our legal, regulatory and reporting duties; and
11. with your consent, send you marketing about our services (section 7).

We collect, use and disclose personal data only for these purposes, or for a purpose we tell you about when we collect it, or as the PDPA otherwise permits.

5. Consent

We ask for your consent before or when we collect your personal data, for example through the consent box on our forms. You may withdraw your consent at any time by contacting us (section 12). We will tell you what withdrawing means for the services we provide: for example, we cannot submit a school or student pass application without the data it requires.

6. Sharing within our group and with others

Within the group. The companies in our group share personal data with each other so that a student and family deal with one team from first enquiry through to arrival and life in Singapore. For example, when you ask dredugroup.com about studying in Singapore and later need a hostel place, the hostel team receives the details it needs. The companies share one customer database. Each receiving company uses the data only for the purposes in section 4 and protects it under this policy and a written agreement between the group companies.

Group companies and representatives outside Singapore: *Required

Outside the group, we disclose personal data only as needed for the purposes in section 4, to:

• schools, universities, course and examination providers;
• government authorities, including the Immigration and Checkpoints Authority and the Ministry of Education, and anyone we must disclose to by law;
• insurers, clinics, hospitals and medical providers;
• transport, airport pickup and activity providers;
• education agents and partners who referred you or who act for you;
• our payment provider, IT, hosting, software and app development providers, and messaging platforms; and
• our professional advisers, auditors and insurers.

Service providers who process personal data for us are bound by contract to protect it and to use it only on our instructions. We do not sell personal data.

7. Marketing, and the platforms we use

Most of our families are in Taiwan and Hong Kong, so we communicate and advertise on the platforms they use. We send marketing only with your consent, which is a separate, optional box on our forms, and you can opt out at any time through the link in a message or by contacting us. We do not send marketing messages to Singapore telephone numbers registered on the Do Not Call Registry unless you have given us clear and unambiguous consent.

The platforms we use, or may use, include:

• Search and video: Google (Search, Google Ads, Google Analytics, Google Tag Manager, Google Maps, Google Business Profile), YouTube, Microsoft Bing and Microsoft Clarity, Yahoo, Baidu;
• Social media: Facebook, Instagram, Threads, Messenger, TikTok, Douyin, Xiaohongshu (RED), Weibo, Bilibili, Xigua Video, Toutiao, Dcard, PTT, LinkedIn, X (Twitter), Pinterest, Snapchat, Telegram;
• Messaging: WhatsApp, WeChat, LINE, KakaoTalk, Telegram, SMS and email;
• Apps: Google Play, Apple App Store, Huawei AppGallery.

When you interact with us on these platforms, the platform also collects data under its own privacy policy. When we advertise, we may give a platform a scrambled (hashed) contact detail or use its pixel or tag on our sites, so that our adverts reach the right audience and we can measure results. We update this list when we add a platform.

8. Cookies and similar technologies

Our websites and apps use cookies, pixels, tags and similar technologies. Essential cookies make the sites work (for example, language choice and keeping you logged in). With your consent, analytics cookies tell us how the sites are used, and advertising cookies and pixels from the platforms in section 7 help us show relevant adverts and measure them. You can accept or refuse non-essential cookies in our cookie banner and change your choice at any time, and you can also block cookies in your browser.

9. Transfers outside Singapore

We transfer personal data outside Singapore when our services require it: for example, to our group's representatives and partners in Taiwan and Hong Kong, to schools and agents overseas, and to the platforms and service providers in sections 6 and 7, some of which store data in other countries (including the United States and Mainland China). When we do, we take steps under section 26 of the PDPA so that the recipient protects the data to a standard comparable to the PDPA, mainly through contracts. Where the laws of Taiwan, Hong Kong or Mainland China also apply to our handling of your data, you have the rights those laws give you as well.

Our main data storage location: *Required

10. How we protect and keep personal data

We protect personal data with reasonable security arrangements, including access controls, encrypted connections, restricted access to health and identity documents, and staff confidentiality duties. If a data breach is likely to cause you significant harm, we will notify you and the Personal Data Protection Commission as the PDPA requires.

We keep personal data only as long as we need it for the purposes in section 4 or as the law requires, then delete or anonymise it. Retention periods: *Required

11. Your rights

You may ask us for access to the personal data we hold about you and how it has been used or disclosed in the past year, ask us to correct it, and withdraw consent. We respond to access and correction requests within 30 days, or tell you within that time when we will respond. We may charge a reasonable fee for an access request and will tell you the fee first. If you are not satisfied with our response, you may contact the Personal Data Protection Commission at www.pdpc.gov.sg.

12. Contact our Data Protection Officer

For any question, request or complaint about your personal data, contact our Data Protection Officer:

• Email: *Required
• Telephone: *Required
• Post: Data Protection Officer, DR Pacific Holdings Pte Ltd, No 99 Rangoon Road, Singapore 218384

Please include your full name, contact details and a short description of your request.

13. Changes and language

We may update this policy. The date at the top shows the latest version, and we will tell you about significant changes through our websites or apps. This policy is also published in Traditional and Simplified Chinese; if the versions differ, the English version applies. This policy is governed by the laws of Singapore.