PDPA Compliance

FleetTrust OS recognises that the privacy of personal data is a fundamental right. We are fully committed to complying with the Personal Data Protection Act 2012 (PDPA) administered by the Personal Data Protection Commission (PDPC) of Singapore.

We adhere to the following PDPA obligations: the Consent Obligation, the Purpose Limitation Obligation, the Notification Obligation, the Access and Correction Obligation, the Accuracy Obligation, the Protection Obligation, the Retention Limitation Obligation, the Transfer Limitation Obligation, and the Data Breach Notification Obligation.

Our platform is built with privacy by design — we collect only what we need, retain it only as long as necessary, and protect it with appropriate technical and organisational safeguards.

We have appointed a Data Protection Officer (DPO) responsible for ensuring our compliance with the PDPA and for handling all data protection matters, including responding to access and correction requests and managing data breach incidents.

Depending on your role (fleet operator or registered driver), we may collect the following categories of personal data:

We collect and use personal data only for the specific purposes for which it was collected and for directly related purposes. These include:

• Fleet Management: Managing driver profiles, vehicle assignments, and operational records for PHV fleet operators
• Invoicing & Billing: Generating rental invoices, processing subscription payments, and maintaining financial records
• Compliance Monitoring: Tracking PDVL, driving licence, insurance, and vehicle inspection expiry dates to ensure LTA regulatory compliance
• Communications: Sending service notifications, compliance alerts, invoice reminders, and platform updates
• Safety & Analytics: Generating driver performance reports and fleet analytics to support operator decision-making
• Legal & Regulatory: Complying with applicable Singapore laws and responding to lawful requests from government authorities
• Security: Detecting and preventing fraud, unauthorised access, and other security incidents

We collect personal data only with the informed consent of the individual, or where permitted by the PDPA without consent (for example, where collection is necessary for a contract, legal obligation, or legitimate interest that outweighs the individual’s privacy interest).

Consent is obtained at the point of account registration and, where applicable, when collecting sensitive categories of data such as NRIC numbers for identity verification purposes. Individuals are informed of the purpose of collection before or at the time of collection.

Individuals have the right to withdraw consent at any time by contacting our DPO at dpo@fleettrust.io. Withdrawal of consent may affect our ability to provide certain services. We will inform you of the consequences before processing your withdrawal.

Under the PDPA, individuals have the right to:

• Access the personal data we hold about you and information about how it has been used or disclosed in the past year
• Correct any personal data that is inaccurate, incomplete, misleading, or not up to date
• Data Portability (where applicable) to receive a copy of your personal data in a commonly used machine-readable format

To submit an access or correction request, please email our DPO at dpo@fleettrust.io. We will respond to all requests within 30 days. In some cases, we may need to verify your identity before processing the request. A reasonable fee may be charged for access requests in accordance with PDPC guidelines.

We retain personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law or regulation.

Financial and transaction records may be retained for up to 7 years in accordance with Singapore accounting and tax regulations. After the applicable retention period, data is securely deleted or anonymised.

Data retained in backup systems may take up to 90 days to be fully purged following a deletion request.

As a cloud-based platform, some personal data may be transferred to and stored or processed in servers located outside Singapore. We ensure that all cross-border transfers comply with the PDPA Transfer Limitation Obligation by implementing appropriate safeguards.

We require all third-party processors to implement appropriate contractual protections and technical safeguards equivalent to the standards required by the PDPA.

In the event of a data breach that is likely to result in significant harm to affected individuals, FleetTrust OS will:

• Notify the Personal Data Protection Commission (PDPC) within 3 calendar days of becoming aware of the breach, in accordance with the mandatory breach notification requirements under the PDPA
• Notify affected individuals as soon as practicable, providing details of the breach, the data affected, and recommended protective actions
• Conduct a thorough investigation, contain the breach, and implement remediation measures to prevent recurrence
• Maintain a record of all data breaches (including those that do not require mandatory notification) for internal accountability purposes

We maintain an incident response plan and conduct regular security reviews to minimise the risk of data breaches.

If you have any questions, concerns, or complaints about how FleetTrust OS handles your personal data, please contact our DPO in the first instance:

If you are not satisfied with our response, you have the right to lodge a complaint with the Personal Data Protection Commission (PDPC) of Singapore: