1. Personal data we collect

• Account data: name, email address, mobile number, password (stored encrypted).
• Candidate data: chosen subjects, exam dates (if provided), agency status, referral code used, practice activity and scores.
• Manager data (for directory applicants): name, company, email, mobile, MAS representative number, LinkedIn profile, professional introduction, optional photo.
• Payment data: processed by Stripe; we receive confirmation and limited transaction details but do not store full card numbers.
• Technical data: device/browser information and usage data via cookies and similar technologies.

2. How we use your data

• To create and manage your account and provide the Platform.
• To process payments and manage your access.
• To operate the manager directory and referral features.
• To send you service-related communications (e.g. receipts, account notices, discount codes).
• To send marketing communications only where you have consented; you may withdraw consent at any time.
• To improve the Platform, prevent fraud, and comply with legal obligations.

3. Consent and how we share data

• Candidate–manager sharing: If you register using a manager's referral code, your name is shared with that manager so they can identify you in their pipeline. Your email address is shared with the manager only if you give explicit consent at registration. You may withdraw this consent.
• Service providers: We share data with trusted providers who help us run the Platform — payment processing (Stripe), hosting (Vercel), database/authentication (Supabase), and email delivery (Resend) — solely to provide the service, under confidentiality obligations.
• Legal: We may disclose data where required by law or to protect our rights.
• We do not sell your personal data.

4. Cookies

We use necessary cookies to operate the Platform (e.g. keeping you logged in). You can control cookies via your browser settings.

5. Data retention

We keep your personal data for as long as your account is active and as needed to provide the service, then for any period required by law or for legitimate business purposes (e.g. transaction records). You may request deletion (see your rights).

6. Protection of your data

We take reasonable security measures to protect your data, including encryption of sensitive fields, access controls, and use of reputable infrastructure providers. No method of transmission or storage is completely secure, but we work to protect your information.

7. Your rights under the PDPA

You may, at any time:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Withdraw consent to the collection, use, or disclosure of your data (this may limit our ability to provide the service).

Submit requests to our Data Protection Officer below. We will respond within the timeframes required by the PDPA.

8. Data Protection Officer

Wu Wenhua — dpo@passcmfas.sg — Astar Edtech Pte Ltd, 60 Paya Lebar Road #06-28 Paya Lebar Square, Singapore 409051

9. Transfers outside Singapore

Some of our service providers may store or process data outside Singapore. Where this occurs, we take steps to ensure your data receives protection comparable to that under the PDPA.

10. Changes to this Policy

We may update this Policy from time to time. Material changes will be notified via the Platform or by email.

11. Contact

Questions about this Policy or your data: dpo@passcmfas.sg / hello@passcmfas.sg.