TEE SIDE CHALET

DATA PROTECTION & CYBERSECURITY NOTICE

Effective Date: 1 Aug 2026

1. INTRODUCTION

1.1. Tee Side Chalet (“TSC”, “we”, “us” or “our”) is operated by Surgo Asset Partners Pte Ltd (“SAPPL”).

1.2. We are committed to protecting the personal data of our guests, customers, visitors, business partners and other individuals who interact with us, in accordance with Singapore’s Personal Data Protection Act 2012 (“PDPA”) and other applicable laws.

1.3. This Data Protection & Cybersecurity Notice (“Notice”) explains how we collect, use, disclose, store, protect and manage personal data, including the measures adopted to address cybersecurity risks and personal data breaches.

1.4. This Notice applies to personal data in our possession or under our control, including personal data processed on our behalf by authorised third-party service providers.

2. PERSONAL DATA

2.1. “Personal data” refers to data, whether true or not, about an individual who can be identified from that data or from that data together with other information to which we have or are likely to have access.

2.2. Depending on your interaction with TSC, personal data we may collect includes:

Name, contact number, email address and residential or billing address;
Identification information, where reasonably necessary and permitted by law;
Booking details, stay dates, bungalow allocations and guest information;
Payment and transaction records;
Vehicle registration numbers and parking access records;
CCTV recordings and security-related information;
Correspondence, enquiries, feedback and complaints;
Website usage information, device information and technical logs; and
Other information reasonably necessary for providing our services or fulfilling legal and operational obligations.

2.3. We seek to collect only personal data that is reasonably necessary for the purposes identified in this Notice or otherwise permitted under applicable laws.

3. COLLECTION, USE AND DISCLOSURE OF PERSONAL DATA

3.1. We may collect personal data directly from you, your authorised representatives, our booking platforms, website, service providers, security systems or other lawful sources.

3.2. Where required under the PDPA, we will notify you of the purposes for collecting, using or disclosing your personal data and obtain your consent. In circumstances permitted by law, personal data may be processed without consent.

3.3. We may collect, use and disclose personal data for the following purposes:

a. Processing and administering bungalow reservations, payments, refunds and security deposits;

b. Managing check-in, check-out, guest access and accommodation arrangements;

c. Communicating booking confirmations, upcoming stay notifications, access instructions and operational updates;

d. Managing parking registrations, access controls, parking charges and enforcement matters;

e. Facilitating catering, activities, events and other services requested by guests;

f. Responding to enquiries, complaints, feedback and service requests;

g. Maintaining safety, security and order within TSC’s premises;

h. Investigating suspected misconduct, unauthorised access, property damage, payment disputes or breaches of TSC’s terms and conditions;

i. Maintaining, monitoring and improving our website, booking systems and other digital services;

j. Detecting, preventing, investigating and responding to fraud, cybersecurity threats and unauthorised system activities;

k. Conducting business analysis, service improvement and operational planning;

l. Sending marketing and promotional communications where permitted under applicable laws;

m. Complying with legal, regulatory, accounting and reporting obligations; and

n. Other purposes reasonably related to the above or otherwise notified to you.

3.4. Personal data may be disclosed to authorised employees, contractors, professional advisers, technology providers, payment processors, security personnel, service partners, government authorities and law enforcement agencies where necessary and permitted by law.

3.5. We do not sell personal data to third parties.

4. CONSENT AND WITHDRAWAL OF CONSENT

4.1. Where consent is required, it may be obtained through appropriate means, including booking forms, online submissions, written communications or other legally recognised methods.

4.2. You may withdraw your consent for the collection, use or disclosure of your personal data by contacting our Data Protection Officer (“DPO”).

4.3. Upon receiving a withdrawal request, we will inform you of any consequences and process the request within a reasonable period.

4.4. Withdrawal of consent may affect our ability to provide certain services, including processing reservations or fulfilling contractual obligations.

4.5. Withdrawal does not affect processing already lawfully undertaken or processing permitted or required without consent under applicable laws.

5. ACCESS AND CORRECTION OF PERSONAL DATA

5.1. You may request access to personal data held by us or request corrections to inaccurate or incomplete information, subject to applicable legal requirements and exceptions.

5.2. Requests should be submitted in writing to our DPO.

5.3. We may require reasonable verification of identity before processing requests.

5.4. A reasonable administrative fee may apply to access requests, where permitted by law. Any applicable fee will be communicated before processing.

5.5. We will respond as soon as reasonably practicable and in accordance with the PDPA.

6. PROTECTION OF PERSONAL DATA

6.1. We are committed to maintaining reasonable administrative, physical and technical safeguards to protect personal data against unauthorised access, collection, use, disclosure, copying, modification, disposal, loss or other similar risks.

6.2. Depending on the nature and sensitivity of the personal data and the systems involved, safeguards may include:

a. Access controls restricting personal data to authorised personnel;

b. Authentication and account security measures;

c. Appropriate safeguards for electronic transmission and storage;

d. Security maintenance, software updates and vulnerability management;

e. Backup and recovery arrangements;

f. Monitoring and reviewing access to systems and personal data;

g. Staff awareness and procedures for handling personal data; and

h. Appropriate physical security measures for records, equipment and premises.

6.3. We periodically review our data protection arrangements, taking into account operational requirements, evolving cybersecurity threats and applicable legal obligations.

7. CYBERSECURITY AND DIGITAL SYSTEM SECURITY

7.1. TSC recognises that cybersecurity risks may arise from the use of websites, online booking systems, payment services, email communications, cloud infrastructure and other digital platforms.

7.2. We adopt a risk-based approach to cybersecurity, with the objective of reducing the likelihood and impact of cyber incidents affecting personal data.

7.3. Cybersecurity risks considered in our security arrangements include:

a. Unauthorised access to systems or accounts;

b. Phishing, credential theft and account compromise;

c. Malware, ransomware and other malicious software;

d. Unauthorised modification, deletion or disclosure of data;

e. Vulnerabilities in websites, software and third-party integrations;

f. Loss or theft of devices or storage media containing personal data; and

g. Other cyber incidents that may compromise the confidentiality, integrity or availability of personal data.

7.4. Security controls and procedures are implemented and reviewed according to the nature of our systems, the risks involved and reasonable operational requirements.

7.5. For security reasons, detailed technical configurations and internal cybersecurity procedures are not publicly disclosed.

8. CYBERSECURITY SAFEGUARDS STATEMENT

8.1. Tee Side Chalet (“TSC”) recognises the cybersecurity risks associated with operating online booking platforms, websites, payment systems and other digital services that process or store personal data.

8.2. TSC adopts a risk-based approach to cybersecurity and is committed to maintaining reasonable technical, administrative and operational safeguards to protect personal data and supporting information systems against unauthorised access, disclosure, alteration, loss and cyber threats.

8.3. Our cybersecurity safeguards are designed to address the following key areas, as applicable to our systems and operations:

a. Website and System Security: Security measures to protect our website, booking platform and supporting IT infrastructure against unauthorised access and malicious activities.

b. Access Control: Restriction of system access and administrative privileges to authorised personnel based on their operational responsibilities.

c. Software Maintenance: Appropriate maintenance and security updates for website components, booking software and supporting systems.

d. Data Protection: Reasonable measures to safeguard personal data collected, processed and stored through our digital platforms.

e. Payment Security: Use of authorised third-party payment service providers for processing online payments, subject to their applicable security arrangements.

f. Data Backup and Recovery: Appropriate arrangements to reduce the risk of permanent data loss and support system recovery following technical failures or cybersecurity incidents.

g. Third-Party Service Providers: Consideration of data protection and cybersecurity risks associated with external technology vendors and service providers.

h. Incident Response: Procedures for assessing and responding to suspected cybersecurity incidents and personal data breaches, including notification to relevant authorities and affected individuals where required by law.

8.4. TSC periodically reviews its cybersecurity arrangements, taking into account changes in technology, operational requirements, emerging threats and applicable regulatory obligations.

8.5. While no digital system can be guaranteed to be entirely free from cybersecurity risks, TSC is committed to taking reasonable and proportionate measures to manage such risks and protect the personal data entrusted to us.

8.6. For security reasons, detailed technical configurations, system access arrangements and internal cybersecurity procedures are not publicly disclosed.

9. ONLINE BOOKINGS AND PAYMENT SECURITY

9.1. Personal data submitted through our website, online booking engine and related services may be processed by authorised technology providers acting on our behalf or providing services to us.

9.2. Payment transactions may be processed through third-party payment service providers. Such providers may collect and process payment information in accordance with their applicable privacy notices and security arrangements.

9.3. TSC takes reasonable steps to select and manage service providers handling personal data on our behalf.

9.4. Customers should ensure that they access TSC’s services through legitimate websites and official communication channels.

9.5. Customers are encouraged not to disclose passwords, one-time passwords, payment authentication codes or other confidential account credentials to unauthorised persons.

10. THIRD-PARTY SERVICE PROVIDERS

10.1. We may engage third-party organisations to provide services such as:

Website hosting and maintenance;
Online reservations and booking management;
Payment processing;
Email, messaging and customer communications;
Cloud storage and IT support;
Security monitoring and parking management;
Catering, activities and event coordination; and
Other operational and administrative support.

10.2. Where third parties process personal data on our behalf, we take reasonable steps to ensure that appropriate data protection and security arrangements are in place.

10.3. Personal data will be shared only to the extent reasonably necessary for the relevant purposes or as otherwise permitted by law.

10.4. Third-party providers operating independently may be subject to their own applicable privacy notices and legal obligations.

11. CCTV, PARKING AND PREMISES SECURITY

11.1. CCTV cameras and other security systems may operate within TSC’s premises for safety, security, access management and incident investigation purposes.

11.2. CCTV recordings, vehicle registration numbers, access logs and related information may be collected, used or disclosed for:

a. Monitoring and maintaining premises security;

b. Managing vehicle access and parking arrangements;

c. Investigating suspected unauthorised entry, parking violations, property damage or other incidents;

d. Supporting enforcement of TSC’s policies and terms and conditions; and

e. Assisting law enforcement agencies or other authorities where required or permitted by law.

11.3. Access to such information is restricted to authorised personnel and relevant service providers, subject to applicable security and operational requirements.

11.4. Such records will be retained only for as long as reasonably necessary for their purposes or as required or permitted by law.

12. CYBERSECURITY INCIDENTS AND PERSONAL DATA BREACHES

12.1. Despite reasonable security measures, no information system or electronic transmission method can be guaranteed to be completely free from cybersecurity risks.

12.2. Where a suspected cybersecurity incident or personal data breach occurs, TSC will take reasonable steps, as appropriate, to:

a. Identify and assess the nature and extent of the incident;

b. Contain the incident and prevent further unauthorised access or disclosure;

c. Investigate the cause and potential impact;

d. Secure affected systems and preserve relevant records;

e. Assess whether the incident constitutes a notifiable data breach under the PDPA;

f. Notify the Personal Data Protection Commission (“PDPC”) and affected individuals where required by law; and

g. Implement appropriate corrective and preventive measures.

12.3. Where a data breach is assessed to be notifiable under the PDPA, TSC will notify the PDPC as soon as practicable and no later than three calendar days after determining that the breach is notifiable.

12.4. Where notification to affected individuals is required, TSC will provide such notification as soon as practicable, subject to applicable legal requirements and exceptions.

12.5. Individuals who suspect that their personal data has been compromised in connection with TSC’s services may contact our DPO using the contact details provided in this Notice.

13. DATA ACCURACY

13.1. We generally rely on personal data provided by you or your authorised representative.

13.2. We take reasonable steps to ensure that personal data is accurate and complete where it is likely to be used to make decisions affecting individuals or disclosed to other organisations.

13.3. You are encouraged to inform us promptly of changes to your personal information.

14. RETENTION AND SECURE DISPOSAL OF PERSONAL DATA

14.1. We retain personal data only for as long as reasonably necessary to fulfil the purposes for which it was collected or for legitimate legal or business purposes.

14.2. Retention periods may vary depending on the nature of the information, operational requirements, contractual obligations, accounting requirements, dispute resolution needs and applicable laws.

14.3. When personal data is no longer required for legal or business purposes, we will take reasonable steps to securely dispose of it or remove the means by which it can be associated with identifiable individuals.

14.4. Where appropriate, personal data may be anonymised for statistical analysis, business planning or service improvement.

15. TRANSFER OF PERSONAL DATA OUTSIDE SINGAPORE

15.1. Certain technology providers, cloud services or third-party service providers engaged by TSC may process or store personal data outside Singapore.

15.2. Where personal data is transferred outside Singapore, we will take steps to ensure that the transfer complies with the PDPA, including applicable requirements relating to a standard of protection comparable to that under the PDPA.

16. WEBSITE USAGE, COOKIES AND ANALYTICS

16.1. Our website may use cookies and similar technologies to support website functionality, improve user experience, analyse website traffic and facilitate online services.

16.2. Depending on the technologies used, information collected may include IP addresses, browser types, device information, pages visited and website interaction data.

16.3. Where such information constitutes personal data, its collection, use and disclosure will be subject to applicable PDPA requirements.

16.4. Users may manage certain cookie preferences through their browser settings or other controls made available on the website.

16.5. Disabling certain cookies may affect the functionality of some website features.

17. MARKETING COMMUNICATIONS

17.1. We may send information about TSC’s services, promotions, offers and events where we have the necessary consent or are otherwise permitted to do so under applicable laws.

17.2. Marketing communications will be managed in accordance with applicable PDPA and Do Not Call requirements.

17.3. You may opt out of marketing communications by following the unsubscribe instructions, where available, or contacting our DPO.

17.4. Withdrawal from marketing communications will not ordinarily affect essential service-related communications concerning existing bookings, payments or operational matters.

18. CUSTOMER RESPONSIBILITIES

18.1. Customers are encouraged to take reasonable precautions when using online services, including protecting account credentials, using secure devices and being alert to suspicious communications.

18.2. Customers should notify TSC promptly if they suspect unauthorised use of their account or receive suspicious communications purporting to originate from TSC.

18.3. Nothing in this Notice excludes or limits any responsibility or liability that cannot lawfully be excluded or limited under applicable laws, including TSC’s obligations under the PDPA.

19. DATA PROTECTION OFFICER

19.1. For enquiries, requests, complaints or concerns relating to personal data protection, cybersecurity incidents involving personal data or this Notice, please contact:

Data Protection Officer
Tee Side Chalet
Operated by Surgo Asset Partners Pte Ltd

Email: admin@teesidechalet.com.sg

19.2. Please provide sufficient details to enable us to assess and respond to your enquiry or request.

19.3. We may request additional information where reasonably necessary to verify your identity or investigate the matter.

20. RELATIONSHIP WITH OTHER POLICIES

20.1. This Notice should be read together with TSC’s applicable booking terms and conditions, website terms, service conditions and other relevant notices.

20.2. Where a matter concerns the collection, use, disclosure or protection of personal data, the applicable requirements of the PDPA will continue to apply.

20.3. Nothing in this Notice is intended to exclude or restrict rights or obligations under applicable laws.

21. CHANGES TO THIS NOTICE

21.1. We may review and update this Notice periodically to reflect changes in our operations, technology, data protection practices, cybersecurity risks or applicable laws.

21.2. The latest version will be published on our official website at:

www.teesidechalet.com.sg

21.3. The effective date displayed at the beginning of this Notice indicates when the current version takes effect.

21.4. Where changes require additional notification or consent under applicable laws, we will take the necessary steps.

Tee Side Chalet
Operated by Surgo Asset Partners Pte Ltd