Skip to main content
Drops Forum LogoDrops Forum

Privacy

Version 2.4

Effective date: 16 October 2026

This Privacy Policy explains how Dropped Object Prevention Scheme Asia Pte Ltd collects, uses, discloses, stores and protects personal data when you use the DROPS Forum website or DROPS Metaverse, register for events, take part in training, receive or verify a certificate, contact us, or otherwise use our services. DROPS Metaverse includes our iOS, macOS, Windows, Meta Quest and browser applications.

Current app and planned store release

This policy covers existing DROPS Metaverse versions and the forthcoming store release. The current behavior is described below. New opt-in controls, in-app account deletion and an updated reporting service are being developed for the forthcoming store release. Until those changes are released, use the current controls and contact us for support, privacy or deletion assistance.

1. Who is responsible for your personal data?

The controller is:

Dropped Object Prevention Scheme Asia Pte Ltd
Represented by Joachim van der Meulen
50H Faber Heights
01-60 Faber Crest
Singapore 129202

Privacy and data protection enquiries: secretary@drops.asia

In this policy, "DROPS", "we", "us" and "our" refer to Dropped Object Prevention Scheme Asia Pte Ltd.

2. Who does this policy apply to?

This policy applies to visitors to our website and users of our services, including learners, event attendees, certificate holders, member-company employees and representatives, customers, suppliers, contributors and people who contact us.

DROPS Forum and DROPS Metaverse use one shared account and backend. Information you provide or update for that account may therefore be used in both services for the purposes explained in this policy. Deleting that account closes your login to both services; it does not delete only the Metaverse app.

DROPS Metaverse is intended for professional and educational use by people aged 13 or older. Children under 13 must not create an account or join a session, including as a local guest. Where local law requires a parent or guardian's authorisation for a minor's use or for particular processing, that authorisation is required. Contact us if you believe a child has provided personal data in breach of these requirements. We will assess the information and take the action required by applicable law.

3. Personal data we collect

Depending on how you use our services, we may collect:

  • Account and identity data, such as your name, email address, account identifier, sign-in records and authentication information.
  • Professional and membership data, such as your employer or company, email domain, job title, member-company association and membership status.
  • Contact and communication data, such as messages, enquiries, feedback, support requests, AI-assistant prompts and responses where you choose to use an AI feature, and communication preferences. Do not put personal or confidential information in an AI prompt unless it is needed for your request.
  • Event and transaction data, such as registrations, attendance, selected sessions, invoices, payment status, discount or coupon use and related transaction references. Payment card details are processed by our payment provider and are not stored by DROPS.
  • Training and learning data, such as course and workshop enrolments, attendance, start and completion dates, completion status, lesson or module progress, assessment results, scores, answers, attempts, time spent and activity scores awarded for participation across DROPS services, and other information needed to provide and administer training.
  • Certificate data, such as the certificate holder's name, email address, course or workshop title, certificate number, issue date, expiry date, validity status and certificate PDF.
  • Technical and security data, such as IP address, browser and device information, operating system, referring page, requested pages, timestamps, diagnostic information, security events and server logs.
  • Website and marketing data, such as page views, interactions, campaign parameters and advertising events where the relevant consent has been provided.
  • Information you choose to share with third parties, for example when you use a link to add a certificate to LinkedIn or share a certificate verification page.

We normally receive personal data directly from you. We may also receive it from your employer or member company, an event organiser, a payment provider, an authentication provider, or from records produced when you use our services.

3.1 DROPS Metaverse

When you sign in, we send a one-time code to your email address and use Supabase to verify it. The app uses session tokens to keep you signed in where supported. It also keeps your profile and settings on your device. Storage differs by platform; the iOS app keeps its sign-in for the current app session, and the browser version can use your website sign-in.

Your account profile includes your name, email address, company and app role or membership association, and any optional phone number and country you provide. When you join a shared room, other participants can see your display name, company, avatar and relevant role or membership indicators. Public rooms may include people you do not know. Your account email, phone number and country are not displayed in ordinary player labels.

The website's employer training reports remain limited to section 5. The app also provides a live session roster: company administrators can see the names, companies, current scenes and rooms of participants associated with their company in public rooms, or in the same private session when using a private room. DROPS administrators can view this presence across public and private rooms. In local training, the host can see the local group. This helps organise and manage the active session. A company administrator participating in a room can also see or hear the information shared with other participants there.

Our multiplayer server processes your account identity, room and session presence, avatar choice, virtual position, head and hand movements and shared interactions so participants can take part in the same scene. It relays the information needed to display that activity to other participants. This virtual movement information is not your GPS location. The service also processes connection and security information and may temporarily cache your profile to support joins and reconnects.

Voice chat uses your microphone and LiveKit to deliver your speech to other participants who are allowed to hear you in the room or session. LiveKit processes audio, room and participant identifiers and connection information. A trainer's broadcast may be heard more widely within the session. Speaking indicators and avatar lip movement may use audio levels or samples.

We do not build an audio recording or transcript of ordinary participant voice chat in the app. Live audio still passes through the voice service. Other participants may hear, repeat or independently record what you say, so do not share confidential information in a public room. Any separately offered recording feature would need its own clear notice before use.

Mute and block choices are saved for your account on the device where you make them. Local guests' choices last for that session. A stable moderation identifier helps apply your choices when a participant reconnects. Blocking hides that person's avatar and name and silences their voice for you, including trainer broadcasts. It does not ban them, prevent others from hearing them or stop them hearing speech that you continue to broadcast.

For a conduct concern in an existing version, use its reporting controls or email secretary@drops.asia. If the app opens your email application, opening it does not submit a report: you must send the message yourself. Provide only the details needed to explain the concern. A report does not automatically attach a voice recording.

For the forthcoming store release, we are developing an in-app reporting service. It is intended to receive a report reference, your account identifier, the reported person's moderation identifier and displayed name, room and scene, time, app version, reason and details you choose to provide. Receipt and handling information will be restricted to authorised safety and support staff. An email handoff remains available where the reporting service cannot be used. This planned service is not a statement that the new reporting backend is already deployed.

We record app entry and room or scene entry information to operate and support the service. Current store-build configurations enable usage and download statistics, including the identifiers described here; this collection is separate from website cookie choices. In the forthcoming store release, we will collect usage and download statistics only if you agree in the app; you can change this in Settings. These new opt-in controls are pending and must not be assumed to apply to an earlier app version. Records may include your account identifier, email address, room or scene, platform, channel, app version and time. Content-download analytics may include bundle name, version and size, download times and duration, device and installation identifiers, network type and a country code inferred from device settings. This is not precise location data and is not necessarily anonymous.

The system check makes short connection requests to the configured sign-in, content, multiplayer and voice services. Those services receive ordinary request information such as your IP address. The microphone test checks sound on your device; it does not send the test audio to other participants. Downloaded training content and related cache files are kept on your device.

In a local training session, your trainer's computer hosts the shared scene on the local network. Your chosen or saved name and company, training code where required, reconnect information, local network address, movements and shared activity pass between the trainer's computer and participating devices. Local discovery can make the training's name and connection details visible to nearby devices on that network. Joining a local training does not send your Supabase sign-in token to the trainer. Voice chat is off in the default local training mode. Separate online sign-in, checks, downloads, support or diagnostics may still contact their usual services.

Leaving a room or reaching an idle timeout ends the active shared session and its voice connection. An idle timeout can leave you signed in on the device so you can continue later. Use Sign out when you finish on a shared device. Uninstalling the app or signing out does not delete your shared DROPS account.

4. Why we use personal data and our legal bases

We use personal data only where we have a lawful basis. The basis depends on the activity and the law that applies to you.

Purpose Personal data commonly used Legal basis
Create and secure accounts, authenticate users and provide requested services Account, identity, contact, technical and security data Performance of a contract or steps requested before entering a contract; legitimate interests in providing and securing the service
Register and administer events, training and payments Identity, contact, professional, event, transaction and training data Performance of a contract; legitimate interests in administration and service delivery; legal obligations where applicable
Deliver training and record learning progress Identity, account, professional and training data Performance of a contract; legitimate interests in providing, improving and evidencing training
Issue, manage and verify certificates Identity, training and certificate data Performance of a contract; legitimate interests in preventing certificate fraud and allowing qualifications to be verified
Provide employer reporting to authorised company admins at an eligible member employer Identity, professional, enrolment, attendance, completion, certificate and activity-score data Performance of training arrangements where applicable; legitimate interests of DROPS, the member employer and the learner in administering employer-linked training, confirming completion and managing sponsored places, subject to the choice in section 5.4
Respond to enquiries and provide support Identity, contact and communication data Performance of a contract or steps requested by you; legitimate interests in responding and maintaining service quality
Provide an AI-assisted feature when you choose to use it Account, communication and relevant service data Performance of a contract or steps requested by you; legitimate interests in providing, securing and improving the requested feature
Protect users, investigate misuse and maintain the service Account, technical, security and communication data Legitimate interests in security, fraud prevention, troubleshooting and protecting legal rights; legal obligations where applicable
Maintain financial, tax, governance and compliance records Identity, contact, transaction and relevant service records Legal obligations; legitimate interests in governance and the establishment, exercise or defence of legal claims
Measure public website use through Vercel's cookieless analytics Limited technical and website interaction data Legitimate interests in understanding aggregate website performance, subject to applicable law and privacy safeguards
Use Google Analytics to understand website use Website, device and interaction data Consent
Measure or improve advertising using Google Ads or the LinkedIn Insight Tag Website, device, campaign and interaction data Consent
Send optional marketing communications Identity, contact and preference data Consent, or legitimate interests where permitted by law and subject to your right to object
Provide requested Metaverse rooms, voice and local training Account and profile information, room presence, audio, avatar movements, interactions and connection information Performance of a contract for the service you request; legitimate interests in reliable and secure service delivery where applicable
Handle reports, abuse and safety concerns Report contents, relevant identities, session details and moderation records Legitimate interests in protecting participants and investigating misuse; legal obligations where applicable
Maintain essential app operation and investigate service failures Entry, connection and necessary technical records Performance of a contract where necessary to provide the service; legitimate interests in service security and reliability
Provide optional crash reporting in the forthcoming store release Limited error, app-version, platform and diagnostic information Consent; the opt-in change is pending
Provide optional usage and download statistics in the forthcoming store release App usage, download and installation information described in section 3.1 Consent; only if you agree in the app; you can change this in Settings. This change is pending.

Where we rely on legitimate interests, we consider the purpose, necessity and effect on the people concerned. You may object to processing based on legitimate interests as explained in section 13.

Where we ask for consent, you may refuse or withdraw it without affecting the lawfulness of processing that took place before withdrawal. Refusing optional analytics or marketing consent does not prevent you from using the core website or training services.

5. Member employers and employer reporting

Training is treated as linked to a member employer when the learner uses an email address whose domain is linked to an active DROPS member company. This applies whether the training was paid for directly by the employer or provided through another member benefit or arrangement.

5.1 Who can see employer reporting

Employer reporting is available to a small number of named individuals at the member company, whom we call company admins. A company admin is nominated by the member company and is approved and recorded by DROPS. Access is never granted automatically, and it is not available to colleagues generally.

Access requires both of the following to be true each time the information is requested:

  • the person's own verified work email address belongs to an active DROPS member company; and
  • DROPS holds a current, active authorisation for that person and that company.

If either stops being true — for example the person leaves the company, or the company's membership ends — access stops at that point without anyone having to withdraw it.

Company admins may view this information on the DROPS Forum website and may download it as a spreadsheet. DROPS may also provide the same information to a member company directly.

5.2 What a company admin can see and manage

For colleagues whose work email domain belongs to the same member company, a company admin may see:

  • name and work email address;
  • which DROPS programme the person is enrolled in, and which of its modules they hold;
  • for each module, whether it is completed, attended, enrolled but not yet started, or not held;
  • the number of DROPS Forum sessions attended;
  • completion dates, certificate status and certificate details;
  • a total activity score ("XP") reflecting participation across DROPS services, including activity outside the programme;
  • where the member company sponsors a limited number of places under its membership agreement, which colleagues hold those places; and
  • a dated record of their colleagues' enrolments, attendance, completions and certificates.

Employer reporting also lists people at the member company who hold a DROPS account but have not enrolled in the programme, so that the employer can plan and encourage participation.

For the DROPS Focal Point Program, a company admin may assign or release the company's sponsored places, enrol same-company colleagues in the programme, and withdraw them from it. Withdrawal removes unstarted programme access and releases any sponsored place. It does not delete attendance, completed work, XP or certificates.

5.3 What a company admin cannot see

Employer reporting does not include assessment scores, individual answers, attempts, lesson-level progress within a module, time-spent records, AI assistant prompts, support enquiries, payment or invoice information, sign-in records, or any information about a person outside their own member company.

5.4 Your choice about employer reporting

You can ask us to keep your individual training record out of your employer's reporting by emailing secretary@drops.asia. We will action the request and confirm it to you.

If you do, your name, email address and individual record stop appearing in your employer's reporting and in anything they download from us.

Two things to be aware of:

  • Where your employer sponsors or funds your place, we may still confirm to them that a sponsored place is in use and whether the required training was completed, because that is necessary for the arrangement between DROPS and your employer. We will not share the rest of your record.
  • Your employer may separately hold its own records about your training, which this choice does not affect.

Choosing this does not affect your access to training, your progress or your certificates.

If your member-company association is recorded incorrectly, contact secretary@drops.asia.

6. Training records and progress

We store training records so that learners can continue courses, view their status and demonstrate completion, and so that DROPS can deliver, support and improve training. These records may include enrolment, attendance, lesson or module progress, assessment scores, answers, attempts, time spent and completion information.

Detailed progress information is available only to the learner and authorized DROPS administrators, except for the employer reporting described in section 5. It is not included in public certificate verification.

7. Certificates, public verification and LinkedIn sharing

Certificates are normally valid for two years from their issue date.

To allow a certificate to be checked and to reduce fraud, a person who has the certificate's verification link or certificate number may view limited verification information. This may include:

  • the certificate holder's name;
  • the course or workshop title;
  • the certificate number;
  • the issue and expiry dates; and
  • whether the certificate is valid or expired.

The public verification page does not display assessment scores, answers, attempts, detailed training progress, time-spent information, the holder's email address, or the certificate PDF. Public verification pages are intended for direct verification and are configured not to be indexed by search engines. A no-index instruction cannot guarantee that every third party will remove or never display a URL.

Certificate PDFs are private. They are available to the certificate holder and authorized DROPS administrators through controlled access. A holder may download the PDF and is responsible for any copy they subsequently share.

We provide user-initiated links that can help a certificate holder add a certificate to LinkedIn or share its verification URL. DROPS does not automatically post to LinkedIn and does not need access to the holder's LinkedIn account for this function. If you choose to continue to LinkedIn, LinkedIn processes information under its own privacy policy. DROPS cannot control copies or posts that you or another person publish outside our services.

8. Cookies, local storage and analytics

Essential technologies

We use essential cookies and similar storage where necessary for authentication, security, session continuity, remembering privacy choices and providing requested functionality. These cannot be disabled through our preference tool because the relevant service may not work without them.

Vercel provides automated website and bot security at the edge. When Vercel identifies a suspicious request, it may present an essential security checkpoint before allowing the browser to continue. Vercel may process limited technical and security data, such as IP address, browser and device information, and checkpoint interaction signals, to distinguish people from automated traffic. We do not use this security processing for advertising or optional analytics.

Vercel Analytics

We use Vercel to host the website and to provide a cookieless, privacy-focused baseline of public website activity. We configure this baseline to avoid collecting personal custom-event properties, to remove query strings and sensitive route identifiers, and to exclude private account and administration routes. Vercel may still process limited technical information needed to deliver the website and produce aggregate analytics.

Google Analytics

Google Analytics is optional and loads only after you give analytics consent. It helps us understand how consented visitors use the website, such as pages viewed and interactions. Google Analytics data therefore represents only the consented portion of website use and will not match Vercel's all-visitor baseline.

Google Ads and LinkedIn

Google Ads and the LinkedIn Insight Tag are optional marketing technologies. They load only after you give marketing consent. They may be used to measure advertising performance, understand whether an advertisement led to an action, build audiences where permitted, and improve campaign relevance.

We do not send events that occurred before consent to Google or LinkedIn after consent is given.

Managing your choices

When the consent panel is shown, you can accept all optional technologies, reject them, or choose analytics and marketing separately. You can change or withdraw your choices at any time using Manage Cookie Preferences on this page. Withdrawal applies to future processing and does not make earlier consent-based processing unlawful.

You may also restrict cookies through your browser. Browser controls can affect site functionality and must usually be configured separately on each browser or device.

App storage and controls

DROPS Metaverse uses local storage for sign-in, profile and configuration caches, avatar and audio settings, mute and block choices, downloaded content and related installation information. These app settings are separate from the website's cookie preferences. You can control microphone permission through your device or browser and use the app's voice controls or leave the session to stop speaking to other participants. You can explore without voice where that feature is available.

The Metaverse app does not use an advertising identifier or an advertising network to track you for personalised advertisements. It does use the operational and usage information described in section 3.1. If you use the browser version on our website, the surrounding website's optional analytics and marketing technologies remain subject to the choices described in this section.

Current store-build configurations enable usage and download statistics, including the identifiers described here; this collection is separate from website cookie choices. In the forthcoming store release, we will collect usage and download statistics only if you agree in the app; you can change this in Settings. These new opt-in controls are pending and must not be assumed to apply to an earlier app version.

Current app error reports

Where crash reporting is configured, supported existing builds send limited error reports to Sentry. In the current app configuration, Send crash reports starts enabled; you can turn it off in Settings. Turning it off stops future reporting through that control. It does not automatically remove reports already received; contact us about those records. We describe this existing behavior so that users of earlier versions do not mistake the planned opt-in change for a current control.

Planned optional app error reports

The forthcoming store release will ask for your choice and send no app error reports unless you agree. This opt-in change is being developed. In that release, you can choose to send limited app error reports to Sentry to help us diagnose faults. This is off until you choose to enable Send crash reports in Settings. You can turn it off again at any time without losing access to training. Withdrawal stops future reporting; contact us if you also want us to assess deletion of reports already received.

The reports contain limited error and code-stack information, app version, release environment and platform. Our app removes account details, arbitrary message text, screenshots, voice recordings and attachments from these reports. Sentry also receives technical information needed to receive and process a request. Error reporting is disabled in the current browser app.

9. Who receives personal data?

We disclose personal data only where needed for the purposes in this policy, where you direct us to do so, or where the law permits or requires it. Recipients may include:

  • authorized DROPS personnel and contractors;
  • an eligible member employer, limited to the employer reporting described in section 5;
  • Supabase, for authentication, database and file-storage services;
  • Vercel, for website hosting, delivery, security and cookieless website analytics;
  • Stripe, for payment processing and payment records;
  • Microsoft, where Microsoft services are used for events, meetings, calendars or communications;
  • Amazon Web Services, including Amazon SES, for service and event email delivery;
  • OpenAI, where an AI-assisted feature sends the prompt and relevant service context needed to produce the requested response;
  • Google, for consented Google Analytics and Google Ads services;
  • LinkedIn, when marketing consent permits the Insight Tag, or when you choose to use a LinkedIn sharing link;
  • Other participants, authorised app company administrators and local training organisers, for the shared-room, live-roster and local-session information described in section 3.1;
  • Fly.io, for hosting our Metaverse multiplayer and related services;
  • LiveKit, for live voice delivery, room and participant handling and connection diagnostics;
  • Tigris, for downloadable training content and associated delivery information;
  • Sentry, where app error reporting is configured and enabled;
  • Apple, Microsoft and Meta, for distribution through their stores and any platform checks used by the relevant app. The stores also process their own account, transaction, device and usage information under their privacy notices; and

  • Our customer-management and operational notification providers, where needed to administer shared accounts and service activity. These may include HubSpot for customer records and Telegram for restricted operational notifications, which can contain an account email address or entry information.

  • professional advisers, auditors, insurers and prospective transaction parties where reasonably necessary and subject to appropriate duties; and

  • courts, regulators, law-enforcement bodies or other authorities where disclosure is legally required or necessary to protect legal rights.

Some providers act as our processors and others, such as payment or social platforms for aspects of their own services, may act as independent controllers. Their own privacy notices provide more information about their processing.

We do not sell personal data.

We do not make decisions based solely on automated processing that produce legal or similarly significant effects for you. AI-assisted output supports a requested feature and is not treated as an unquestionable decision about you.

10. International transfers

DROPS is based in Singapore and provides services internationally. Our providers and users may be located in Singapore, the European Economic Area, the United Kingdom, the United States and other countries. Personal data may therefore be processed outside the country in which it was collected.

Where required, we use contracts and other recognized safeguards intended to provide a comparable standard of protection. These may include contractual data-protection terms, the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, transfer-risk assessments and security controls. You may contact us for information about the safeguards relevant to your personal data.

11. How long we keep personal data

We keep personal data only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, security and dispute requirements.

Record Normal retention approach
Account and profile information While the account is active, then deleted or anonymized when it is no longer needed, subject to the periods below and any legal requirement
Training, enrolment and examination evidence While the account is active and for two years after account closure. The planned deletion process is intended to retain only limited evidence needed for the retained purpose, rather than all original account-linked answers and activity detail. For a current assisted request, we confirm what has been removed and what must remain.
Certificate verification record and private certificate PDF Six years from the certificate's issue date
Public certificate status Shown as valid during the two-year validity period and as expired after that, until the six-year retention period ends
Payment, tax and accounting records For the period required by applicable financial and tax laws
Security and server logs For a limited period appropriate to security, diagnostics and abuse prevention
Consent records For as long as needed to demonstrate and manage the consent, including after withdrawal where evidence is legally required
Enquiries and routine correspondence For as long as needed to answer the enquiry and manage any follow-up, dispute or legal requirement
Metaverse entry, room and download records The intended approach for the forthcoming release is to keep records only as long as needed for service operation, usage analysis or fault investigation, and remove identifying fields when unnecessary. The new purge/minimisation controls are pending. Contact us for current handling and applicable provider retention information.
Conduct reports and moderation records Current emailed concerns are handled as support correspondence for the enquiry, follow-up, dispute or legal requirement. For the planned reporting service, the intended approach is to retain reports while needed for assessment, action and review, and delete or minimise identifying details when no longer needed. Its retention controls remain pending.
App error reports and provider security logs For the diagnostic or security period needed by DROPS and the relevant provider, subject to the provider's retention settings and any justified legal hold.
Limited account-erasure and suppression records The planned erasure process is intended to keep limited evidence and suppression information needed to prevent erased data being restored, reattached to a new account or used for outreach, without a usable login or ordinary contact profile. That automated safeguard is not yet verified in the released app. For current assisted requests, we confirm the records and follow-up steps individually.

Ordinary live voice is processed to deliver the conversation rather than to create a stored training or certificate record. Our app does not keep a recording or transcript of ordinary participant voice chat. This does not mean that service providers process no connection or security information.

Retained certificate verification information can still include the recipient's name and award details, and the private certificate PDF can contain the recipient's name, until six years from issue. Public verification continues to show only the limited fields described in section 7. Keeping a certificate verifiable does not require keeping a usable shared login. The forthcoming deletion process is intended to separate retained evidence from the deleted login and prevent same-email sign-up from restoring erased history. Those automated safeguards are still being developed. For current assisted requests, we explain the confirmed removal, retention and any remaining steps.

Owner-controlled copies held by our service providers are included in our deletion or minimisation process where applicable. Some managed security logs and backups expire under their retention schedules. Copies already received by an employer, another participant or another independent organisation may require a separate request to that organisation. Contact us for assistance. These limitations do not remove rights you have under applicable law.

At the end of the six-year certificate period, the personal certificate record and certificate PDF are deleted. The verification URL will then no longer confirm the certificate. Keeping an account active does not extend this period.

We may retain particular information for longer where required by law, where there is an unresolved complaint or dispute, or where it is reasonably needed for the establishment, exercise or defence of legal claims. Where possible, we restrict further use during such a hold.

12. How we protect personal data

We use technical and organizational measures designed to protect personal data against unauthorized access, use, disclosure, alteration, loss or destruction. These measures include access controls, role-based permissions, encrypted connections, authentication safeguards, logging, backups, service-provider controls and review of access to administrative functions.

No online service can guarantee absolute security. You should protect your account and email access, use trusted devices, and tell us promptly if you believe your account or certificate has been misused.

13. Your rights

Your rights depend on where you are located and which law applies. Subject to applicable conditions and exceptions, you may have the right to:

  • ask whether we process your personal data and request access to it;
  • ask us to correct inaccurate or incomplete data;
  • ask us to delete personal data;
  • ask us to restrict processing;
  • object to processing based on legitimate interests or to direct marketing;
  • ask us to keep your training record out of your employer's reporting, as described in section 5.4;
  • receive certain data in a portable format;
  • withdraw consent at any time;
  • ask for information about international-transfer safeguards; and
  • complain to a data-protection authority.

Singapore's Personal Data Protection Act also provides rights and obligations relating to access, correction, consent, purpose limitation, protection, retention and transfers. Where the UK GDPR or EU GDPR applies, the rights under those laws apply subject to their conditions.

To exercise a right, contact secretary@drops.asia. We may need to verify your identity and clarify your request. We will respond within the period required by applicable law. Some rights are not absolute, and we will explain any lawful reason why we cannot fully comply.

13.1 Deleting your shared DROPS account

Current route: email secretary@drops.asia with the subject Delete my DROPS account, identify the account email and complete appropriate identity verification. Do not email your sign-in code or password. You can use this route now, including if you cannot sign in.

Planned in-app route: the forthcoming store release will offer Delete my account inside DROPS Metaverse for all account holders, including company administrators and DROPS staff. This feature is being developed; it is not presented as available in existing versions. The public account-deletion help page will provide the exact navigation when the released controls have been verified. In the planned in-app flow, we will send a one-time confirmation code to your verified account email address to check that the request is yours. The planned process is intended to remove the login shared by DROPS Forum and DROPS Metaverse, your profile and other account-linked personal information, subject to limited retained records. It will close access to both services on all platforms. A current assisted request is assessed individually: we explain what has been removed, what is retained and any remaining steps; closing or disabling access alone is not represented as completed erasure.

We retain limited evidence needed for training, certificate verification and legal accounting requirements. Training, enrolment and examination evidence is kept for two years after account closure. Certificates and information needed to verify them, including the recipient's name, are kept for six years from issue. Payment and tax records are kept for the period required by applicable law. Documented legal holds may delay deletion of affected records. Separation from the deleted login and prevention of same-email restoration are intended safeguards of the forthcoming automated process; they are not claimed as a verified current app capability.

The forthcoming process is intended to preserve other people's shared game or discussion history under “Deleted user”, with identifying content removed or minimised, and to minimise safety-report and erasure information as described in section 11. For current assisted requests, we assess identifying shared content and reports separately and confirm the action taken; those automated transformations are not yet verified.

In the forthcoming release, the following arrangement will apply to in-app deletion as well as assisted deletion: If you are a company administrator or a DROPS staff member, deleting your account also removes your administrator role. DROPS then looks after your company's administration until your company names a new administrator. Until that in-app flow is released, contact us for deletion assistance and responsibility transfer. If you cannot complete deletion in the app, cannot access your account, or need help with provider copies, email secretary@drops.asia. Account-deletion help is available at dropsforum.org/account-deletion without signing in.

For an assisted request, we explain the retained categories, relevant dates and any additional steps or time needed. The planned in-app flow is intended to show the outcome and retention dates too; its automated deletion and retention controls remain subject to release verification. Some provider copies, logs and backups are handled separately as explained in section 11. Signing out or uninstalling the app does not delete your account. There is no fee to request deletion. If you have a paid service or subscription, check its cancellation arrangements as well; we will explain any action needed for billing separately.

14. Complaints

Please contact us first at secretary@drops.asia so that we can investigate and try to resolve your concern.

You may also complain to the authority responsible for data protection where you live or work, or where you believe an infringement occurred. In Singapore, this is the Personal Data Protection Commission. If the EU GDPR or UK GDPR applies, you may contact the competent supervisory authority in the relevant country.

For DROPS Metaverse support or conduct concerns, email secretary@drops.asia. Where your app version provides People & safety, use it to mute, block or report another participant. If it opens an email composer, send the report yourself. Public support information is available at dropsforum.org/metaverse-support. These support and help pages do not require a DROPS login. For an immediate emergency, use the appropriate local emergency services; the app is not an emergency reporting service.

15. Changes to this policy

We may update this policy when our services, providers or legal obligations change. The published policy will show its version and effective date. If a change materially affects how we use personal data, we will provide additional notice where required.

Version 2.1 (5 August 2026; management disclosure updated 18 August 2026) introduced employer reporting through named company admins, including a self-service company view and management of Focal Point Program enrolments and sponsored places. It also explains the learner's choice about employer reporting and what training history is preserved after withdrawal.

Version 2.2 adds Cloudflare Turnstile as an essential, on-demand security check for login and account creation when the primary automated check cannot validate the request. It explains the limited technical and security data involved and confirms that Turnstile is not used for advertising or optional analytics.

Version 2.3 removes the proposed Cloudflare fallback, which was not activated, and documents Vercel's native automated security and on-demand checkpoint. This keeps website delivery and bot protection with the existing hosting provider.

Version 2.4 explicitly covers DROPS Metaverse and its shared account with DROPS Forum. It adds information about participant visibility, multiplayer activity, voice, local training, reports, app storage, usage and diagnostics, providers and shared-account deletion. It retains the existing training, certificate and payment retention approach. It distinguishes the existing app configuration from the opt-in, deletion and reporting changes planned for the forthcoming store release. These descriptions do not certify that an automated purge, reporting service or store submission has been accepted.

Public help: DROPS Metaverse support · Account-deletion help · Terms of Service.