Privacy

Version 2.1

Effective date: 5 August 2026

This Privacy Policy explains how Dropped Object Prevention Scheme Asia Pte Ltd collects, uses, discloses, stores and protects personal data when you use the DROPS Forum website, register for events, take part in training, receive or verify a certificate, contact us, or otherwise use our services.

1. Who is responsible for your personal data?

The controller is:

Dropped Object Prevention Scheme Asia Pte Ltd<br> Represented by Joachim van der Meulen<br> 50H Faber Heights<br> 01-60 Faber Crest<br> Singapore 129202

Privacy and data protection enquiries: secretary@drops.asia

In this policy, "DROPS", "we", "us" and "our" refer to Dropped Object Prevention Scheme Asia Pte Ltd.

2. Who does this policy apply to?

This policy applies to visitors to our website and users of our services, including learners, event attendees, certificate holders, member-company employees and representatives, customers, suppliers, contributors and people who contact us.

3. Personal data we collect

Depending on how you use our services, we may collect:

Account and identity data, such as your name, email address, account identifier, sign-in records and authentication information.
Professional and membership data, such as your employer or company, email domain, job title, member-company association and membership status.
Contact and communication data, such as messages, enquiries, feedback, support requests, AI-assistant prompts and responses where you choose to use an AI feature, and communication preferences. Do not put personal or confidential information in an AI prompt unless it is needed for your request.
Event and transaction data, such as registrations, attendance, selected sessions, invoices, payment status, discount or coupon use and related transaction references. Payment card details are processed by our payment provider and are not stored by DROPS.
Training and learning data, such as course and workshop enrolments, attendance, start and completion dates, completion status, lesson or module progress, assessment results, scores, answers, attempts, time spent, activity scores awarded for participation across DROPS services, and other information needed to provide and administer training.
Certificate data, such as the certificate holder's name, email address, course or workshop title, certificate number, issue date, expiry date, validity status and certificate PDF.
Technical and security data, such as IP address, browser and device information, operating system, referring page, requested pages, timestamps, diagnostic information, security events and server logs.
Website and marketing data, such as page views, interactions, campaign parameters and advertising events where the relevant consent has been provided.
Information you choose to share with third parties, for example when you use a link to add a certificate to LinkedIn or share a certificate verification page.

We normally receive personal data directly from you. We may also receive it from your employer or member company, an event organiser, a payment provider, an authentication provider, or from records produced when you use our services.

4. Why we use personal data and our legal bases

We use personal data only where we have a lawful basis. The basis depends on the activity and the law that applies to you.

Purpose	Personal data commonly used	Legal basis
Create and secure accounts, authenticate users and provide requested services	Account, identity, contact, technical and security data	Performance of a contract or steps requested before entering a contract; legitimate interests in providing and securing the service
Register and administer events, training and payments	Identity, contact, professional, event, transaction and training data	Performance of a contract; legitimate interests in administration and service delivery; legal obligations where applicable
Deliver training and record learning progress	Identity, account, professional and training data	Performance of a contract; legitimate interests in providing, improving and evidencing training
Issue, manage and verify certificates	Identity, training and certificate data	Performance of a contract; legitimate interests in preventing certificate fraud and allowing qualifications to be verified
Provide employer reporting to authorised company admins at an eligible member employer	Identity, professional, enrolment, attendance, completion, certificate and activity-score data	Performance of training arrangements where applicable; legitimate interests of DROPS, the member employer and the learner in administering employer-linked training, confirming completion and managing sponsored places, subject to the choice in section 5.4
Respond to enquiries and provide support	Identity, contact and communication data	Performance of a contract or steps requested by you; legitimate interests in responding and maintaining service quality
Provide an AI-assisted feature when you choose to use it	Account, communication and relevant service data	Performance of a contract or steps requested by you; legitimate interests in providing, securing and improving the requested feature
Protect users, investigate misuse and maintain the service	Account, technical, security and communication data	Legitimate interests in security, fraud prevention, troubleshooting and protecting legal rights; legal obligations where applicable
Maintain financial, tax, governance and compliance records	Identity, contact, transaction and relevant service records	Legal obligations; legitimate interests in governance and the establishment, exercise or defence of legal claims
Measure public website use through Vercel's cookieless analytics	Limited technical and website interaction data	Legitimate interests in understanding aggregate website performance, subject to applicable law and privacy safeguards
Use Google Analytics to understand website use	Website, device and interaction data	Consent
Measure or improve advertising using Google Ads or the LinkedIn Insight Tag	Website, device, campaign and interaction data	Consent
Send optional marketing communications	Identity, contact and preference data	Consent, or legitimate interests where permitted by law and subject to your right to object

Where we rely on legitimate interests, we consider the purpose, necessity and effect on the people concerned. You may object to processing based on legitimate interests as explained in section 13.

Where we ask for consent, you may refuse or withdraw it without affecting the lawfulness of processing that took place before withdrawal. Refusing optional analytics or marketing consent does not prevent you from using the core website or training services.

5. Member employers and employer reporting

Training is treated as linked to a member employer when the learner uses an email address whose domain is linked to an active DROPS member company. This applies whether the training was paid for directly by the employer or provided through another member benefit or arrangement.

5.1 Who can see employer reporting

Employer reporting is available to a small number of named individuals at the member company, whom we call company admins. A company admin is nominated by the member company and is approved and recorded by DROPS. Access is never granted automatically, and it is not available to colleagues generally.

Access requires both of the following to be true each time the information is requested:

the person's own verified work email address belongs to an active DROPS member company; and
DROPS holds a current, active authorisation for that person and that company.

If either stops being true — for example the person leaves the company, or the company's membership ends — access stops at that point without anyone having to withdraw it.

Company admins may view this information on the DROPS Forum website and may download it as a spreadsheet. DROPS may also provide the same information to a member company directly.

5.2 What a company admin can see

For colleagues whose work email domain belongs to the same member company, a company admin may see:

name and work email address;
which DROPS programme the person is enrolled in, and which of its modules they hold;
for each module, whether it is completed, attended, enrolled but not yet started, or not held;
the number of DROPS Forum sessions attended;
completion dates, certificate status and certificate details;
a total activity score ("XP") reflecting participation across DROPS services, including activity outside the programme;
where the member company sponsors a limited number of places under its membership agreement, which colleagues hold those places; and
a dated record of their colleagues' enrolments, attendance, completions and certificates.

Employer reporting also lists people at the member company who hold a DROPS account but have not enrolled in the programme, so that the employer can plan and encourage participation.

5.3 What a company admin cannot see

Employer reporting does not include assessment scores, individual answers, attempts, lesson-level progress within a module, time-spent records, AI assistant prompts, support enquiries, payment or invoice information, sign-in records, or any information about a person outside their own member company.

5.4 Your choice about employer reporting

You can ask us to keep your individual training record out of your employer's reporting by emailing secretary@drops.asia. We will action the request and confirm it to you.

If you do, your name, email address and individual record stop appearing in your employer's reporting and in anything they download from us.

Two things to be aware of:

Where your employer sponsors or funds your place, we may still confirm to them that a sponsored place is in use and whether the required training was completed, because that is necessary for the arrangement between DROPS and your employer. We will not share the rest of your record.
Your employer may separately hold its own records about your training, which this choice does not affect.

Choosing this does not affect your access to training, your progress or your certificates.

If your member-company association is recorded incorrectly, contact secretary@drops.asia.

6. Training records and progress

We store training records so that learners can continue courses, view their status and demonstrate completion, and so that DROPS can deliver, support and improve training. These records may include enrolment, attendance, lesson or module progress, assessment scores, answers, attempts, time spent and completion information.

Detailed progress information is available only to the learner and authorized DROPS administrators, except for the employer reporting described in section 5. It is not included in public certificate verification.

7. Certificates, public verification and LinkedIn sharing

Certificates are normally valid for two years from their issue date.

To allow a certificate to be checked and to reduce fraud, a person who has the certificate's verification link or certificate number may view limited verification information. This may include:

the certificate holder's name;
the course or workshop title;
the certificate number;
the issue and expiry dates; and
whether the certificate is valid or expired.

The public verification page does not display assessment scores, answers, attempts, detailed training progress, time-spent information, the holder's email address, or the certificate PDF. Public verification pages are intended for direct verification and are configured not to be indexed by search engines. A no-index instruction cannot guarantee that every third party will remove or never display a URL.

Certificate PDFs are private. They are available to the certificate holder and authorized DROPS administrators through controlled access. A holder may download the PDF and is responsible for any copy they subsequently share.

We provide user-initiated links that can help a certificate holder add a certificate to LinkedIn or share its verification URL. DROPS does not automatically post to LinkedIn and does not need access to the holder's LinkedIn account for this function. If you choose to continue to LinkedIn, LinkedIn processes information under its own privacy policy. DROPS cannot control copies or posts that you or another person publish outside our services.

8. Cookies, local storage and analytics

Essential technologies

We use essential cookies and similar storage where necessary for authentication, security, session continuity, remembering privacy choices and providing requested functionality. These cannot be disabled through our preference tool because the relevant service may not work without them.

Vercel Analytics

We use Vercel to host the website and to provide a cookieless, privacy-focused baseline of public website activity. We configure this baseline to avoid collecting personal custom-event properties, to remove query strings and sensitive route identifiers, and to exclude private account and administration routes. Vercel may still process limited technical information needed to deliver the website and produce aggregate analytics.

Google Analytics

Google Analytics is optional and loads only after you give analytics consent. It helps us understand how consented visitors use the website, such as pages viewed and interactions. Google Analytics data therefore represents only the consented portion of website use and will not match Vercel's all-visitor baseline.

Google Ads and LinkedIn

Google Ads and the LinkedIn Insight Tag are optional marketing technologies. They load only after you give marketing consent. They may be used to measure advertising performance, understand whether an advertisement led to an action, build audiences where permitted, and improve campaign relevance.

We do not send events that occurred before consent to Google or LinkedIn after consent is given.

Managing your choices

When the consent panel is shown, you can accept all optional technologies, reject them, or choose analytics and marketing separately. You can change or withdraw your choices at any time using Manage Cookie Preferences on this page. Withdrawal applies to future processing and does not make earlier consent-based processing unlawful.

You may also restrict cookies through your browser. Browser controls can affect site functionality and must usually be configured separately on each browser or device.

9. Who receives personal data?

We disclose personal data only where needed for the purposes in this policy, where you direct us to do so, or where the law permits or requires it. Recipients may include:

authorized DROPS personnel and contractors;
an eligible member employer, limited to the completion information described in section 5;
Supabase, for authentication, database and file-storage services;
Vercel, for website hosting, delivery, security and cookieless website analytics;
Stripe, for payment processing and payment records;
Microsoft, where Microsoft services are used for events, meetings, calendars or communications;
Amazon Web Services, including Amazon SES, for service and event email delivery;
OpenAI, where an AI-assisted feature sends the prompt and relevant service context needed to produce the requested response;
Google, for consented Google Analytics and Google Ads services;
LinkedIn, when marketing consent permits the Insight Tag, or when you choose to use a LinkedIn sharing link;
professional advisers, auditors, insurers and prospective transaction parties where reasonably necessary and subject to appropriate duties; and
courts, regulators, law-enforcement bodies or other authorities where disclosure is legally required or necessary to protect legal rights.

Some providers act as our processors and others, such as payment or social platforms for aspects of their own services, may act as independent controllers. Their own privacy notices provide more information about their processing.

We do not sell personal data.

We do not make decisions based solely on automated processing that produce legal or similarly significant effects for you. AI-assisted output supports a requested feature and is not treated as an unquestionable decision about you.

10. International transfers

DROPS is based in Singapore and provides services internationally. Our providers and users may be located in Singapore, the European Economic Area, the United Kingdom, the United States and other countries. Personal data may therefore be processed outside the country in which it was collected.

Where required, we use contracts and other recognized safeguards intended to provide a comparable standard of protection. These may include contractual data-protection terms, the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, transfer-risk assessments and security controls. You may contact us for information about the safeguards relevant to your personal data.

11. How long we keep personal data

We keep personal data only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, security and dispute requirements.

Record	Normal retention approach
Account and profile information	While the account is active, then deleted or anonymized when it is no longer needed, subject to the periods below and any legal requirement
Detailed enrolment, assessment and training-progress records	While the account is active and for two years after account closure
Certificate verification record and private certificate PDF	Six years from the certificate's issue date
Public certificate status	Shown as valid during the two-year validity period and as expired after that, until the six-year retention period ends
Payment, tax and accounting records	For the period required by applicable financial and tax laws
Security and server logs	For a limited period appropriate to security, diagnostics and abuse prevention
Consent records	For as long as needed to demonstrate and manage the consent, including after withdrawal where evidence is legally required
Enquiries and routine correspondence	For as long as needed to answer the enquiry and manage any follow-up, dispute or legal requirement

At the end of the six-year certificate period, the personal certificate record and certificate PDF are deleted. The verification URL will then no longer confirm the certificate. Keeping an account active does not extend this period.

We may retain particular information for longer where required by law, where there is an unresolved complaint or dispute, or where it is reasonably needed for the establishment, exercise or defence of legal claims. Where possible, we restrict further use during such a hold.

12. How we protect personal data

We use technical and organizational measures designed to protect personal data against unauthorized access, use, disclosure, alteration, loss or destruction. These measures include access controls, role-based permissions, encrypted connections, authentication safeguards, logging, backups, service-provider controls and review of access to administrative functions.

No online service can guarantee absolute security. You should protect your account and email access, use trusted devices, and tell us promptly if you believe your account or certificate has been misused.

13. Your rights

Your rights depend on where you are located and which law applies. Subject to applicable conditions and exceptions, you may have the right to:

ask whether we process your personal data and request access to it;
ask us to correct inaccurate or incomplete data;
ask us to delete personal data;
ask us to restrict processing;
object to processing based on legitimate interests or to direct marketing;
ask us to keep your training record out of your employer's reporting, as described in section 5.4;
receive certain data in a portable format;
withdraw consent at any time;
ask for information about international-transfer safeguards; and
complain to a data-protection authority.

Singapore's Personal Data Protection Act also provides rights and obligations relating to access, correction, consent, purpose limitation, protection, retention and transfers. Where the UK GDPR or EU GDPR applies, the rights under those laws apply subject to their conditions.

To exercise a right, contact secretary@drops.asia. We may need to verify your identity and clarify your request. We will respond within the period required by applicable law. Some rights are not absolute, and we will explain any lawful reason why we cannot fully comply.

14. Complaints

Please contact us first at secretary@drops.asia so that we can investigate and try to resolve your concern.

You may also complain to the authority responsible for data protection where you live or work, or where you believe an infringement occurred. In Singapore, this is the Personal Data Protection Commission. If the EU GDPR or UK GDPR applies, you may contact the competent supervisory authority in the relevant country.

15. Changes to this policy

We may update this policy when our services, providers or legal obligations change. The published policy will show its version and effective date. If a change materially affects how we use personal data, we will provide additional notice where required.

Version 2.1 (5 August 2026): employer reporting is now provided through named company admins with a self-service view of their colleagues' training records, and learners can ask for their own record to be kept out of it. See section 5.