Privacy Statement
National Association of Travel Agents Singapore ("NATAS")
1. About This Statement
This Privacy Statement explains how the National Association of Travel Agents Singapore ("NATAS", "we", "us", "our") collects, uses, discloses, and protects your personal data in accordance with the Personal Data Protection Act 2012 (as amended) ("PDPA").
NATAS is committed to managing personal data responsibly and in compliance with Singapore's data protection laws, including the 2021 PDPA amendments which introduced mandatory data breach notification and the data portability obligation.
This Statement applies to all individuals whose personal data NATAS collects, including members, event participants, members of the public who contact us, and job applicants.
2. Who We Are
Organisation | National Association of Travel Agents Singapore (NATAS) |
Address | 120 Lower Delta Road, #03-16 Cendex Centre, Singapore 169208 |
Website | www.natas.travel |
Data Protection Officer | Willie Tan, Raffles Corporate Services Pte. Ltd. |
DPO Email | dposervices@natas.travel |
3. Personal Data We Collect
Depending on how you interact with NATAS, we may collect the following personal data:
How You Interact with Us | Personal Data Collected | Purpose |
Member organisation and representative | Name, email, phone number, designation | Membership administration; event and circular communications |
Submitting a complaint or feedback | Name, phone number, email address; and any personal data you choose to include in attachments (e.g. booking forms) | Referring to relevant member travel agency with your consent |
Attending a NATAS Travel Fair or event | General information (age range, gender, travel habits) via survey; photographs and video footage at the venue | Market research; marketing and social media content |
Visiting our website | IP address and browsing information (via standard web analytics) | Website operation and improvement |
Job application | Resume, qualifications, employment history, references | Recruitment and employment evaluation |
We collect only the personal data that is necessary for the stated purpose. We do not collect NRIC numbers or copies of identity documents unless required by law or necessary to verify your identity to a high degree of accuracy.
4. How We Use Your Personal Data
We use personal data only for the purposes for which it was collected, or purposes you have consented to. These include:
- Managing NATAS membership, including renewals, correspondence, and certificate issuance.
- Organising and communicating about industry events, site visits, hotel previews, and travel fairs.
- Processing complaints from the public and referring them to member travel agencies where relevant (with your consent).
- Marketing and publishing event photography or video footage on our website and social media platforms, where adequate notice has been given or consent obtained.
- Complying with applicable laws and regulations.
- Evaluating and processing job applications.
We will not use your personal data for any purpose other than those stated above without first obtaining your consent.
5. Disclosure of Personal Data to Third Parties
NATAS may disclose your personal data to the following categories of third parties:
- Member travel agencies — where you have submitted a complaint and consented to your details being shared for resolution purposes.
- Service providers and data processors — such as our payroll and HR software provider (Sage EPE / Access EasyPay) and survey companies engaged for Travel Fair research. These parties are contractually required to protect your data and use it only for the specified purpose.
- Regulatory and government authorities — where required by law, such as the PDPC, CPF Board, or Ministry of Manpower.
NATAS does not sell, rent, or trade personal data to third parties for commercial purposes.
Regarding ASEANTA, FATA, and UFTAA: NATAS is a member of these overseas associations. No personal data about NATAS members, event participants, or members of the public is shared with these bodies. Their logos appear on our website solely to indicate our membership.
6. Transfer of Personal Data Outside Singapore
Where personal data is transferred to a recipient outside Singapore (for example, to a cloud service provider), NATAS takes reasonable steps to ensure that the recipient provides a standard of protection for the data that is comparable to the protection under the PDPA, including through data transfer agreements or equivalent contractual arrangements.
7. Retention of Personal Data
We retain personal data only for as long as it is necessary for the purpose it was collected, or as required by applicable law. Our general retention periods are:
Data Category | Retention Period |
Member records (active members) | For the duration of membership and 7 years thereafter |
Member records (former/terminated members) | 7 years from date of termination |
Complaint and feedback records | 1 year from case closure; sensitive attachments deleted within 30 days of case closure |
Event participation data | Up to 3 years from the event date |
Travel Fair survey data | Up to 2 years |
HR and staff records | 7 years from cessation of employment |
8. Protection of Personal Data
NATAS implements reasonable security arrangements to protect personal data in our possession against unauthorised access, disclosure, copying, modification, or disposal. These include:
- Individual user credentials for access to HR and payroll systems, with two-factor authentication and facial recognition.
- Restriction of personal data access to staff whose roles require it.
- Password protection for files containing personal data.
- Ongoing staff training on data protection obligations.
If you believe that your personal data in our possession has been compromised, please contact us immediately at dposervices@natas.travel.
9. Photography and Filming at NATAS Events
NATAS photographs and records video footage at public events such as the NATAS Travel Fair for marketing purposes, including publication on our website and social media channels (e.g. Facebook, Instagram, TikTok, and LinkedIn).
We will display prominent notice boards at event venues to inform visitors that photography and filming is taking place. By attending the event after viewing such a notice, you acknowledge that you may be photographed or filmed.
10. Your Rights
Under the PDPA, you have the following rights in relation to your personal data held by NATAS:
Right | What It Means |
Right to Access | Request to know what personal data NATAS holds about you and how it has been used or disclosed in the past year. |
Right to Correction | Request that inaccurate or incomplete personal data held by NATAS be corrected. |
Right to Withdraw Consent | Withdraw consent you have previously given for NATAS to collect, use, or disclose your personal data. We will stop doing so, subject to any legal obligations. |
Right to Data Portability | In certain circumstances, request that your personal data be transmitted to another organisation in a machine-readable format. This obligation applies where mandated by the PDPC. |
To exercise any of the above rights, please submit a written request to our DPO at dposervices@natas.travel. We will acknowledge your request within 3 business days and respond within 30 calendar days.
NATAS may charge a reasonable fee to cover the administrative costs of responding to access requests. No fee is charged for correction requests.
11. Data Breach Notification
In the event of a data breach that is likely to result in significant harm to you, or that affects 500 or more individuals, NATAS is required under the PDPA (2021 amendments) to:
- Notify the Personal Data Protection Commission (PDPC) within 3 calendar days of determining the breach is notifiable.
- Notify affected individuals within 30 calendar days of determining the breach is notifiable.
If you suspect that your personal data held by NATAS has been compromised, please contact our DPO immediately at dposervices@natas.travel.
12. Contact Us
For all data protection queries, access or correction requests, consent withdrawals, or complaints, please contact our Data Protection Officer:
Data Protection Officer | Willie Tan |
Organisation | Raffles Corporate Services Pte. Ltd. |
Email | dposervices@natas.travel |
Website | rafflescorporateservices.com |
Response Time | Acknowledgement within 3 business days; substantive response within 30 calendar days |
If you are not satisfied with how NATAS has handled your personal data or your request, you may contact the Personal Data Protection Commission (PDPC) at www.pdpc.gov.sg.
13. Updates to This Statement
NATAS may update this Privacy Statement from time to time to reflect changes in our operations, legal obligations, or PDPC guidance. The current version will always be published on our website at www.natas.travel.
This Statement is effective from 8 July 2026 and replaces all previous versions.