Last update: 2 August 2021

Purpose of this Policy

What is included in our SM Services?

Definitions

Who operates the SM services?

What are the types of Personal data collected and used by us?

How and for which purposes will the Personal data collected be used?

On which legal basis will your Personal data be collected and processed? 
We collect and process your Personal data where necessary for the performance of a contract to which You are subject as well as for Sodexo’s legitimate interests except where such interests are overridden by your interests or fundamental rights and freedoms. We will also rely on your consent to collect and process any sensitive Personal data. You will be able to withdraw your consent at any time.

To whom will my Personal data be disclosed?

How will your Personal data be protected?

How can You access your Personal data?

Right of access  

You can request access to your Personal data. You may also request rectification of inaccurate Personal data, or to have incomplete Personal data completed. 
You can request any available information as to the source of the Personal data, and You may also request a copy of your Personal data being processed by Sodexo.

Right to be forgotten

Your right to be forgotten entitles You to request the erasure of your Personal data in cases where:
(i)    the data is no longer necessary in relation for the purposes of its collection or processing;
(ii)    You choose to withdraw your consent;
(iii)    You object to the processing by automated means using technical specifications; 
(iv)    your Personal data has been unlawfully processed;
(v)    there is a legal obligation to erase your Personal data;
(vi)    erasure is required to ensure compliance with applicable laws.

Right to restriction of processing

You may request the restriction of processing in the cases where:
(i)    You contest the accuracy of the Personal data;
(ii)    Sodexo no longer needs the Personal data, for the purposes of the processing;
(iii)    You have objected to processing for legitimate reasons.

Right to data portability 

You can request, where applicable, the portability of your Personal data that You have provided to Sodexo, in a structured, commonly used, and machine-readable format. You have the right to transmit this data to another controller without hindrance from Sodexo where:
a)    the processing of your Personal data is based on consent or on a contract; and
b)    the processing is carried out by automated means.
You can also request to transmit directly your Personal data to a third party of your choice (where technically feasible). 

Right not to be subject to automated decisions  

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning You or similarly significantly affects You.
Right to lodge a complaint to the competent supervisory authority    If You have a privacy-related complaint against us, You may complete and submit the Request/Complaint Form  or make your complaint with the competent supervisory authority or the competent court where the Sodexo entity has an establishment or where you have your habitual residence. 


  
To exercise these rights, You can 

How long will your Personal data be held? 

Generally, the SM Services will retain your Personal data for 7 years after the last contact with You for the relevant purposes described in this Policy. This may be different from country to country dependent upon local law in Singapore, Malaysia, Thailand, Indonesia, Vietnam, or Philippines, whichever is applicable to the Sodexo local entity, and may be affected by specific regulatory or legal obligations for particular regulations.

How will You be notified if the uses of your data change?

Who is your local system administrator?

Contact us > Open sharing and other actions