Privacy

1Who we are

CKSC Alumni Association Singapore (菲律賓中正學院新加坡校友會) is an alumni association registered in Singapore. We are the organisation responsible for the personal data described on this page.

Registered name

Chiang Kai Shek College Alumni Association Singapore

Registration number (UEN)

T25SS0049A · Registry of Societies

Singapore’s Personal Data Protection Act requires us to name someone you can reach about your data. Requests, questions and complaints go to our Data Protection Officer at info@ckscaasg.org.

2What this policy covers

• ckscaasg.org — this website, which anyone can read without signing in.
• app.ckscaasg.org — the Alumni Portal, which members sign in to.
• Our own records — what the association keeps about its members, including anything you told us by email or in person rather than through a website.

It does not cover Facebook or WhatsApp. We use both to reach alumni, but our Facebook page and the alumni WhatsApp group run on Meta’s services under Meta’s terms. What Meta does with your data there is between you and Meta.

3What we hold

Personal data reaches us in five ways, and they are not the same as each other.

• You email us. Whatever you put in the message. For a membership enquiry that is usually your name, your email address and the year you graduated.
• You are a member. We keep an alumni roster: your name, email address, graduating year, membership status, the date you joined, and occasional notes — a committee role, or that you asked us to use a different address.
• You sign in to the Alumni Portal. Signing in uses your Google account, which passes us your email address and the name on that account. We also record which role you hold in the association. Sign-in is by invitation: an address that is not on our list is turned away even if Google lets it through.
• You submit an idea. Ideas are anonymous unless you choose to add your name or email. If you leave both blank, nothing in the record identifies you.
• You visit this site. Counts of pages opened and links clicked. No name, no account, and nothing you typed. See cookies and analytics.

We do not ask for identity card numbers, dates of birth, financial details or anything about your health, and we have no way to accept them. There is no online payment.

4Photographs

We do not publish photographs of people on this website. Pictures taken at gatherings are usually posted to our Facebook page instead, where alumni can see them and tag themselves.

A photograph in which you are recognisable is personal data, and being in a room where a camera came out is not the same as agreeing to be published. If a picture of you is up and you would rather it were not, write to info@ckscaasg.org and we will take it down. You do not have to explain why.

5Why we use it

• To run the association’s membership — to know who is a member and to keep in touch.
• To tell you about events, news and anything the association is organising.
• To answer you when you write to us.
• To let members find and recognise each other in the Alumni Portal.
• To understand which parts of our site are useful, so we can improve them.

We use personal data for these purposes and no others. If we ever want it for something new, we will ask you first.

6Consent, and taking it back

When you email us your details to join, or fill in something on one of our sites, you consent to us using that data for the purposes above.

You can withdraw that consent at any time by writing to info@ckscaasg.org. We will act on it and tell you what it means in practice — for most requests it means we stop contacting you and remove your details, and it may mean we can no longer keep you as a member, because membership is difficult to administer for someone we are not allowed to contact. We will say so plainly rather than quietly dropping you from the roster.

7Cookies and analytics

We use one analytics service to count visits. It sets a cookie in your browser that gives it an anonymous identifier, so that ten pages opened in one sitting are counted as one visit rather than ten. The cookie is shared between ckscaasg.org and app.ckscaasg.org, which is how a member who follows a link from here into the portal is not counted twice.

The Alumni Portal sets one other cookie, which is what keeps you signed in between pages. It is not analytics and it is not shared with anyone; clearing it signs you out.

Those are the only cookies we set, and neither is for advertising. There are no advertising cookies and no third-party marketing trackers on either site — no advertising pixel, no remarketing tag, nothing that follows you to another website. The association does not advertise and does not sell anything, so there is nothing here for such a thing to do.

Two things are worth stating plainly, because they are the parts of website analytics people are right to worry about, and we turned both of them off:

• We do not record your screen. Session replay — which saves a video of what a visitor sees and does — is disabled. The Alumni Portal displays the alumni roster, and a replay of a member using it would be a recording of other people’s names and addresses.
• We do not capture clicks automatically. Automatic capture records every click along with the text of whatever was clicked, which on a members-only page means names and email addresses leaving the browser as analytics data. It is off. An event exists only because we wrote a line of code to record that specific thing.

Nothing on this public site is linked to a person. In the Alumni Portal, where you have signed in, analytics are linked to your account so we can tell a director’s use of the portal apart from a member’s.

If you would rather not be counted, every major browser can block cookies for a site, and browsers with a “do not track” or tracking-protection setting will stop the analytics loading at all. Nothing on either site stops working if you do.

8Who else can see it

We do not sell personal data, and we do not share it with anyone for their own marketing. The association has no arrangement under which that could happen.

We do rely on a small number of companies to run the sites. They act on our instructions and may not use what they hold for anything else:

Hosting

A hosting company serves every page of this site and the Alumni Portal.

Database

A database provider stores the Alumni Portal’s records, including the alumni roster, and enforces who is allowed to read which rows.

Sign-in

Signing in to the Alumni Portal is done through Google Sign-In. Google checks that you are who you say you are, under its own privacy policy, and passes us only what identifies your account — the name and email address on it. Your password is between you and Google; we never see it and have none of our own to lose.

Email and documents

An email provider holds the messages you send us and our replies, and the association’s own working files — including any spreadsheet a committee member is working from.

Website analytics

An analytics provider counts visits and clicks so we know which parts of the site are used.

Facebook

Our page runs on Meta’s service. We read its audience figures, which reach us as totals rather than as named people.

Beyond those companies, the roster stays inside the association. We do not send it to Chiang Kai Shek College, to alumni chapters in other countries, or to any other organisation. The difference matters: the companies above hold data in order to run something for us and may not use it for anything of their own, which is not the same as giving your details to another body to keep.

The Alumni Portal’s database is hosted in Singapore, so the membership records themselves stay in the country. What leaves is the site analytics, which are held in the United States and are counts rather than a record of a person. Where personal data does leave Singapore, the Personal Data Protection Act requires us to make sure it stays protected to a comparable standard, and we rely on the data protection terms in each provider’s contract to do that.

If you want to know which companies these are, ask us at info@ckscaasg.org and we will tell you.

We will also disclose personal data where the law requires us to.

9How we protect it

• The portal is invitation-only. An address has to be on our allowlist before it can sign in at all, and anyone else is turned away at the door even after Google has let them through. Signing in uses your Google account, so we never handle a password of yours and there is none of ours for anyone to steal.
• The database enforces who sees what. Permission is not a matter of hiding a menu item. Every table has row-level security, so the database itself refuses to return rows to someone who should not have them, even if a bug in our code asks for them.
• The alumni roster is restricted inside the portal. Only committee members with the director role can read it there — an ordinary member signing in cannot see other members’ contact details.
• Administrative functions are restricted to authorised committee members. Granting someone access to the portal, reading the association’s reports and changing what appears on the portal’s home screen are all limited to that same director role, which is given deliberately and one address at a time. A member who is not authorised is not shown these pages and cannot reach them by guessing a web address.
• Working copies exist outside it, and we would rather say so. Committee members sometimes take part of the roster into a spreadsheet to work from. Those copies sit in the association’s own accounts, but the protections above are built into the portal and do not follow a file out of it — so we keep such copies to what a task actually needs. They are not shared outside the committee.
• We do not keep your network address. The idea form is rate-limited to stop it being flooded. What we store to do that is a one-way code derived from your address, never the address itself, so the record cannot be turned back into you — and it is deleted within a week.
• Traffic is encrypted between your browser and our sites, on every page.

No system is perfect, and we will not claim otherwise. If we ever discover a breach that puts you at risk of significant harm, we will notify you and the Personal Data Protection Commission, as the law requires.

10How long we keep it

We do not keep personal data once the reason we collected it has passed.

Membership records

For as long as the association exists. Alumni status does not lapse, so we treat the roster as a lasting record of the community rather than something that expires — a member who moves away or stops attending is still an alumnus. You can ask us to remove you at any time, and we will.

Emails, ideas and anything else you send us

While it is still useful for the reason you sent it. We clear out what is plainly finished with; we do not run a stopwatch on your correspondence.

Anti-spam fingerprints

Seven days. This is a one-way code derived from a network address, never the address itself, and it exists only to stop the same browser flooding the idea form.

11Your rights

Under the Personal Data Protection Act you can ask us to:

• Tell you what we hold about you, and how we have used it in the past year.
• Correct anything that is wrong. A misspelled name or an old email address — write to us and we will fix it.
• Stop using it, by withdrawing your consent.

Write to info@ckscaasg.org. We will respond within 30 days, and if something will take longer than that we will tell you when to expect it. There is no charge for a correction. In the rare case where an access request takes substantial work, we may charge a reasonable fee, and we will tell you what it is before doing anything.

12Changes to this policy

When we change this policy we will change the date at the top of this page. If a change materially affects how we use data we already hold — a new purpose, a new company with access — we will tell members directly rather than relying on you to re-read this page.

13If you are not satisfied

Please write to our Data Protection Officer at info@ckscaasg.org first. We would rather hear about it and put it right. If we have not resolved it, you can bring a complaint to Singapore’s Personal Data Protection Commission at pdpc.gov.sg.