Privacy Policy

Reviewed by The Right Workshop team.

Last updated: 14 April 2026

The Right Workshop Pte Ltd (“we“, “us“, “our“) takes your privacy seriously. This Privacy Policy explains how we collect, use, disclose and protect your personal data in accordance with the Personal Data Protection Act 2012 (PDPA) of Singapore.

By providing us with your personal data, you consent to the collection, use and disclosure of your data as described in this Policy.

1. Our Data Protection Officer

We have designated a Data Protection Officer (DPO) responsible for overseeing our PDPA compliance:

2. Personal Data We Collect

We may collect the following categories of personal data:

  1. Identity and contact details: name, phone number, email address, NRIC / FIN (only where legally required, e.g. insurance claims), postal address.
  2. Vehicle information: registration number, make, model, year, engine number, VIN, mileage, service history, previous repairs, accident records.
  3. Transaction data: invoices, receipts, payment method details (we do not store full credit card numbers; our payment provider handles these), PayNow references.
  4. Service records: work performed, parts used, photos of damage and repairs, condition reports, warranty records.
  5. Communication records: WhatsApp messages, SMS, email, phone call notes, customer feedback.
  6. Insurance information: policy numbers, insurer details, claim references (where we handle accident claims on your behalf).
  7. Website usage data: IP address, browser type, device type, pages visited, time on site, referring URL (via Google Analytics and similar tools).
  8. Marketing preferences: consent status for WhatsApp, SMS and email marketing.

3. How We Collect Your Data

We collect personal data when you:

4. Purposes of Collection and Use

We use your personal data only for the following purposes:

  1. Service delivery: to inspect, diagnose, service, repair and maintain your Vehicle; to contact you about your booking, service progress, additional work approvals, and collection.
  2. Invoicing and payment: to issue invoices, process payments, follow up on outstanding amounts, and comply with accounting and tax requirements.
  3. Warranty and service records: to maintain a history of work performed for warranty claims, future reference, and compliance with regulatory or insurance requirements.
  4. Insurance liaison: to communicate with your insurer for accident claims, with your consent.
  5. Customer service: to respond to enquiries, handle complaints, and improve our services.
  6. Appointment reminders: to send service-due reminders and upcoming appointment notifications by SMS or WhatsApp.
  7. Marketing (with consent): to send occasional promotional messages about services, tips or offers, where you have opted in.
  8. Legal and regulatory compliance: to meet obligations under Singapore law (including LTA, IRAS, PDPA, CPFTA and CCCS).
  9. Website improvement: to analyse traffic patterns, improve content and user experience.

5. Disclosure of Your Data

We do not sell your personal data. We may share it only with:

  1. Insurance companies and their surveyors, when you authorise us to handle an accident claim on your behalf.
  2. Parts suppliers and distributors, where specific parts need to be ordered and may require vehicle identification information.
  3. Service providers who process data on our behalf: Bookly Pro (booking system), WordPress.com hosting, Google Analytics, Google Calendar, Twilio (SMS), WhatsApp Business, Meta (Instagram), payment processors (Stripe, PayNow operators, banks).
  4. Professional advisers: accountants, auditors, lawyers, where necessary for the operation of our business.
  5. Government agencies: LTA, IRAS, police, courts or other authorities where required by law or valid legal process.
  6. Successors in interest: in the event of a merger, acquisition or sale of part of our business, your data may be transferred to the acquiring party, subject to confidentiality undertakings.

All third-party processors are required to handle your personal data in accordance with the PDPA and their own privacy obligations. Where your data is transferred overseas (for example, to service providers whose servers are outside Singapore), we take reasonable steps to ensure a comparable standard of protection.

6. Data Retention

We retain your personal data only for as long as necessary for the purposes described, or as required by law:

After these periods, records are securely deleted or anonymised.

7. Your Rights Under PDPA

You have the right to:

  1. Access the personal data we hold about you;
  2. Correction of any inaccurate or incomplete personal data;
  3. Withdraw consent for marketing communications at any time (reply STOP to SMS, unsubscribe link in emails, or message us directly);
  4. Request deletion of your personal data, subject to our legal retention obligations;
  5. Complain to the Personal Data Protection Commission (PDPC) of Singapore if you believe we have mishandled your data. Contact PDPC at www.pdpc.gov.sg.

To exercise any of these rights, please email our DPO at therightworkshoppteltd@gmail.com. We will respond within 30 days.

8. Data Security

We implement reasonable security arrangements to safeguard your personal data against unauthorised access, collection, use, disclosure, copying, modification, disposal or similar risks, including:

No system is completely secure. In the event of a data breach that is likely to result in significant harm to you, we will notify you and the PDPC within the timeframes required by PDPA (Data Breach Notification Obligation, effective 1 February 2021).

9. Cookies and Analytics

Our website uses cookies to improve your experience. Cookies are small text files stored on your device that help us:

You may disable cookies in your browser settings. Some features of our site may not function as intended without cookies.

We use Google Analytics to understand site traffic. Google may process your data in accordance with its own privacy policy. IP addresses are anonymised where possible.

10. Children’s Privacy

Our services are directed at car owners, who must be at least 18 years of age in Singapore. We do not knowingly collect personal data from individuals under 18. If you believe we have collected data from a minor, please contact our DPO so we can delete it.

11. International Transfers

Some of our service providers (including Google, Meta and Twilio) may process your personal data outside Singapore. Where personal data is transferred overseas, we rely on those providers’ contractual safeguards and our own reasonable steps to ensure the data is protected at a standard comparable to the PDPA.

12. Marketing Consent and Opt-Out

  1. We only send marketing messages to customers who have explicitly opted in (ticked a consent box or messaged us to subscribe).
  2. You can opt out at any time by replying STOP to any SMS, clicking “unsubscribe” in any email, or contacting our DPO.
  3. Opt-out takes effect within 14 days (PDPA Do Not Call requirement). Service-related messages (appointment reminders, quotation approvals) are not marketing messages and will continue so long as you are a customer.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or the law. The latest version will always be available on this page with the “Last updated” date at the top. Significant changes will be notified to active customers by email or WhatsApp.

14. Contact Us

For any questions, concerns or requests relating to this Privacy Policy or your personal data:

This Privacy Policy was drafted on 14 April 2026 based on the PDPA, Do Not Call Registry rules, and Data Breach Notification Obligation in effect at that date. Not legal advice. Consult a qualified Singapore lawyer or PDPC for specific guidance. For PDPC queries: www.pdpc.gov.sg.