Organisation	Quillmarrow Supplies Pte. Ltd. (fictional)
Document	B4 · Privacy notices
Version	1.0
Date	30 October 2026 (illustrative)
Prepared by	Alex Lew, reviewer and sign-off
Client approver (role)	Head of Operations (DPO)
Label	Fictional organisation, illustrative only, not a client case study

1. How these notices were tailored

These drafts address two collection points with different audiences and purposes.

Notice A is for a customer deciding whether to place an order. It explains the information needed to process and deliver that order, the role of the payment provider, and the separate choice about marketing. It also highlights Malaysia deliveries at the point where a customer provides delivery details.

Notice B is for a person applying for a job. It focuses on the application information needed for assessment, who will review it and what happens if the applicant withdraws.

Both use a layered approach: the short notice appears at the collection point, with a link to the full website privacy policy for further detail. The policy URL and the retention information linked from it must be confirmed before publication. Quillmarrow’s lawyer should review both notices and the full policy, and process owners should check that the wording matches actual practices.

The notices are drafts. In particular, the statement about not requesting NRIC at application stage is a proposed practice to confirm, not an established finding. Overseas-transfer wording must be checked against the safeguards Quillmarrow actually adopts; the reported DV-01 contract has a confidentiality clause but no data-protection clauses.

2. Notice A: web-shop checkout (shown at the checkout step, with a link to the full policy)

Your information when you place an order

Quillmarrow Supplies Pte. Ltd. collects information you provide at checkout, including your name, delivery address, mobile number, email address and order details.

We use this information to process your order, arrange delivery, handle returns and warranty enquiries, and provide customer service. We may contact you about your order or a related enquiry using the details you give us.

Our payment provider, Fictional PayGate, handles your card details. We do not see your full card number. We receive payment information such as a payment token and payment status so that we can manage your order.

Who we share information with

We share the information needed for these purposes with service providers, which may include:

• Our web-shop and payment providers.
• Delivery and fulfilment partners.
• Customer service and technology support providers.
• Other service providers involved in processing, accounting for or supporting your order.

For deliveries in Malaysia, our fulfilment partner, Tanjung Contoh Logistics Sdn. Bhd., receives the order and delivery information it needs to pick, pack and deliver your order. This involves sending that information to Malaysia.

When we transfer personal data overseas, we assess the arrangements and seek appropriate safeguards. The safeguards applicable to this transfer are being reviewed; Quillmarrow must confirm and implement them before relying on this wording.

Marketing is your choice

You can place an order without agreeing to receive marketing emails. If you would like to receive them, select the optional box below. The box should appear unticked when the checkout page first opens.

☐ I would like to receive marketing emails from Quillmarrow about its products, offers and updates.

You can withdraw your marketing consent later by using the unsubscribe option in a marketing email or contacting our DPO. Withdrawing marketing consent does not stop us from contacting you about an order, return or customer service enquiry.

Retention and your choices

We keep your information for the period needed for the purposes described above and other applicable requirements, according to our retention approach. For more detail, see [link to the full privacy policy and retention approach — URL to be confirmed].

You may contact us to withdraw marketing consent or request access to, or correction of, your personal data. We may need to verify your identity and ask for information that helps us locate the relevant records. Our full privacy policy explains how we handle requests.

To contact our Data Protection Officer, email dpo@quillmarrow.example.

Last updated: 30 October 2026.

Publication check for Notice A

Before this notice is displayed, the Head of Customer Service and IT Manager should confirm that the named provider roles, checkout fields and payment description match the live process. The Head of Marketing should confirm that the marketing box is unticked, optional and separate from placing an order, and that the unsubscribe route works.

The DPO should confirm the full policy link, retention wording and overseas-transfer safeguards with the relevant owners and a Singapore-qualified lawyer. The general safeguards sentence must not be treated as evidence that appropriate safeguards are already in place. If the arrangements are not ready, the DPO should resolve the wording and transfer decision before publication.

3. Notice B: job-application form (short)

Information for job applicants

Quillmarrow Supplies Pte. Ltd. collects the information you provide when you apply for a role, such as your contact details, CV, employment history, qualifications and answers relevant to your application.

We use this information to assess your application, contact you about the role and manage the recruitment process. The HR Manager and the hiring manager for the role may see your application information for these purposes.

We do not ask for your NRIC at the application stage.

If your application is unsuccessful, we retain it according to Quillmarrow’s retention decision for unsuccessful applications. You can find further information in our [full privacy policy — URL to be confirmed].

If you wish to withdraw your application, contact the HR Manager through the application channel or email our Data Protection Officer at dpo@quillmarrow.example. We will explain any information we need to retain and why. You may also contact the DPO to request access to or correction of your personal data.

Last updated: 30 October 2026.

Publication check for Notice B

The HR Manager must confirm that the application form and recruitment process do not request NRIC at the application stage before publishing that sentence. If the current process does ask for it, revise the process or the draft after review; do not publish a statement that does not match practice.

The HR Manager and DPO should also confirm who can see applications, the withdrawal route and Quillmarrow’s decision for RS-11. The retention decision is not yet established by this notice. Legal questions and the final wording should be reviewed by a Singapore-qualified lawyer.

4. Placement and display

Notice	Where shown	Format	Owner role	Review trigger
A: web-shop checkout	At checkout, before the customer submits the order and alongside the optional marketing choice	Short, readable notice with a working link to the full policy; separate, unticked marketing checkbox	Head of Customer Service; Head of Marketing for the marketing choice; IT Manager for implementation	Change to checkout fields, purposes, providers, delivery locations, marketing process, retention decision or full policy
B: job-application form	On the application form, before the applicant submits information	Short notice with a working link to the full policy and a clear DPO contact	HR Manager	Change to application fields, reviewers, recruitment process, withdrawal route, RS-11 decision or full policy

The DPO should coordinate a review at least annually and when a trigger occurs. Owners should retain the approved wording and evidence of where it is displayed, such as a masked screenshot. The IT Manager should check that links work on the relevant form and that the notice is readable before submission.

The DPO’s business contact, dpo@quillmarrow.example, is to be published on the website. Publication should be checked and evidenced under G-01 rather than assumed from inclusion in these drafts.

5. What changed from the 2019 statement

Compared with relying on the generic website statement from 2019, these drafts propose:

• Collection-point wording: a checkout notice for customers and a separate, shorter notice for applicants.
• Specific purposes: order processing, delivery, returns and customer service at checkout; assessment of the application for applicants.
• A separate marketing choice: an optional, unticked checkbox rather than combining marketing with an order.
• Clearer recipients: categories of service providers for orders and the HR Manager and hiring manager for applications.
• A Malaysia delivery explanation: the proposed checkout notice identifies the fulfilment partner and overseas transfer, subject to confirmation of safeguards.
• Practical contact and choices: the DPO contact and routes for marketing withdrawal, access and correction; the applicant notice also addresses withdrawal of an application.
• Retention signposting: links to a full policy and retention approach, with the underlying decisions still to be confirmed.

These are proposed improvements, not a line-by-line comparison with the 2019 statement, whose full text was not supplied. CCTV signage text and the showroom sign-up notice remain follow-up actions in B2; they are not drafted here.