1. When Quillmarrow relies on consent, deemed consent or an exception

These procedures help staff identify and record the basis for collecting, using or disclosing personal data, and respond when a person withdraws consent. A privacy notice explains what Quillmarrow does; it does not by itself establish consent.

The table is a starting point for review, not a legal determination. This document is practical operating support and is not legal advice. The DPO should confirm the applicable basis and any exception with a Singapore-qualified lawyer before a process is approved.

The Head of Operations is Quillmarrow’s appointed DPO. Refer uncertain cases to the DPO at dpo@quillmarrow.example. The B3 inventory identifies the relevant data, including marketing records PD-08, showroom sign-ups PD-09 and telemarketing prospects PD-10.

2. Obtaining consent

Before asking for consent, identify the activity, the information needed, the purpose and any recipients. Give the person a clear notice at the collection point and a way to contact the DPO. Use the relevant approved B4 notice where it applies.

When seeking marketing consent:

1. Make the choice separate from terms of sale, account creation and other purposes.
2. Use an unticked box or another clear affirmative choice. Silence, an unattended box or a pre-ticked box must not be recorded as a positive choice.
3. State the purpose and channel in plain language. Do not use a general statement that permits unspecified future marketing.
4. Explain how the person can withdraw and ensure the chosen withdrawal route works.
5. Capture the wording and choice in the consent record described below.

Use this wording for the optional marketing email checkbox:

☐ I would like to receive marketing emails from Quillmarrow about its products, offers and updates.

This is the same proposed wording as the B4 web-shop notice. The Head of Marketing should confirm that the actual messages match it; a new channel or materially different purpose requires DPO review before use.

For G-02, the Head of Marketing and Sales Manager should arrange for the B2B account form’s pre-ticked marketing box to be replaced with a separate unticked choice. Proposed target: 13 November 2026, matching G-02 in the B2 tracker. Retain an approved copy of the revised form and a masked screenshot or test record showing the choice and its capture. Track the change in B2.

For existing showroom sign-ups, the absence of records is an evidence gap. The Head of Marketing should identify affected records and agree the next step with the DPO and a Singapore-qualified lawyer before relying on them for marketing. Do not backdate or reconstruct consent as fact.

3. Recording consent

Keep the record in the approved location with access limited to staff who need it. The record should allow Quillmarrow to identify what choice was made and what wording was presented, without storing unnecessary information.

Also record the outcome of the choice, any processing status and the owner responsible for action. An unchecked box is not a positive consent record. Correct errors with an audit trail rather than overwriting the original evidence.

Keep marketing and consent records under RS-07 once Quillmarrow has confirmed the retention decision in B8. Until then, the Head of Marketing and DPO should document the interim handling decision and seek legal advice where needed.

4. Withdrawal flow

The timings below are Quillmarrow’s own internal service targets, chosen by management. They are not legal deadlines and are not quoted to customers. The DPO should confirm with a lawyer that they are reasonable before approval.

1. Receive and log. Any staff member who receives a withdrawal must forward it promptly to the Head of Marketing and DPO. Record the date, channel, person reference, stated choice and recipient. Acknowledge within three working days as an organisation target.

2. Identify the request. Confirm the person’s identity proportionately and identify the channel and purpose they want to stop. Ask a focused question if the request is unclear; do not ask for unnecessary identity documents. Record the answer without delaying action on any part already clear.

3. Explain likely consequences. Tell the person what will stop and, where relevant, what may continue. For example, withdrawing marketing email consent means Quillmarrow will stop that marketing; order, delivery or service messages may still be needed for an existing transaction. If withdrawal may affect a requested service, explain the likely effect and refer uncertainty to the DPO. Do not discourage the person from withdrawing, and do not imply that every use must stop before the DPO has assessed it.

4. Suppress and stop. Update the approved preference and suppression records and remove the person from relevant marketing selections. The target is to stop the relevant marketing within 10 working days of receipt. Act sooner where practicable; escalate immediately if a campaign is scheduled before the update can take effect.

5. Inform providers. The Head of Marketing must send the necessary instruction through the approved route to Fictional MailBurst and any other provider handling the affected marketing. Share only the information needed to implement the choice. Obtain and retain confirmation, or record that confirmation remains outstanding.

6. Confirm and check. Tell the person when the preference has been updated. Check that the suppression is reflected in the relevant list and provider system. Record completion, evidence and any delay; inform the DPO if the target may be missed.

7. Keep a limited suppression record. Retain the minimum information needed to respect the choice and avoid re-adding the person, subject to the confirmed RS-07 decision. Do not use the suppression record as a marketing list.

If a request also asks for access, correction or deletion, forward that part to the DPO and use the appropriate B7 process. Do not close it merely because the marketing preference was updated.

5. Staff scripts

Phone

“Thank you for letting us know. I’ll record that you no longer want to receive marketing emails and pass your request to our marketing team. We will stop them as soon as we can and confirm when it is done. Messages about an existing order may still be sent. You can contact our DPO at dpo@quillmarrow.example.”

Email reply

“Thank you for your request. We have recorded your wish to stop receiving Quillmarrow marketing emails. We will update the relevant lists as soon as we can. We will confirm when the update is complete. If you meant a different channel or purpose, please let us know. You may also contact our DPO at dpo@quillmarrow.example.”

Showroom counter

“Would you like to receive marketing emails about Quillmarrow’s products, offers and updates? It is optional, and you do not need to agree to use the showroom. Please leave the box unticked if you do not want them. You can withdraw later by contacting our DPO at dpo@quillmarrow.example.”

6. Owner roles, records kept and checks

The Head of Marketing owns marketing choices, list updates, provider instructions and evidence of withdrawals. The Sales Manager owns the B2B form change; the Showroom Supervisor owns the use of approved showroom sign-up materials. The IT Manager supports system configuration and evidence capture.

The DPO maintains oversight and performs a monthly sample check of new consent and withdrawal records. The check should compare the recorded choice with the wording and evidence, verify that withdrawals reached the relevant lists and providers, and identify overdue or missing actions. Record the sample, findings, owner and target date in B2. Do not describe a control as working until its operation has been checked.

By 31 December 2026, the Head of Marketing should provide the DPO with the revised form evidence, a record format, a withdrawal test and the outcome of the first proposed sample check. Missing evidence and unresolved decisions remain open under G-02.