This notice explains how Indofood (“we”, “us”) collects, uses and discloses your personal data in connection with the “Slurp for Huat” campaign. It forms part of, and should be read together with, the Terms & Conditions — where the two differ on how personal data is handled, this notice prevails.
We collect: your email address and Singapore mobile number; receipt images and the data read from them; device, browser and network information; and, for video entrants, a social media handle, video link and Singapore delivery address. If you win a prize, we additionally collect your full name as it appears on your identity document and the last four characters of your NRIC or FIN.
We do not collect your full NRIC or FIN number, retain copies of your identity documents, or collect any payment information.
We use your personal data to: administer your entries, the monthly lucky draws and the Monthly Goodie Bag Contest, including verifying receipts and preventing fraud; award and deliver prizes; and comply with our own record-keeping obligations for this promotion. Where you have given separate, optional consent, we also use your email and mobile number for marketing.
Administering your entries, running the draws, verifying receipts, preventing fraud, and awarding and delivering prizes are all necessary to run the Campaign you have entered, and are carried out on that basis. Retaining Campaign records for the periods described in clause 8 is necessary to comply with our obligations as a licensed trade promotion lottery under Singapore's Gambling Control Act 2022. Marketing messages are sent only where you have given your own separate, optional consent, and never as a condition of taking part.
We take reasonable steps to make sure the personal data we hold about you is accurate and complete, particularly where it could affect your eligibility for a prize. You are responsible for the accuracy of the information you give us — including your email address, mobile number, and, if you win, your identity and delivery details. You can ask us to correct inaccurate data at any time using the contact details in clause 10.
Consenting to marketing is optional and is never a condition of entering the Campaign. If you don't consent, you take part on exactly the same terms as someone who does. Messages about your own entries — sign-in links, verification outcomes, entry confirmations, prize notifications and claim reminders — are administrative, not marketing, and are sent regardless of your marketing preference.
Before we send any marketing message to a Singapore telephone number, we check that number against the Do Not Call Registry, unless we already hold your clear and unambiguous consent to be contacted that way, in which case we keep a record of that consent.
We share personal data with service providers who help us run the Campaign — hosting, image storage, automated verification, email and SMS delivery, prize fulfilment, and the independent scrutineer who oversees each draw. Each of them processes your data only on our instructions and under contract. Some of these providers process data outside Singapore; where that happens, we take steps to make sure they are bound by obligations comparable to Singapore's Personal Data Protection Act 2012 ("PDPA"). We also disclose personal data where required or permitted by law, to a regulator, or to the police in connection with suspected fraud.
As noted in clause 6, some of our service providers are based outside Singapore. We only transfer personal data to them on terms that place them under obligations to protect your data comparable to the PDPA's standards, regardless of where they're located.
We keep records of the Campaign — entries, receipt images, draw records and winners' records — for five (5) years, which is the record-keeping period that applies to this kind of promotion, and securely destroy or anonymise them afterwards, unless we need to keep something longer to deal with an unresolved claim, dispute or investigation. Any other personal data we hold is deleted or anonymised within 90 days of the Campaign ending.
You can ask to access or correct your personal data, or withdraw your consent for any purpose, at any time — see clause 10 for how to reach us. We aim to respond to an access or correction request within 30 days, or tell you when we will. If you withdraw consent that's necessary for us to administer your entry, we won't be able to keep administering it and it will be voided — but we'll still keep whatever records we're legally required to under clause 8, and we'll tell you which those are.
Verification of entries is partly automated. If your submission is rejected by an automated check, you can ask for it to be reviewed by a person once, within 7 days of the rejection. Any decision to disqualify a participant is made by a person, not a system.
If you're not satisfied with how we've handled your personal data, you can complain to the Personal Data Protection Commission.
You can reach our Data Protection Officer, for any request under this notice, at hello@mail.javasproduction.com.
We use reasonable technical and organisational measures to protect the personal data we hold from unauthorised access, loss, misuse or disclosure — including transmitting data over encrypted connections (HTTPS/TLS), and limiting access to personal data to the staff and service providers who need it to run the Campaign. We deliberately collect less sensitive data than we could — for example, we never collect your full NRIC/FIN or any payment information. No method of transmission or storage is completely secure, but we take these steps to reduce the risk.
If we become aware of a data breach affecting your personal data, we assess it promptly to work out whether it's likely to result in significant harm to you or is otherwise notifiable under the PDPA. Where it is, we will notify the Personal Data Protection Commission and affected participants as required by law, and take reasonable steps to contain the breach and reduce any harm.
We may update this notice from time to time — for example, if the Campaign changes or the law requires it. Any update is posted on this page with a revised date, and we will highlight any change that materially affects how we handle your personal data. A change to this notice does not reduce the protections that applied to personal data we collected before the change.