Privacy & personal data

Privacy Policy

Prepared 17 October 2026. This policy explains how Going Home handles personal data.

Who we are and how to contact us

Going Home is a rescued-cat interaction centre at 47A Temple Street, Singapore 058592. In this policy, “Going Home”, “we”, “us” and “our” mean UEN 53527365K, trading as Going Home. This policy covers goinghome.sg, our booking and enquiry services, and personal data we handle in connection with visits, programmes and adoption enquiries. Our Data Protection Officer (DPO) can be contacted at contact@goinghome.sg. Our existing general contact is contact@goinghome.sg. Please address privacy correspondence to “Data Protection Officer”. Do not send identification-document copies with an initial request. Policy version: GH-PRIVACY-20260928-1. Effective date: 17 October 2026. Separate notices may apply to employment, volunteering or other activities not described here.

The information we collect

Booking and visit information: the booking contact’s name and email; visit date, time, duration and party size; each visitor’s age in years and selected concession category; quoted prices; booking reference and status; attendance, arrival and extension records; and relevant service correspondence. Payment information: amount due and received, payment method, transaction references, your payment declaration, manual verification and refund records, and the payer information visible to authorised staff when checking our bank records. We do not ask for internet-banking passwords, PINs, one-time passwords or payment-card credentials. Consent and safety information: attendee names, minor/guardian details where applicable, the visitor-consent version and acceptance record, staff witnessing/check-in records, and necessary details of incidents or requests for assistance. Enquiry information: your name, email and message, the cat you enquire about, or your organisation and expected group size. Please do not include unnecessary medical information or other people’s private details.

Information collected by the website

The website and its hosting environment may record IP addresses, browser/device information, request times, pages requested, error/security events and session identifiers to deliver and protect the service. Application records also include staff actions, policy acknowledgements and notification-delivery history. Our booking form asks for ages in years, not dates of birth. Routine booking and concession checks do not require us to keep copies of identity documents. Staff should check eligibility at the venue and record the result rather than copy an NRIC, FIN, passport or student card. The website uses expiring signed booking links. Anyone who receives your link may be able to view or act on that booking. Keep it private and contact us if you believe it has been disclosed accidentally.

Where information comes from

We obtain information directly from you when you book, enquire, communicate with us or attend. We may also receive relevant information from an authorised group organiser or guardian, our bank when reconciling a transfer, or a rescue partner when coordinating an adoption enquiry you have requested. If you supply another person’s information, share this notice with them and obtain their authority, or confirm another lawful basis for doing so. An organiser’s permission is not automatically authority to consent to marketing, promotional photography or a waiver for every participant. We may ask for proportionate evidence of identity or authority when handling a privacy request. We will explain what is needed; possession of an NRIC number alone is not a suitable authentication method.

Why we use your information

We use relevant information to: • process enquiries, quotations and reservations; • check age and concession eligibility and calculate the correct price; • manage capacity, attendance, safe admission and consent records; • reconcile payments, issue confirmations and reminders, resolve unmatched or duplicate transfers, and administer authorised refunds; • deliver agreed visits, workshops or group arrangements and requested adoption introductions; • investigate incidents, complaints, fraud or misuse and maintain reliable operational records; • maintain and secure the website and diagnose service faults; • meet accounting, legal and regulatory responsibilities and establish or respond to claims. We explain additional purposes before using information for them, and obtain consent where needed. We do not use booking information for unrelated purposes simply because it was provided to us.

Consent and necessary service information

We seek consent where required and use any PDPA exception only where its conditions are actually met. For example, limited information may be handled where the law requires it or to respond to a qualifying emergency. We do not treat this policy as unrestricted permission to do anything with your data. Some information is necessary to reserve capacity, verify a payment or admit visitors safely. If you decline to provide that information, we may be unable to complete that particular service and will explain why. Optional marketing or promotional-photo consent is separate from necessary service information. Browsing the website, making a booking or entering the venue does not by itself authorise unrelated marketing or promotional use of your image.

Children, guardians and group organisers

Our ordinary visit rules do not permit children under 6. Children aged 6–12 must attend with a paying adult. These admission rules are not a determination of a child’s legal capacity to enter contracts or consent to every use of personal data. For children below 13, a parent or legally authorised guardian must provide the necessary consent for the child’s online personal-data collection. For older minors, we consider their understanding and the nature and risks of the processing. A school organiser or accompanying adult must not assume they hold parental authority. Please initially send group size and age ranges rather than full class lists, student IDs or health files. If participant details are later necessary, we will explain the fields, purpose and appropriate submission arrangements.

Visit recognition and optional marketing

The staff system can group completed, non-demo visits by the booking contact’s email, with name, visit count and last-visit date, and display an internal relationship-stage label. A shared email may therefore represent a household or group, not necessarily one individual. These labels are not a public profile, a credit score or a guarantee of a reward. It must not be used to infer consent to advertising or automatically determine eligibility for admission. The present booking journey does not enrol you in a marketing campaign. If optional marketing is introduced, we will give a separate choice and an effective withdrawal route. Marketing to Singapore telephone numbers must comply with the applicable Do Not Call rules. Booking confirmations, payment-status messages and essential service changes are not optional advertising merely because they are sent by email.

Who can receive information

Information is made available to authorised staff according to their responsibilities, such as front-desk operations, payment verification, responding to enquiries or handling a complaint. It is not intended for unrestricted staff browsing. Where needed for the stated purposes, information may be handled by hosting, maintenance, backup, email and communications providers; banks and payment-network participants; accountants, insurers and legal advisers; emergency responders; or authorities exercising lawful powers. We limit what is shared to what is relevant. We will identify an appropriate rescue partner and obtain the necessary authority before passing an adoption enquiry to that partner. Partners processing data for their own adoption decisions have their own responsibilities and privacy notices. We do not publish adopter or visitor stories with identifying details without appropriate permission. Our proposed policy is not to sell personal data or supply visitor lists for unrelated third-party advertising. Any new service provider or sharing arrangement must be checked before use.

Service providers and overseas access

A provider acting on our instructions must receive suitable confidentiality, security, incident-reporting and deletion/return instructions. Using a provider does not remove our responsibility for the data we control. If personal data is transferred or made accessible outside Singapore, we will first ensure the applicable PDPA transfer requirements are met, including comparable protection through appropriate enforceable arrangements or another permitted route. This can include remote support and overseas backups, not only the server’s physical location. We do not claim that all information stays in Singapore until that has been verified. Third-party social-media and messaging services also apply their own policies when you choose to use them.

Cookies, local storage and external links

The website uses session and security cookies to maintain your visit to the site and protect form submissions. Blocking them may prevent forms or bookings from working. The cat-animation setting is stored in your browser’s local storage so that your motion preference can be remembered; it is not a visitor advertising profile. You can clear cookies and local storage through your browser. No advertising pixel or third-party analytics tag was identified in the current public-page source reviewed for this draft. We will give appropriate information and obtain consent where required before introducing non-essential tracking. Links to Instagram, Facebook, TikTok or a bank’s service do not mean those services are operated by us. If you follow a link, their handling of your information is also governed by their own policies.

Photography, recordings and CCTV

A booking or safety acknowledgement is not a model release. If we wish to use identifiable visitor images, testimonials or stories for promotional purposes, we will explain the proposed use and request separate permission where required. Parent/guardian authority must be checked where relevant. Declining promotional photography does not by itself prevent an ordinary paid visit. Our premises at 47A Temple Street are monitored by CCTV. Notices are displayed at the entrance. Areas covered: the entrance lobby, cat room and staff areas. There are no cameras in the toilet. Why we use it: to keep visitors, staff and the cats safe to look into incidents, injuries and complaints to prevent and detect theft, damage or misconduct to watch the cats’ wellbeing when the centre is closed Video only: The cameras record video only. They don’t record sound. Storage and access: Recordings are stored on a secure recording device on our premises. Only authorised staff can view them. We don’t use the footage for marketing, and we don’t share it unless: we need to deal with an incident, for example with our insurer or legal advisers, or the law requires it, for example at the request of the police. Retention: We automatically delete recordings after [30] days. If footage is needed to deal with an incident, a complaint or a legal claim, we keep that part for as long as needed. Your footage: You can ask for a copy of footage of yourself under the PDPA. Email our Data Protection Officer at contact@goinghome.sg with the date, the approximate time and a description of yourself. To protect other people’s privacy, we may blur them or give you a still image instead. We may charge a reasonable fee for this. Visitors should avoid including other visitors or staff in photographs without permission. A request to remove our promotional publication will be assessed promptly, including limits on copies already lawfully printed or shared by independent third parties.

How long we retain information

We keep identifiable information only while it is needed for the purpose for which it was collected or for a legitimate legal or business requirement. Different records need different treatment; we do not apply an indefinite “keep everything” rule. Booking/payment records may need to be retained for accounting, reconciliation and disputes. Enquiries should be closed and reviewed when the correspondence has ended. Recognition records, consent/incident files, technical logs, optional media permissions and backups require separate retention rules. A legal hold or a pending access request may require relevant records to be preserved. When retention is no longer justified, records should be securely deleted or irreversibly anonymised, including managed expiry from backups. A withdrawal request is not always a requirement to erase financial or claim-related evidence immediately. Record-specific retention schedule: 2 weeks

Keeping information accurate and protected

Please tell us if your booking contact or other relevant details change. We take reasonable steps to keep information accurate for the uses made of it, especially where it affects a visitor or is shared with another organisation. We must maintain reasonable safeguards appropriate to the information and risks. These include restricting staff access, protecting administrative accounts, controlling private records and backups, maintaining the software, and handling exports and communications carefully. No website or transmission method is risk-free. This does not exclude our legal duties or your remedies. We will never ask for your banking password or one-time password to investigate a privacy or payment issue. Do not post payment screenshots, booking links or sensitive documents in public comments.

Withdrawing consent and raising an objection

You may contact the DPO to withdraw consent, identifying the relevant purpose or communication channel and allowing reasonable notice. We will explain any likely service consequences and cease the consent-based collection, use or disclosure covered by your withdrawal, unless another lawful basis permits or requires it. For example, withdrawal of permission to use essential booking details may prevent us from administering a future visit; withdrawal of optional marketing consent should not prevent an otherwise valid visit. Withdrawal does not undo processing that was lawful before the request or automatically cancel a booking or establish a refund entitlement. We will process requests without unnecessary delay. Where the Do Not Call withdrawal rules apply, relevant specified messages to your Singapore telephone number must cease within 21 days. Records needed to respect an opt-out may be retained for that limited purpose.

Access, correction and deletion requests

You may request access to personal data we possess or control about you and information about its use or disclosure during the preceding year. You may also request correction of an error or omission. Please identify the records or booking concerned and a way to contact you. We respond to access requests as soon as reasonably possible and make required corrections as soon as practicable. If we cannot comply within 30 days after receiving a request made in accordance with the applicable regulations, we will tell you in writing within that period when we will respond. We will preserve relevant data as required while a request is being addressed. We may need to verify identity/authority and protect other people’s information. Where an exception applies, we may redact or withhold affected material and will give an explanation where permitted. Required corrections will also be communicated to relevant recipients as the law requires. Any reasonable access fee will be explained in a written estimate first. We do not charge for making a correction. You may ask us to delete data no longer needed, but the PDPA does not provide an unconditional right to immediate deletion of every record. We will explain any continuing retention need.

Data incidents and privacy complaints

If we become aware of a suspected personal-data breach, we will contain and assess it, keep appropriate records and take required remedial steps. Where a breach is notifiable, we must notify the PDPC as soon as practicable and no later than three calendar days after the day we determine that it is notifiable. Where notification to affected individuals is required, it must occur as soon as practicable, at the same time as or after notification to the PDPC. These are not promises to delay until the deadline. Please send a privacy concern to the DPO with the relevant facts, but no unnecessary sensitive attachments. We will investigate and explain the outcome or next steps. You may also approach Singapore’s Personal Data Protection Commission through its official complaints/review channels; contacting us does not remove that right.

Updates to this policy

We will identify the effective date and version of an approved policy and make it available on the website. Where a change introduces a new use requiring notification or consent, we will provide that notice and obtain the necessary consent before applying it. Merely changing this page does not retrospectively authorise an unrelated use of your data.