Effective Date: 1 October 2026
Last Updated: 1 October 2026
This Data Protection & Privacy Policy (“Policy”) governs the collection, use, disclosure, storage, transfer, and processing of personal data by Carnival World SG Pte. Ltd. (UEN: 201725634R) (“Carnival World”, “Company”, “we”, “us”, or “our”) in strict accordance with the Singapore Personal Data Protection Act 2012 (No. 26 of 2012) (“PDPA”) and its subsidiary legislation, including the Personal Data Protection (Amendment) Act 2020.
By accessing carnivalworld.sg (“Website”), submitting quotation requests, communicating via electronic channels (including WhatsApp, telephone, and electronic mail), or entering into commercial equipment rental, talent booking, and event management agreements with us, you acknowledge that you have read, understood, and agreed to the terms set out in this Policy.
1. Scope and Definitive Interpretation
This Policy applies to all personal data under our custody or control, whether collected directly from corporate planners, private consumers, procurement officers, venue managers, event attendees, or via third-party event management intermediaries. Under the PDPA, “personal data” refers to data, whether true or not, about an individual who can be identified from that data, or from that data and other information to which an organisation has or is likely to have access.
2. Categories of Personal Data Collected
In the course of providing commercial event equipment rentals, carnival game booths, arcade machines, bouncy castles, live food stations, and turnkey event coordination, we collect the following classes of personal data:
- Identity & Corporate Credentials: Full legal name, business title, designation, company name, Unique Entity Number (UEN), and official authorization records for corporate procurement.
- Direct Contact Coordinates: Corporate and personal email addresses, office landlines, mobile numbers, and instant messaging handles (including WhatsApp and Telegram).
- Billing, Tax & Settlement Data: Corporate billing addresses, bank account numbers, PayNow corporate identifiers, purchase orders (PO), credit verification details, and statutory electronic invoicing data under Vendors@Gov and GeBIZ.
- Event Spatial & Venue Logistics: On-site delivery addresses, event dates, loading bay delivery schedules, venue management contacts, Management Corporation Strata Title (MCST) clearance documentation, and authorized on-site recipient details.
- Security, Media & Visual Records: Photographic, video, and audio recordings captured by our team during live event activations, equipment setups, or public exhibitions; security CCTV footage captured at our warehouse premises; and vehicle license plate numbers required for loading bay access passes.
- Technical & Telemetry Data: IP addresses, browser types, device identifiers, operating systems, referring URLs, and website engagement analytics gathered via server logs, Google Analytics, and on-site tracking cookies.
3. Lawful Bases and Purposes of Collection, Use, and Disclosure
Carnival World processes personal data based on express consent, statutory exceptions under the PDPA (including Deemed Consent by Conduct, Deemed Consent by Notice, and the Legitimate Interests Exception), and contractual necessity for the following operational and commercial purposes:
A. Contractual Fulfillment & Operational Logistics
- Evaluating, generating, and issuing commercial quotations and hire contracts.
- Allocating, testing, and staging equipment inventory at our warehouse facility.
- Scheduling and dispatching our Logistics & On-Site Setup Crew, along with contracted third-party transport operators, for site delivery, heavy machine positioning, safety anchoring, facilitation, and teardown.
- Conducting site surveys, ceiling height clearances, and Singapore standard 230V 13A electrical socket distribution audits.
- Drafting, certifying, and submitting site-specific Risk Assessment and Management Strategy (RAMS) documents, method statements, and Singapore Civil Defence Force (SCDF) fire egress clearances.
B. Enterprise Procurement, Government Invoicing & Credit Control
- Administering public sector transactions via Vendors@Gov and GeBIZ.
- Issuing GST-compliant tax invoices, processing digital receipts, verifying electronic funds transfers, and managing corporate credit terms.
- Conducting commercial credit evaluations and engaging professional debt recovery agencies or legal counsel in the event of default on rental fees.
C. Marketing, Audience Insights & Legitimate Business Interests
- Retaining corporate transaction history to recommend seasonal promotions, recurring corporate family day packages, and customized event solutions.
- Conducting digital retargeting and aggregated audience analysis across search engines and advertising platforms (Google Ads, Meta Ads).
- Showcasing crowd engagement case studies and equipment setups on our Website, marketing decks, and commercial portfolios (using crowd-level event photographs or videography where individuals are incidental to the overall event capture).
- Internal operational analytics, crew training, risk auditing, and system cybersecurity monitoring.
4. Deemed Consent by Notice and Legitimate Interests
To the maximum extent permitted under Section 15A and the Second Schedule of the PDPA:
- Deemed Consent by Notice: Where we notify you of our intent to collect, use, or disclose personal data for a specified purpose via written contracts, official quotations, electronic invoices, or our Website, and you do not submit a formal opt-out notice within the stated period, you shall be deemed to have consented to such processing.
- Legitimate Interests Exception: We reserve the statutory right to collect, use, or disclose personal data without consent where necessary for the legitimate interests of Carnival World or another organization (such as enterprise security, fraud prevention, public safety, debt recovery, or corporate defense), provided our legitimate interests outweigh any potential adverse effect on the individual.
5. Disclosure of Personal Data to Third Parties
Carnival World does not sell, rent, or trade personal data to consumer marketing brokers. We disclose personal data strictly on a need-to-know basis to the following recipients:
- Contracted Third-Party Transport & Freight Haulers: External logistics firms, vehicle drivers, and freight transport contractors engaged to collect, transport, and deliver event equipment between our warehouse and the client’s venue.
- Logistics & On-Site Setup Crew: Field supervisors, equipment operators, and certified Game Masters executing installation, safety supervision, and post-event teardown.
- Specialized Subcontracted Talents: Freelance event entertainers (such as professional emcees, roving magicians, caricature artists, balloon sculptors) booked specifically to fulfill your service scope.
- Venue Management & Security: Building management (MCST), condominium security, hotel banquet operations, and convention center logistics desks (e.g., Suntec Singapore, Marina Bay Sands, Singapore EXPO) to secure loading bay vehicle permits and security clearances.
- Government Authorities & Statutory Boards: Relevant agencies (including the Singapore Police Force, Singapore Civil Defence Force, Singapore Food Agency, and Inland Revenue Authority of Singapore) where legally mandated or required to secure event permits.
- Professional Advisors: bizSAFE Level 3 auditors, certified public accountants, legal counsel, commercial insurance underwriters, and corporate banking partners.
- Business Asset Successors: Any prospective or actual buyer, assignee, or partner in connection with a merger, sale, acquisition, or restructuring of Carnival World SG Pte. Ltd.
6. Cross-Border Data Transfers
Our core business operations are conducted and hosted within Singapore. However, we utilize enterprise cloud infrastructure, web hosting networks, and software-as-a-service (SaaS) providers whose data centers or personnel may be located overseas.
In all such transfers, we ensure that the overseas recipient provides a standard of protection to personal data comparable to that required under the Singapore PDPA, in compliance with the Personal Data Protection Regulations 2021.
7. Administrative, Technical, and Physical Security Safeguards
As a bizSAFE Level 3 certified company, Carnival World maintains comprehensive security safeguards to prevent unauthorized access, collection, use, copying, alteration, or disclosure of personal data:
- Network & Transmission Security: Web traffic across carnivalworld.sg is protected via modern Transport Layer Security (TLS/HTTPS). Server endpoints utilize perimeter firewalls, automated malware scanners, and administrative IP filtering.
- Role-Based Access Governance: Access to customer records, quotation data, and accounting ledgers is restricted strictly to authorized operational and administrative personnel.
- Physical Facility Security: Hardcopy files, contracts, and internal computer systems maintained at our registered office and warehouse are secured within access-controlled premises under active CCTV surveillance.
Notice of Web Risk: While we implement rigorous safeguards, no electronic internet transmission or cloud database storage is entirely invulnerable. We disclaim liability for security breaches arising from factors beyond our reasonable operational control, including third-party internet outages or malicious cyber warfare targeting public telecommunications infrastructure.
8. Mandatory Data Breach Notification Protocols
In compliance with Part 6A of the PDPA, in the event of a suspected data security incident involving personal data under our custody:
- Our compliance team will conduct an immediate assessment to determine whether the incident constitutes a Notifiable Data Breach (resulting in, or likely to result in, significant harm to individuals, or affecting 500 or more individuals).
- Where required by law, Carnival World will formally notify the Personal Data Protection Commission (PDPC) within 72 hours of making that determination.
- Where mandated under the PDPA, we will concurrently notify affected clients and individuals with remediation measures and protective guidance.
9. Data Retention and Disposal Standards
We retain personal data only for as long as necessary to fulfill the commercial, operational, or legal purposes for which it was gathered, or as required by applicable laws in Singapore.
Financial, tax, and contractual records associated with commercial rental bookings are retained for a minimum statutory period of five (5) years in compliance with the Singapore Companies Act and Inland Revenue Authority of Singapore (IRAS) requirements. Once retention is no longer legally or operationally required, data is securely scrubbed, purged from cloud storage, or anonymized for statistical analysis.
10. Cookie Governance and Telemetry Tracking
Our Website employs essential, functional, analytics, and marketing cookies. You may manage your consent preferences at any time using our on-site Cookie Preferences Panel.
- Essential & Security Cookies: Required for server load balancing, security firewall verification (e.g., Wordfence/Cloudflare), and core navigation. These cannot be disabled.
- Analytical & Performance Cookies: Gather anonymous aggregate traffic patterns, visitor origin metrics, and page bounce rates to optimize catalog performance.
- Marketing & Retargeting Cookies: Measure advertising effectiveness and deliver relevant corporate equipment solutions across partner networks.
Declining optional cookies will not block basic site access, but may affect interactive features such as real-time quotation auto-fill and dynamic catalog search functions.
11. Individual Rights Under the PDPA (Access, Correction & Withdrawal)
Subject to the statutory conditions, exceptions, and exemptions under the PDPA, you possess the following rights regarding personal data held by us:
A. Right to Request Access
You may request a formal record of your personal data currently in our possession, along with an account of the ways in which that data has been used or disclosed within the twelve (12) months preceding the request. We reserve the right to charge a reasonable administrative fee to recover search and processing costs.
B. Right to Request Correction
You may request the correction of an error or omission in your personal data. We will update our databases as soon as practicable, unless statutory PDPA exceptions justify withholding the change.
C. Right to Withdraw Consent
You may withdraw your consent for the collection, use, or disclosure of personal data by providing written notice to our Data Protection Officer. Upon receipt of such notice, we will explain the operational consequences of withdrawal.
Notice of Cancellation: If you withdraw operational consent (such as delivery contact numbers or venue access authorizations) while a confirmed event hire contract is pending, the withdrawal shall be treated as an operational cancellation by the client, subject to our standard commercial cancellation terms.
12. Data Protection Officer (DPO) Contact Details
For formal inquiries regarding our data handling practices, statutory access/correction requests, or policy feedback, please contact our appointed Data Protection Officer in writing:
| Data Protection Officer: | Data Protection Office / Compliance Directorate |
| Entity Name: | Carnival World SG Pte. Ltd. |
| Company Registration (UEN): | 201725634R |
| Registered Office & Warehouse: | 10 Admiralty Street, #05-40 North Link Building, Singapore 757695 |
| Direct Telephone Line: | +65 6612 6450 |
| Official Corporate WhatsApp: | +65 9181 8242 |
| Official Inquiries Email: | hello@carnivalworld.sg |
13. Governing Law and Dispute Jurisdiction
This Policy, together with any disputes or legal claims arising out of or related to our website or commercial services, shall be governed exclusively by, and construed in accordance with, the laws of the Republic of Singapore. Any legal proceeding arising under this Policy shall be submitted exclusively to the jurisdiction of the competent courts of the Republic of Singapore.
14. Modifications to This Policy
Carnival World reserves the right to amend, update, or revise this Policy at any time without prior individual notice to reflect changes in our operational procedures, digital infrastructure, or PDPC statutory guidelines. All amendments will be published directly on this page with an updated “Last Updated” timestamp. Your continued use of our Website or services constitutes conclusive acceptance of the revised Policy.