1. Definitions in Policy
1.1 “Company” shall mean:
- YY Group of companies inclusive of YYLife Pte Ltd, Hong Ye Group Pte Ltd, YY Circle (SG) Pte Ltd and 1st Station Pte Ltd; and
- Core business platforms inclusive of YY Circle, YY Business, Yolara and any other platform operated by the Company from time to time; and
- all other relevant subsidiaries, associates, affiliations business entity engaged with YY Group of companies; and
- the constituent of but not limited to directors, shareholders, members, employees, advisors, managers and legal representatives.
1.2 “Applications” shall mean all mobile applications owned or operated by the Company, whether existing now or introduced at any time in future, and available to Users (ascribed below) and Third Party Providers (ascribed below) for downloads and installations;
1.3 “Software” shall mean all software owned by the Company, that supports the Applications and Platforms (ascribed below), and available to Users (ascribed below) and Third Party Providers (ascribed below) for downloads and installations; and
1.4 “Platforms” shall mean all of the Company's technology platforms, digital portals and websites that are used in conjunction with its Applications and Software for the purpose of achieving seamless operations of the Company;
2. Introduction
The Company values the information you have provided to the Company or permitted the Company to collect. The Company strives to protect your privacy while providing you with the best service and experience the Company can give. All such personal information in the Company’s possession is collected, valued, used, disclosed and protected in accordance with the Singapore Personal Data Protection Act 2012 ("PDPA").
This Privacy and Data Protection Policy applies to all personal data submitted by you and is intended to apply to all personal data submitted by the Company via the Company’s Applications, Platforms and Software, and including any personal data that the Company receives from other third parties.
By visiting or using the Company’s Applications, Platforms and Software, you are deemed to agree to the terms and conditions of this Privacy and Data Protection Policy.
You are advised to review this Privacy and Data Protection Policy carefully prior to visiting or using Company’s Applications, Platforms and Software, or otherwise providing any personal data.
3. PDPA
In Singapore, Personal data is protected under the Personal Data Protection Act 2012 (PDPA).
The PDPA establishes a data protection law that constitutes various rules governing the collection, use, disclosure and handling of personal data. It acknowledges both the rights of individuals to protect their personal data, including rights of access and correction; and the requirements of organisations to collect, use or disclose personal data for legitimate and reasonable purposes.
In accordance to Advisory Guidelines on the Personal Data Protection Act (“PDPA”) for NRIC and Other National Identification Numbers (“NRIC Guidelines”), organisations are typically not allowed to collect, use or disclose an individual’s NRIC number (or copy of NRIC) from 1st of September 2019 unless:
- required under the laws in Singapore (or an exception under the PDPA applies); or
- necessary to accurately establish or verify the identity of the individual to a high degree of fidelity, where the failure to do so would pose a significant safety or security risk or significant impact or harm to an individual and/or organisation.
Personal Information and Other Relevant Data Collected
Personal data as defined in the PDPA refers to data whether genuine or not, about an individual who can be identified from either that particular data, or from that data and other information which the Company have or likely have access to. Personal data is collected where reasonably necessary for the Company's functions and activities. Personal data that the Company may hold include the following:
- name, address and contact details;
- date of birth;
- NRIC number, FIN number *;
- bank account details;
- details of services provided to an individual by the Company;
- details of an individual's dealings with the Company, including telephone records, email and online interactions;
- photos and video recordings;
- your image;
- voice recordings;
- location data; and
- other personal data as may be provided by an individual from time to time.
Some of the information that the Company collects is sensitive in nature. This includes information such as your NRIC or FIN number. The Company only collect this information when permitted by applicable laws and when this is necessary to verify your identity to a high degree of fidelity.
Collection of Personal Data
Wherever possible, the Company will collect personal data directly from you. Notwithstanding the above, the Company may also receive personal data about you from various third parties such as analytics providers, data aggregators, or other providers of technical and delivery services, and public sources.
In addition to the personal data you provide to the Company, certain information related to you that is not considered personal data under the PDPA may also be collected. The Company collect this information to improve the Company's Applications, Platforms and Software. Such non-personal data may include information such as the internet browser you use or the duration of use of the Company's Application, Platforms and Software. Lastly, any other purposes that the Company notify you at the point of obtaining your consent.
Collection of Face Data (Attendance and Identity Verification)
To ensure accurate attendance tracking, face recognition technology is used strictly for this purpose. The company provide face recognition machines to the clients, the data collected will solely be used to verify and confirm the identity of registered members reporting for work.
As a job portal platform, it is essential for the company to ensure that only verified and registered members are attending the assigned jobs. Face recognition helps build trust and accountability for the clients by confirming the right individuals are present at the work site.
The Company also verifies the identity of Workers in the Yolara app. A Worker submits a photo of an identity document together with a live selfie, and both files are uploaded directly to cloud storage operated by Microsoft Azure. The selfie and the document photo are then sent to the Alibaba Cloud identity-verification service in the Singapore region, which compares the two and returns a match result. The Company keeps that result, and the document itself, as evidence on the Worker's record.
Facial data collected through the Company's attendance terminals is stored on cloud servers located in Singapore. We may use additional cloud service providers as our operations expand, and will ensure any such providers meet equivalent security standards. Facial data is used only for the attendance verification and identity verification purposes described in this section. It is not used for any other purpose, and it is not used to populate any other Application or Platform operated by the Company.
The company are committed to safeguarding the privacy and security of all data collected and ensure it is used in accordance with relevant data protection laws.
Use of Cookies
Cookies are small files which require user permission in order to be installed on a computer’s hard drive. Cookies will only start to perform their functions after such permission is granted. By collecting and analysing data on the user’s browsing patterns, cookies allow web applications to respond to the user as an individual by tailoring a web application’s operations to the user’s specific needs and preferences. Permission for cookies is granted by default in most web browsers. You can however choose to disable this function in your browser’s settings. This may prevent you from taking full advantage of the Company’ Application, Platforms and Software.
The Company may use traffic log cookies to identify which pages are being used. This use is designed to assist the Company in gathering data on webpage traffic. The gathered data is used only for statistical purposes and is removed from the company’s database shortly after. Overall, the data collected by the cookies is used for the purpose of improving your browsing experience on the Company’ Application, Platforms and Software, to help the Company better understand how the website is performing, and to enable the website to function properly.
Cookies do not grant the Company access to your computer or any information about you outside of your browsing activity on the Company’s Applications and Platforms.
Age Limitations
The Company's services, Application, Platforms and Software are only intended for those aged 16 and above, and for those of sufficient legal age to perform the particular services concerned. A Worker must be at least 18 years old to take paid work through the Platform, and the Company checks the date of birth on record before it accepts payout details for a Worker. If a parent or guardian becomes aware that his or her child, who is below the applicable minimum age, has provided the Company with information without their consent, he or she should contact the Company's data protection officer, whose contact details are listed in section 13 below. The Company will delete such information from the Company's files within a reasonable timeframe.
Your Consent
By using the Company's services, Application, Platform and Software, you consent to the collections and use of your personal information and data in the ways herein (subjected to change from time to time as supported by section 10); unless and until you inform the Company on the withdrawal of your consent.
Your consent will also include the exchange of your personal information between the Company's internal stakeholders, external parties or individuals, to prove the authenticity of your declared status, and the sharing of your profile, credentials, qualifications and engagement history between the Company's Applications and Platforms, including any Application or Platform launched by the Company after the date of this Policy, so that opportunities may be offered to you across the Company's platforms without the need for you to register again.
The sharing described above between the Company’s Applications and Platforms, including between YY Circle and Yolara, applies by default. If you do not wish your profile, credentials, qualifications or engagement history to be shared between the Company’s Applications and Platforms, you may opt out at any time and at no charge by writing to the Company’s data protection officer at the contact details set out in section 13. An opt-out takes effect within thirty (30) days of receipt and does not affect sharing that took place before it takes effect, and the Company will inform you if the consequence of your opt-out is that a particular Application, Platform or service can no longer be provided to you. For the avoidance of doubt, your NRIC or FIN number, your bank account details and your remuneration information are not shared between Applications and Platforms under this paragraph, and facial data is never shared between Applications and Platforms under this paragraph. Facial data is disclosed only to the cloud storage and identity-verification providers described in section 6, as set out under Collection of Face Data in section 3.
4. Use of Your Personal Data
The Company collect personal data for various purposes. Without limitation, these purposes include:
- to register as a user on the Company’ Application and Platforms
- to verify your identity;
- to assess and/or verify your employability;
- to deliver the services which you have requested, including but not limited to the services provided by the Applications and Platforms;
- to enable the Company to manage and administer the services which you have requested, including but not limited to the services provided by the Company’ Application, Platforms and Software;
- to send you service updates and promotional messages about the Company’s own services, and to measure and analyse the effectiveness of the content that the Company serves you;
- to manage the Company relationship with you including notifying you of any changes to the Company’ Application, Platforms and Software or any service the Company provides;
- supplying you with information that is relevant to your existing relationship with the Company;
- providing customer and marketing support;
- to investigate and resolve your complaints, discrepancies or enquiries;
- to contact you in respect to the Company's services;
- to administer and protect the Company business and the Platforms including troubleshooting, data analysis and system testing;
- to match you with Shift opportunities and to improve those matches, which includes the use of data analytics and artificial intelligence in relation to your personal data;
- to manage staff training and quality assurance;
- to conduct research and statistical analysis for the maintenance and development of the Company's Application, Platforms and Software;
- to monitor the Company's performances and that of the Company's Application, Platforms and Software;
- for fraud prevention and detection; or
- in the Company's sole discretion, in exceptional circumstances such as national emergency, security concerns, or other situations in which the Company deem that such disclosure is prudent.
- to make your profile, credentials, qualifications and engagement history available across the Company's Applications and Platforms, including any Application or Platform launched by the Company after the date of this Policy, so that opportunities may be offered to you across the Company's platforms; and
- to design, build, test, launch and improve new Applications, Platforms and Software operated by the Company.
6. Third Party Relations
The Company’s Applications, Platforms and Software may, from time to time, contain links to and from the websites of the Company’s partner networks, affiliates and third party service providers. Following such a link, or using an embedded third party service, means that the provider’s own privacy policy applies to what that provider collects.
You register for and sign in to the Company’s Applications, Platforms and Software with your mobile number and a one-time verification code sent to that number. The Company creates your account from the details you provide and does not use a social media or single sign-on account to identify you. You may add an email address to your profile for the Company to contact you; your mobile number remains the identifier you sign in with.
Service providers that process personal data
The Company does not sell personal data. The providers below process personal data on the Company’s behalf, or as independent controllers of what they collect directly from you, for the purposes stated. Each provider is engaged to use the data only for the service it provides to the Company, and the Company requires a standard of protection comparable to that under the PDPA. The Company will update this list when it changes a provider.
- Stripe
- Card payments, saving a payment method, wallet top-ups and Worker payouts for engagements settled through Stripe. Stripe receives the payment details needed to process a transaction, and identity and bank-account details for a Worker who is a payout recipient.
- Airwallex
- Card payments, prepaid wallet funding and Worker payouts for engagements settled through Airwallex. Airwallex receives the same categories of data as Stripe.
- Xendit
- Payout of Worker earnings, where the payout is routed through Xendit. Xendit receives the Worker’s name, bank-account details and payout amount.
- OpenIM
- In-app chat between a Business and a Worker. OpenIM processes the chat messages, the account identifiers used for the conversation, the device push token used to deliver chat notifications, and any image or file a user sends in a chat.
- Firebase (Google)
- Push notification delivery to your device, and collection of app crash and diagnostic reports. Firebase receives a device push token, device and app version information, and the contents of a crash report.
- Dify
- The in-app assistant. The messages you send to the assistant and the assistant account identifier the Company issues for you are processed by Dify so that it can generate a reply.
- Alibaba Cloud
- Identity verification for Workers: a live selfie and the photo on an identity document are compared by its face-comparison service in the Singapore region. Delivery of one-time verification codes by SMS. Speech-to-text for the optional voice brief a Business records when creating a Shift.
- DeepSeek
- Automated reading of the text on an identity document or company registration document that a user uploads, to check whether the details submitted match the document. The document image is sent for this purpose and the extracted result is returned to the Company as an evidence signal.
- Microsoft Azure
- Hosting of the Company’s Platform and its API, and the file storage that holds documents and images users upload, including identity documents, selfies, chat attachments and Shift evidence.
- Google Maps
- Display of Shift locations and addresses on a map inside the Applications.
- Bird
- WhatsApp Business messaging used to send verification codes and Shift reminders to your mobile number.
Please note that these websites and any services that may be accessible through them have their own privacy policies and the Company do not accept any responsibility or liability for these policies or for any personal data that may be collected through these websites or services. Please check these policies before you submit any personal data to these websites or use these services.
7. Security
The Company will protect your personal data using industry standard precautions from theft, loss, misuse, disclosure, alteration and unauthorised access. While the transference of electronic data over the internet has inherent risks, the Company will exercise reasonable precautions to ensure your personal data is not subject to unnecessary risks.
The Company although endeavor to provide reasonable security for information the Company process and maintain, no security system can prevent all potential security breaches over the internet, or any electronic storage methods. You have a personal responsibility to safeguard your passwords to the Applications and Platforms.
8. Retention
The Company will retain your personal data for as long as necessary in order to fulfil the purpose for which it was collected, or as required for any legal or business purposes under relevant laws. In some circumstances the Company will anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case the Company may use this information indefinitely without further notice to you. Your user profile and account data, including your credentials, qualifications and engagement history, will be retained for as long as your account remains registered with the Company, including through periods of inactivity, because the Company’s services are engaged on an intermittent basis and this data remains necessary to verify your identity, preserve the continuity of your engagement records and offer you opportunities across the Company’s Applications and Platforms. If you no longer wish the Company to retain your profile, you may deactivate or delete your account in accordance with section 11 or contact the Company’s data protection officer under section 13.
9. Access, Update, Withdrawal of Consent
Understand that you may have different privacy concerns, you are entitled to be provided, upon request;
- access to some or all your personal data that is in the Company's possession or control; or
- information about the ways in which that personal data has been or may have been used or disclosed by the Company within a year before the date of your request
You must submit a request to the Company's data protection officer, whose contact details are set out in section 13 below, if you subsequently decide to request access to your personal data, update your personal data or withdraw your consent for us to collect, use and/or disclose your personal data, whether partial or in full. Please note that it may take up to 30 days after receipt of your request to process your request. If the Company is unable to respond within 30 days, it will notify you within that period of the time by which it will respond. The Company may require further information from you to accurately verify your identity before processing your request. Kindly also take note that:
- your updated personal data, will also be sent to all relevant parties which the Company had originally disclosed to them within a year before the date of the update, unless the relevant parties have no more legal or business purposes for the personal data.
- the PDPA exempts certain types of personal data from being subject to your access request.
- Should your withdrawal of consent result in any legal consequences arising from such withdrawal, and depending on the extent of your withdrawal of consent, it may result in the discontinuation on your existing relationship with the Company.
10. Policy Variation
The Company reserve the right to amend this Privacy and Data Protection Policy at any time. If material changes are made to this Privacy and Data Protection Policy, they will be posted on this page and date stamped. The Company encourages you to review this page periodically in order for you to stay notified of any changes.
Your continued use of the Company’ Application, Platforms and Software and acceptance of the Company’s services after any changes to this Privacy and Data Protection Policy constitutes your consent to any such changes, to the extent such consent is not otherwise provided.
11. Deactivation of Profile Policy
- Account Deletion in the App: A user can delete their account and associated personal data from inside the Yolara app. There is no charge, and no request by email or other out-of-app channel is required.
-
Steps in the Yolara app:
→ Open the Yolara app and sign in
→ Open the ‘Profile’ tab
→ Tap ‘Delete account’
→ Read what deletion does, then type DELETE to confirm and tap ‘Delete my account’
- Effect of Deletion: The account is disabled as soon as the user confirms. A disabled account can no longer take shifts, apply, chat or receive payouts. The user's profile, mobile number, NRIC or FIN, identity document images and bank details are then permanently removed. Before deletion can be confirmed, the app requires the user to settle any unsettled earnings, payouts still in progress, assigned shifts, pending applications and active team members.
- Processing Time: A deletion request is reviewed by Yolara operations and completed within thirty (30) days of confirmation. The user can follow the status in the app, and can withdraw the request in the app while it is pending. Withdrawing does not by itself reopen the account; the user must contact Yolara support to reactivate it.
- Data Retention: Records the Company must keep for tax, payment, payout, employment, fraud-prevention, security, audit or dispute-resolution purposes are retained for the applicable legal retention period or until the relevant matter is resolved, and are then deleted or irreversibly de-identified. The Company does not apply a general additional retention period after account deletion. Section 8 above describes retention more generally.
- Privacy and Security: A deleted or disabled profile is not visible to other users, and the Company protects the privacy and security of the user's information while a deletion request is pending.
- Compliance with Legal Requirements: This policy is applied in accordance with relevant data protection laws and regulations.
12. Complaint Process
If you have any complaint or feedback regarding about how the Company handled your personal data or about how the Company is complying with the PDPA, feel free to contact the Company for clarifications at section 13 below via the company’s DPO. The Company will certainly strive to deal with any complaint or feedback that you may have fairly and promptly. If you are not satisfied with the Company's response you may refer your complaint to the Personal Data Protection Commission at www.pdpc.gov.sg.
13. Contact Us
If you have comments or questions about this Privacy and Data Protection Policy statement, or wish to submit a request mentioned in section 9 above, please contact the Company's data protection officer at:
Email address: dpo@hongyegroup.com.sg (Hong Ye Group)
dpo@yycircle.com (YYLife)
Telephone number: +65 66046896 (Hong Ye Group)
+65 66046919 (YYLife)
Address: 60 Paya Lebar Rd, #09-13, Paya Lebar Square, Singapore 409051
14. Governing Law and Jurisdiction
Nothing in this Privacy and Data Protection Policy shall limit your rights under the Personal Data Protection Act 2012 of Singapore, or any other data protection or privacy related law that is applicable to you. This Privacy Policy shall be governed by the laws of the Republic of Singapore and you agree to submit to the exclusive jurisdiction of the Singapore courts.
This Policy was last updated on 1 October 2026.