Privacy Policy
We take your data seriously. This policy explains exactly what we collect, why we collect it, how we protect it, and what rights you have — with full transparency.
Introduction
Dort Asia Technologies Pte. Ltd. ("Dort Asia", "we", "us", or "our") operates a suite of business applications, with Vertex being our live, fully operational HRMS platform. Vertex is a complete company operations platform that unifies people management, payroll, finance, equity, project tracking, and documents.
This Privacy Policy applies to all data we collect and process when you use Vertex or any Dort Asia service. It is written in compliance with the Singapore Personal Data Protection Act 2012 (PDPA) and is designed to be transparent, specific, and legally protective for both our users and our company.
Data We Collect
We collect personal data only when it is necessary to provide our services, meet statutory obligations, or fulfil legitimate business purposes. Below is a comprehensive breakdown of every category of data we process:
Identity & Personal
- Full legal name, preferred name
- Date of birth, nationality
- NRIC (Singapore Citizens & PRs)
- FIN number (foreign workers)
- Passport number & expiry date
- Identity document scans (front & back)
- Work pass type, number, issue & expiry dates
Employment
- Job title, department, reporting line
- Work email address
- Monthly gross salary (SGD)
- Employment start & end dates
- CPF contribution rates & residential status
- Skills Development Fund (SDF) status
- Foreign worker levy details
Financial
- Bank name (from approved bank list)
- Account holder name
- Bank account number
- Bank code & branch code
- Payment records & unique payment IDs
- Payroll history and payslips
System & Audit
- Full audit trail of all system activity
- Login timestamps & IP addresses
- Who made what changes and when
- Document access and download logs
- OTP verification records
- Financial PIN authorization attempts
How We Use Your Data
Every piece of data we collect has a specific, documented purpose. We do not sell, rent, or trade your personal data. Below are the lawful bases under which we process your information:
Statutory Compliance (Singapore)
We apply exact CPF contribution rates based on your age bracket and residential status. We process ethnicity-based community fund contributions (SINDA, CDAC, ECF), the Skills Development Fund (SDF), and Foreign Worker Levy. This processing is mandated by Singapore law and cannot be refused.
Payroll & Financial Ledger Processing
Salary calculations occur strictly inside the Payroll module, which acts as the single source of truth. Every approved payment automatically generates a unique, immutable Payment ID (e.g., PAY-DORTASIA-20260531-0001) to create an unbreakable financial audit trail.
Project Cost Tracking & P&L
Once payroll is generated, salary data is automatically posted to the assigned project's expense ledger. This maintains accurate, real-time company Profit & Loss (P&L) statements and ensures project billing accuracy.
Onboarding & Workforce Management
We use your identity and employment data to create and manage your employee profile, configure role-based access, assign you to departments and projects, and maintain your employment history record.
Security & Fraud Prevention
Audit logs and system access records are used to detect unauthorized access, investigate incidents, and maintain the integrity of financial records. PIN authorization logs are retained to verify the legitimacy of all financial transactions.
Vertex HRMS — App-Specific Policies
Live AppVertex is currently our only live, publicly deployed application. The following policies apply specifically and exclusively to data processed within Vertex HRMS:
Attendance & Geofencing
Vertex supports GPS-based attendance tracking and QR code check-ins. When GPS attendance is enabled, your device's location coordinates are captured at the moment of check-in only. We do not continuously track your location. Location data is used solely to verify that the check-in occurred within the approved worksite radius. Raw GPS coordinates are not stored beyond 90 days.
Document Storage
Identity documents (NRIC scans, passport copies, work pass copies), payslips, and company documents uploaded to Vertex are stored in a private, access-controlled Supabase Storage bucket. These files are not publicly accessible. Signed URLs with short expiry windows are used to serve files to authorised users. Documents are never shared with third parties unless required by law.
Payroll PIN Authorization
All financial transactions in Vertex mandate a 6-digit PIN confirmation from an authorized user. This PIN is never stored in plaintext. It is hashed using SHA-256 and bcrypt algorithms before storage. A failed PIN attempt is logged and may trigger account lockout after repeated failures to prevent unauthorized financial operations.
Realtime Notifications
Vertex uses Supabase Realtime WebSockets for live notifications (e.g., attendance check-ins, payroll approvals). These connections are authenticated and tenant-scoped. Notification payloads contain only the minimum information required and are not persisted in third-party notification queues.
OTP Verification
Vertex uses OTP (One-Time Password) sent via email and mobile for authentication. OTPs expire within 10 minutes and are single-use. Phone numbers and email addresses used for OTP delivery are subject to this Privacy Policy and are not used for marketing communications without explicit consent.
Org Chart & Hierarchy Data
Vertex maintains an organisation chart reflecting reporting lines. Your name, job title, and department may be visible to other employees within your company's Vertex instance according to the role-based visibility rules set by your company's Super Admin.
Data Security & Architecture
We implement enterprise-grade security measures across all layers of our infrastructure. Security is not an afterthought — it is built into the architecture of every system we operate.
Database Security
PostgreSQL with Row Level Security (RLS) policies enforced on every table. All queries are tenant-scoped at the database layer, not just the application layer.
Encryption
Data encrypted at rest (AES-256) and in transit (TLS 1.3). Financial PINs are double-hashed with SHA-256 + bcrypt. No plaintext secrets are stored.
Authentication
Supabase Auth with OTP (email & mobile). Session tokens are short-lived JWTs. Refresh tokens are rotated on each use and invalidated on logout.
Infrastructure
Deployed on Vercel (Edge Network) with Next.js 16. Database hosted on Supabase (Singapore region). No data leaves the Singapore/APAC zone for primary storage.
Audit Logging
Full immutable audit trail of all data changes, access events, and financial transactions. Logs cannot be deleted by application users, only by Super Admins with forensic records.
API Security
All API routes are protected by Supabase JWT validation. Server-side rendering prevents client-side data exposure. Environment variables are never exposed to the browser.
Data Visibility & Access Controls
Within any Vertex instance, data visibility is heavily restricted by design. Access is not assumed — it must be explicitly granted through the permission system:
- 1By default, an employee cannot view their coworkers' personal details, salary, or documents.
- 2Data visibility is strictly governed by Role Permissions, the "Reports To" hierarchy, explicit project assignment, and Admin rights — not simply by department membership.
- 3Only Super Admins can modify Admin Payroll Settings (CPF configurations, allowance templates, levy rates). This ensures no unauthorized personnel can alter company-wide calculations.
- 4Finance module access is separate from HR access. An employee with HR permissions does not automatically gain access to financial records.
- 5Document downloads generate a time-limited signed URL (15 minutes). The access event is logged with the user's identity, timestamp, and IP address.
- 6Departing employees have their accounts deactivated immediately upon termination. Deactivated accounts cannot log in but their data is retained for statutory compliance periods.
Data Retention
We retain personal data for as long as required to fulfil the purpose for which it was collected, or as mandated by Singapore law, whichever is longer.
| Data Category | Retention Period | Basis |
|---|---|---|
| Employee identity & employment records | 7 years after termination | MOM / IRAS / Employment Act |
| Payroll & CPF records | 7 years | CPF Act, IRAS guidelines |
| Financial transaction records | 7 years | Singapore Companies Act |
| Audit logs & access records | 3 years | Internal policy / PDPA |
| GPS check-in coordinates | 90 days | Operational necessity |
| OTP & authentication logs | 90 days | Security investigation |
| Work pass copies | Until pass expiry + 2 years | MOM Work Pass Conditions |
| Document uploads (general) | Duration of employment + 3 years | Internal policy |
Third-Party Services
We use a limited number of trusted third-party services to operate our platform. All sub-processors are vetted for security compliance and are contractually bound to protect your data:
Supabase (PostgreSQL & Storage)
Primary database, authentication, file storage, and realtime infrastructure. Data region: Singapore.
Vercel
Application hosting and edge deployment. All server-side code; no customer data stored in Vercel's persistent storage.
Google Maps API
Used for geolocation-based attendance verification only. No user location data is sent to Google beyond the API call needed to resolve coordinates to an address.
Your Rights
Under the Singapore PDPA and as a matter of our company policy, you have the following rights with respect to your personal data:
Right of Access
You may request a copy of all personal data we hold about you at any time.
Right to Correction
You may request correction of inaccurate or incomplete personal data.
Right to Withdraw Consent
Where processing is consent-based, you may withdraw consent. Withdrawal does not affect prior processing.
Right to Data Portability
You may request your data in a machine-readable format (JSON/CSV) for portability.
Right to Deletion
You may request deletion of data not subject to a legal retention obligation.
Right to Know
You have the right to know how your data is used, who can access it, and where it is stored.
To exercise any right, submit a written request to enquiry@dortasia.com. We will respond within 30 calendar days. Identity verification may be required before fulfilling any request.
Company Policies
Operator GuideIf your company uses Vertex HRMS as an operator (i.e., you are an employer using Vertex to manage your workforce), the following additional obligations apply to your company:
Data Collection Consent
As the operator, you are responsible for obtaining valid informed consent from your employees before collecting and uploading their personal data into Vertex. This includes NRIC/FIN numbers, bank details, and sensitive identity documents. Dort Asia acts as a data processor on your behalf; you remain the data controller.
Super Admin Responsibilities
The Super Admin account for your Vertex instance carries elevated data access. It is the operator's responsibility to ensure the Super Admin credential is held only by an authorised individual, is protected by a strong password and MFA, and that access is revoked immediately when the relevant person's role changes.
Payroll Accuracy
The operator is responsible for ensuring that all salary figures, CPF categories, allowance types, and levy details entered into Vertex are accurate and current. Dort Asia provides the calculation engine; the accuracy of inputs and ultimate payroll liability remains with the employer.
Offboarding & Termination
When an employee is terminated, it is the operator's responsibility to deactivate the employee's Vertex account promptly. Dort Asia enforces account deactivation controls but cannot guarantee this occurs if the operator does not initiate the action.
Breach Notification
In the event of a data breach affecting your company's Vertex instance, Dort Asia will notify the operator within 72 hours of becoming aware. The operator is then responsible for notifying affected employees and the PDPC (Personal Data Protection Commission) if the breach is notifiable under the PDPA Mandatory Breach Notification Obligation.
Limitation of Liability
Dort Asia Technologies Pte. Ltd. is not liable for any loss, damage, or regulatory penalty arising from the operator's incorrect input of data, failure to obtain employee consent, failure to deactivate accounts, or misuse of the Super Admin access. Dort Asia's liability is limited to the direct costs of rectifying any data breach caused by a failure in our systems or infrastructure.
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our services, legal obligations, or best practices. When we make material changes, we will:
- Update the Effective Date at the top of this page.
- Send a notification to registered operators and administrators via email.
- Display an in-app banner in Vertex for at least 14 days following the update.
Continued use of Dort Asia services after a policy update constitutes acceptance of the revised terms. We encourage you to review this page periodically.
Contact Us
For any questions, data access requests, corrections, or privacy concerns, please reach out through:
Registered Address
Dort Asia Technologies Pte. Ltd.
Singapore
UEN: (to be provided upon registration)
We aim to respond to all privacy-related requests within 30 calendar days. For complex requests, we may extend this period by a further 30 days and will notify you accordingly.
© 2026 Dort Asia Technologies Pte. Ltd. · Privacy Policy · Effective 5 July 2026