This Data Protection Notice (“Notice”) explains how Bounce Singapore Pte Ltd (“we”, “us” or “our”) collects, uses, discloses and otherwise processes the personal data of our customers in accordance with the Personal Data Protection Act 2012 (“PDPA”). It applies to personal data in our possession or under our control, including personal data held by organisations we have engaged to process personal data on our behalf.

Personal data

1. In this Notice:

• “customer” means an individual who (a) contacts us about our goods or services, (b) books, buys or uses our goods or services, including memberships and parties, (c) takes part in an activity at our sites, (d) is a parent, guardian or other person who books for, or gives consent on behalf of, a participant, or (e) books on behalf of a school, company or other organisation; and
• “personal data” means data, whether true or not, about an individual who can be identified from that data, or from that data and other information we have or are likely to have access to.

2. Depending on how you deal with us, we may collect:

• identity and contact details, such as your name, date of birth, email address, telephone number, postcode and country of residence;
• booking and transaction details, such as tickets purchased, visit dates and payment records (card details are processed by our payment providers);
• membership details and visit history, if you are a member;
• for group, school and corporate bookings, the name and contact details of the person making the booking and the name of their organisation;
• your signed participation waiver;
• records of incidents or injuries at our sites;
• images and video recorded by CCTV at our sites and, where you have agreed, photographs or video taken during activities; and
• information about how you use our website and online booking platforms, such as device and cookie data.

3. We do not collect NRIC, FIN, passport, work permit or birth certificate numbers, unless the law requires it or it is necessary to establish your identity to a high degree of accuracy. We do not use these numbers to authenticate you.
4. Other terms used in this Notice have the meanings given to them in the PDPA (where the context permits).

Children

5. Many of our participants are under 18. Where a participant is a minor, we will generally collect their personal data from, and seek consent from, their parent or guardian. A parent or guardian may exercise the rights in this Notice on the minor’s behalf. A parent or guardian must sign the participation waiver for every participant under 18, except for school groups. For school groups, the school completes a group acknowledgement form and provides any student details we need. The school is responsible for obtaining any consent required from parents or guardians.

Collection, use and disclosure of personal data

6. We collect, use and disclose your personal data with your consent, or where the PDPA otherwise allows us to do so. This includes where your consent is deemed (for example, because the data is needed to perform a contract you have entered into with us), where we have a legitimate interest that outweighs any adverse effect on you, for business improvement purposes, or where the law requires or permits it. We will seek your consent before using your personal data for a new purpose that has not been notified to you, unless the law permits otherwise.
7. We collect and use personal data for the following purposes:

• processing bookings, tickets and payments, and providing our activities;
• managing memberships, parties, and group, school and corporate bookings;
• checking that participants meet our safety requirements and giving safety briefings;
• managing incidents and injuries, including first aid, contacting a parent, guardian or next of kin, and handling related insurance or legal claims;
• keeping our sites safe and secure, including by CCTV;
• responding to queries, requests, complaints and feedback;
• managing your relationship with us, including service messages about your booking or membership;
• improving our activities, services and customer experience, including through surveys and analysis of booking and usage data;
• complying with applicable laws, regulations and guidelines, and assisting law enforcement and regulatory authorities;
• sending you marketing information, only where you have agreed to receive it (see clause 11); and
• using photographs or video of you in our publicity, only where you have agreed (see clause 12).

8. We may disclose your personal data to the following, for the purposes above:

• service providers we engage, such as our booking, waiver, payment and marketing platforms, IT and cloud hosting providers, and email providers;
• our related corporations, Tomorrow Entertainment Singapore Pte Ltd and Tomorrow Entertainment Group Pte Ltd, which provide shared management, finance, customer service, IT and data protection functions for us;
• for school and other group bookings, the school or organisation that made the booking, in connection with that booking or any incident;
• insurers, medical providers and emergency services, in connection with incidents and injuries;
• our professional advisers, such as lawyers and auditors;
• government and regulatory authorities, where required or permitted by law; and
• prospective or actual buyers of, or investors in, our business, where the PDPA permits this in a business asset transaction.

9. Tickets and passes may be sold through our ticketing partner’s platform. When you book through that platform, the ticketing partner collects your personal data as an independent organisation under its own privacy policy, which you will see when you book. It shares your booking details with us so that we can provide your visit, and our use of that data is governed by this Notice. We are not responsible for how the ticketing partner handles personal data under its own privacy policy.
10. The purposes above may continue to apply for a reasonable period after your relationship with us ends, including to deal with any claims and to enforce our rights under any contract with you.

Marketing

11. We will only send you marketing emails about our activities if you have agreed to receive them. These emails may be sent by us or by our marketing platform on our behalf. You can opt out at any time by using the unsubscribe link in any email or by contacting our Data Protection Officer.

CCTV and photography

12. We operate CCTV at our sites for safety and security. Our staff may take photographs or video during activities. We will only use images in which you can be identified in our marketing or social media if you, or your parent or guardian for a minor, have agreed. You can withdraw that agreement under clause 13.

Withdrawing your consent

13. The consent you give for the collection, use and disclosure of your personal data remains valid until you withdraw it in writing. You may withdraw consent and ask us to stop collecting, using and/or disclosing your personal data for any or all of the purposes above by writing or emailing our Data Protection Officer at the contact details below.
14. After receiving your written request, we may need reasonable time (depending on its complexity and its impact on our relationship with you) to process it and to tell you the consequences, including any legal consequences affecting your rights and liabilities to us. In general, we will process your request within ten (10) business days of receiving it.
15. While we respect your decision, depending on the nature and scope of your request we may not be able to keep providing our goods or services to you. If so, we will tell you before completing your request. If you decide to cancel your withdrawal of consent, please tell us in writing as described in clause 13.
16. Withdrawing consent does not affect our right to continue to collect, use and disclose personal data where the PDPA or other laws allow us to do so without consent.

Access to and correction of personal data

17. If you wish to make (a) an access request for a copy of the personal data we hold about you, or information about how we have used or disclosed it, or (b) a correction request to correct or update your personal data, you may write or email our Data Protection Officer at the contact details below.
18. A reasonable fee may be charged for an access request. If so, we will tell you the fee before processing your request.
19. We will respond to your request as soon as reasonably possible. If we cannot respond within thirty (30) days of receiving it, we will tell you in writing within that period when we will be able to respond. If we cannot give you access or make a correction, we will generally tell you why, unless the PDPA does not require us to.

Protection of personal data

20. To safeguard your personal data from unauthorised access, collection, use, disclosure, copying, modification, disposal or similar risks, we have introduced appropriate administrative, physical and technical measures, such as up-to-date antivirus protection, encryption, and disclosing personal data internally and to our authorised service providers and agents only on a need-to-know basis.
21. No method of transmission over the Internet or of electronic storage is completely secure. While security cannot be guaranteed, we strive to protect your information and regularly review and improve our security measures.

Accuracy of personal data

22. We generally rely on personal data provided by you (or your authorised representative). To keep your personal data current, complete and accurate, please tell our Data Protection Officer in writing or by email if your details change.

Retention of personal data

23. We keep your personal data for as long as it is needed for the purpose for which it was collected, or as required or permitted by law. Incident, injury and waiver records may be kept for longer, for as long as they are needed to deal with possible claims.
24. We will stop keeping your personal data, or remove the means by which it can be associated with you, as soon as it is reasonable to assume that keeping it no longer serves the purpose for which it was collected and is no longer necessary for legal or business purposes.

Transfers of personal data outside Singapore

25. Some of our service providers, including our booking, ticketing, waiver, payment and marketing platforms, store or process personal data outside Singapore. When we transfer personal data overseas, we take steps to ensure it continues to receive a standard of protection comparable to that under the PDPA, such as legally enforceable contractual obligations with the recipient.

Data Protection Officer

26. You may contact our Data Protection Officer with any questions or feedback about our personal data protection policies, or to make any request, as follows:

• Name: Simon Ogilvie
• Telephone: +65 6206 9744
• Email: PD**@***********om.sg

Effect of this Notice and changes to it

27. This Notice applies together with any other notices, contractual clauses and consent clauses that apply to the collection, use and disclosure of your personal data by us.
28. We may revise this Notice from time to time. The current version will always be available on our website, showing the date it was last updated. If a change involves using your personal data for a new purpose, we will seek your consent, or notify you as the PDPA requires, before doing so.

Effective date: 03/02/2021
Last updated: 13/10/2026