Privacy Policy

We collect the following categories of personal data:

• Verifying your identity and authorising entry via SingPass
• Processing and recording payments via PayNow and PayWave
• Maintaining transaction records for accounting, auditing, and tax compliance
• Preventing and investigating theft, fraud, misconduct, or breaches of our Terms of Entry
• Ensuring the safety and security of customers and store assets
• Complying with applicable laws and requests from law enforcement or regulatory authorities
• Improving store operations using anonymised or aggregated data

• Performance of a contract — to process your purchases and manage store access
• Legitimate interests — for security monitoring, fraud prevention, and operational improvement
• Legal obligation — to comply with applicable Singapore laws and regulatory requirements
• Consent — where you have expressly consented (e.g. optional loyalty or marketing communications)

5.1 We do not sell, rent, or trade your personal data to third parties.

5.2 We may disclose your personal data to:

• SingPass / GovTech — for identity verification services
• Payment processors (PayNow / PayWave network operators and your bank) — to process transactions
• CCTV and security service providers — for surveillance system maintenance and monitoring
• Cloud or IT infrastructure providers — for data storage and system operations (bound by data processing agreements)
• Law enforcement agencies, courts, or regulatory authorities — where required by law or legal proceedings
• Professional advisors — legal, accounting, or insurance professionals, as necessary

5.3 All third-party service providers are required to protect your data in accordance with the PDPA and our contractual requirements.

We retain your personal data only for as long as necessary for the purposes for which it was collected, or as required by law:

7.1 We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include encryption in transit, access controls, and regular security assessments.

7.2 No data transmission or storage system can be guaranteed to be 100% secure. If you believe your data has been compromised, please contact us immediately.

7.3 In the event of a data breach likely to cause significant harm, we will notify the Personal Data Protection Commission (PDPC) and affected individuals in accordance with the PDPA Notification of Data Breaches Obligation.

Under the PDPA, you have the following rights with respect to your personal data:

• Right of Access — to request access to personal data we hold about you
• Right of Correction — to request correction of inaccurate or incomplete personal data
• Right of Withdrawal of Consent — to withdraw consent where consent is the legal basis (note: withdrawal may affect your ability to use the store)
• Right to Data Portability — to request a copy of your data in a portable format (where applicable under the PDPA)

9.1 Our identity verification process uses SingPass, operated by the Government Technology Agency of Singapore (GovTech). By using SingPass to enter our store, you are also subject to GovTech's Terms of Use and Privacy Policy, available at www.singpass.gov.sg.

9.2 We only retrieve the minimum necessary personal data from MyInfo required to verify your identity and age. We do not store your NRIC number in full; it is used solely at the point of verification.

10.1 Payment transactions are processed through PayNow and PayWave. Your payment credentials (bank account numbers, card numbers) are not stored by us. Payment processing is handled directly by your bank or payment network operator.

10.2 We retain only the transaction reference number, amount, date/time, and payment method for our own records.

We may update this Privacy Policy from time to time. The updated policy will be posted at the store entrance and on our website. Continued use of the store constitutes acceptance of the updated policy.

If you have any questions, concerns, or complaints regarding this Privacy Policy or our handling of your personal data, please contact our Data Protection Officer (DPO):

You also have the right to lodge a complaint with the Personal Data Protection Commission (PDPC) at www.pdpc.gov.sg if you are dissatisfied with how we have handled your personal data.