PDPA & Privacy

1. INTRODUCTION & SCOPE

This Privacy Policy sets out the basis on which Cessentials (UEN: 53531205M) (“we”, “us”, “our”, or “Cessentials”) collects, uses, discloses, and processes your Personal Data in accordance with the Singapore Personal Data Protection Act 2012 (“PDPA”). This policy applies to all visitors, registered users, and customers accessing or transacting on our website (cessentials.shop).

2. WHAT IS PERSONAL DATA

“Personal Data” refers to any data, whether true or not, about an individual who can be identified from that data, or from that data and other information to which we have or are likely to have access. The Personal Data we collect includes:

• Identity Data: Full name, gender, profile photo, date of birth, and identity documentation required for regulatory compliance.
• Contact Data: Delivery address, billing address, contact telephone number, and email address.
• Payment Data: Credit card information, bank account details, PayNow transaction reference numbers, and payment verification records.
• Transaction Data: Details of products purchased, order history, billing records, and customer care correspondence.
• Usage Data: Details of your visits to our website, browsing actions, products viewed, resources accessed, and interactions with website features.
• Device & Technical Data: IP address, operating system, browser type, device identifiers, advertising identifiers, error logs, and session analytics.
• Location Data: Geographical position derived from IP addresses or mobile device network signals when accessing our website.

3. HOW WE COLLECT PERSONAL DATA

We collect Personal Data through the following methods:

• Directly Provided Data: Information you voluntarily provide when registering an account, placing an order, contacting support, submitting an RMA request, or participating in surveys and promotions.
• Third-Party Authentication: Data obtained if you log in via social media or sign-in services (e.g., Facebook Connect, Google Sign-In), which authenticate your identity and prepopulate account details.
• Automated Collection: Data collected automatically via cookies, web beacons, embedded scripts, and server logs during your site interactions.
• External Sources: Information received from business partners, credit verification agencies, payment service providers, and logistics operations.

4. PURPOSES OF COLLECTION, USE & DISCLOSURE

Your Personal Data is processed strictly for the following purposes:

• Business Operations & Order Fulfillment: Processing transactions, verifying payments, issuing automated GST-detailed tax invoices, and delivering purchased products to specified shipping addresses within our 5-business-day SLA.
• Customer Care & RMA Processing: Managing customer inquiries, processing 14-day returns, administering 90-day warranty coverage, and dispatching replacement spare parts.
• Compliance & Safety Checks: Conducting Know-Your-Customer (KYC), Anti-Money Laundering (AML), credit risk, and fraud-prevention assessments required under Singapore banking regulations.
• Marketing, Cookies & Cart Recovery: Delivering promotional newsletters, event invitations, and automated abandoned checkout reminders via SMS or email where consent has been granted.
• Business Asset Transactions: Processing data in connection with mergers, acquisitions, joint ventures, consolidation, restructuring, financing, business asset sales, or corporate acquisition.
• Statutory & Legal Requirements: Complying with applicable Singapore laws, IRAS tax audits, court orders, or law enforcement requests.

5. COOKIES & ABANDONED CART SMS DISCLOSURE

We use cookies and similar tracking technologies to track items placed in your shopping cart, maintain checkout states, and analyze traffic patterns. When you begin checkout and enter contact information, cookies capture this state to determine when to trigger automated checkout reminder messages via SMS or email. You may manage cookie preferences through browser settings; disabling cookies may impact site checkout functionality.

6. DISCLOSURE & OVERSEAS TRANSFER

We disclose Personal Data strictly to authorized third parties to perform essential operational services on our behalf:

• Payment Gateways: Stripe, GrabPay, PayNow processing partners, and acquiring banks.
• Logistics Providers: Local courier networks executing last-mile deliveries.
• IT & Cloud Infra Providers: Web hosting providers, data analytics tools, and secure database servers.

Where Personal Data is transferred outside Singapore, Cessentials ensures standard data protection safeguards comparable to Singapore PDPA requirements are enforced.

7. ACCESS, CORRECTION & 1-YEAR RETROSPECTIVE DISCLOSURE

You have the right to request access to or correction of your Personal Data in our custody. Submit written requests to our Data Protection Officer. As permitted under the PDPA, Cessentials reserves the right to charge a reasonable administrative fee to process data access requests (a written fee estimate will be provided prior to processing). Where Personal Data is corrected, Cessentials may, at its discretion, send the corrected Personal Data to any organization to which the data was disclosed within one (1) year before the date the correction was made, unless the corrected data is no longer needed for legal or business purposes.

8. ACCOUNT SECURITY & USER RESPONSIBILITY

You must safeguard your user account, login credentials, and device against unauthorized access. We cannot assume responsibility for unauthorized use of your personal data attributable to factors beyond our control. If you suspect your account credentials have been compromised, you must contact us immediately and update your password. You are reminded to log out of your account at the conclusion of each browsing session.

9. LINKS TO THIRD-PARTY WEBSITES

Our website may contain links to third-party sites or external resources. These links are provided for convenience only. Cessentials has no control over and accepts no responsibility or liability for the privacy practices, content, or data handling of external third-party websites.

10. WITHDRAWAL OF CONSENT & AMENDMENTS

You may withdraw consent for data processing or marketing communications at any time by contacting our DPO. Requests take up to 7 working days to process. Personal Data is securely destroyed or anonymized when no longer required for legal or business purposes. Cessentials reserves the right to update this Privacy Policy at any time by publishing the amended policy on cessentials.shop. Continued use of our website or services constitutes acceptance of the amended terms.