Personal Data Protection Privacy Policy

At Quack's Gelato (referred to as "we," "us," or "our"), we operate as an online boutique gelato brand. We are thoroughly committed to safeguarding the personal data of our customers, website visitors, and users in strict accordance with the Singapore Personal Data Protection Act 2012 (PDPA).

This Privacy Policy outlines how we collect, use, disclose, maintain, and transfer your personal data when you interact with our online platform, place orders for delivery or self-collection, or contact us via our WhatsApp links.

1. Personal Data We Collect

We only collect personal data that is reasonably necessary to fulfill your orders, process your transactions, or communicate with you. This data is collected when you voluntarily provide it at checkout or via our communication channels, or through automated digital tools:

• Identity and Contact Data: Full name, mobile telephone number, and email address.

  HeySara

• Delivery and Logistics Data: Physical delivery address, postal code, block/unit numbers, and specific dropping-off instructions.

• Transaction Data: Details of items purchased, delivery windows or self-collection timestamps chosen, and order amounts paid. (Note: All digital payments are securely processed through our third-party checkout gateways; we do not store your raw credit card numbers or banking passwords on our internal local databases).

• Technical and Tracking Data: Internet Protocol (IP) addresses, browser type, device information, and site navigation behaviors collected automatically as you browse our web layers.

  ICLG

2. Critical Identity Protection Notice (No NRIC Collection)

In absolute compliance with the Personal Data Protection Commission (PDPC) guidelines and the mandatory private sector enforcement framework, Quack's Gelato does not collect, track, or authenticate user profiles using NRIC, FIN, or passport numbers.

• We strictly utilize mobile phone numbers or verified email addresses to uniquely identify and authenticate order ownership and fulfill collection queues at 27 Dover Crescent.

  HeySara

3. Purposes of Data Collection, Use, and Disclosure

We will collect, use, and disclose your personal data solely for the following explicit purposes, unless alternative processing is legally permitted or required under Singapore law:

• Order Fulfillment: Churning, packaging, managing inventory, and verifying transaction completion.

• Logistics and Dispatch: Coordinating our flat-rate $8 islandwide delivery service, mapping out optimal delivery routes, and passing necessary contact data to our third-party delivery couriers to execute delivery windows.

• Customer Care: Contacting you via voice calls, SMS, or WhatsApp if our delivery driver encounters routing errors, if you are unreachable at your doorstep, or if we need to re-arrange an uncollected order within our strict 2-hour self-collection grace period.

• Platform Security: Monitoring site traffic logs to prevent fraudulent transactions, electronic exploits, or unauthorized system access.

  ICLG

4. Cookies and Automated Tracking Disclosure

Our website, hosted via the Hostinger platform, utilizes standard internet "cookies" and similar digital tracking technologies to optimize your e-commerce browsing journey:

• Strictly Necessary Cookies: Essential for the foundational operations of our shopping cart and secure digital checkout screens.

• Performance and Analytics Cookies: Utilized to understand which gelato flavors or web sections receive the highest visitor traction. These cookies do not directly identify individual human profiles unless you complete a purchase transaction.

• Control of Cookies: Most modern web browsers automatically accept cookies. You may adjust your specific device browser settings to block or delete tracking cookies at any time; however, please note that doing so may prevent you from adding gelato items to your digital shopping cart or successfully executing online payments.

5. Transfer Limitation Obligation (Cross-Border Data Safeguards)

Because our website infrastructure and online storefront operations are integrated with Hostinger's hosting architectures, the personal data you submit may be transmitted to, or stored on, cloud servers and secure backup databases located outside of Singapore.

Under the PDPA Transfer Limitation Obligation, we guarantee that your data will not be moved to an international country or territory unless that recipient country or individual service provider enforces data protection baselines that are at least comparable to the robust standards maintained under Singapore's PDPA. This is achieved by ensuring our platform providers utilize appropriate cloud service agreements, Model Contractual Clauses (MCCs), or are aligned with recognized international frameworks such as the Global Cross-Border Privacy Rules (CBPR) System.

6. Protection and Security Safeguards

We implement reasonable and appropriate physical, administrative, and technical security arrangements to prevent unauthorized access, accidental collection, leaking, copying, modification, or destruction of your personal data. This includes using encryption protocols for data in transit and limiting digital access to order details strictly to personnel required to prepare or deliver your gelato.

• Mandatory Breach Response Protocol: In the highly unlikely event of a security compromise or data breach that is assessed to pose a risk of significant harm to individuals or impacts a scale of 500 or more people, we will systematically report the incident to the Personal Data Protection Commission (PDPC) within three (3) calendar days and notify affected users within three (3) business days in accordance with statutory guidelines.

7. Retention Limitation Schedule

We will only retain your personal data for as long as it is necessary to fulfill the original commercial or legal purposes for which it was collected. Once an order has been successfully fulfilled, the 2-hour complaint window has lapsed, and tax documentation requirements are met, we will securely delete, shred, or completely anonymize your personal information to ensure it can no longer be traced back to an identifiable individual.

8. Protection of Minors (Age of Consent under 13)

The data protection of young consumers is treated with a high standard of sensitivity. Quack's Gelato does not intentionally target, market to, or collect personal data from children under the age of thirteen (13) without verifiable guardian authorization. If you are under 13 years of age, you must obtain explicit permission from a parent or legal guardian before submitting your name, contact details, or home address on our online platform. If we discover that personal data from a child under 13 has been submitted without parental clearance, we will immediately delete that information from our database.

9. Your Individual Rights (Access, Correction, and Withdrawal)

Under the PDPA statutory framework, you possess complete autonomy over your personal data:

• Right to Access & Correct: You may submit a request to see what personal data we currently hold about you, or request immediate corrections to inaccurate or incomplete profile data. We will aim to respond to or fulfill your access/correction queries as soon as practicable.

• Right to Withdraw Consent: You may completely withdraw your consent for us to collect, use, or disclose your personal data at any time by contacting our designated officer. Please note that if you withdraw your data consent, we will be unable to process, prepare, or deliver any active gelato orders to your address, and your order slots will be forfeited without a refund.

10. Contacting Our Data Protection Officer (DPO)

Every organization subject to the PDPA is legally mandated to designate an individual responsible for compliance. For all questions, compliance inquiries, feedback, data correction requests, or privacy complaints regarding Quack's Gelato, please contact our designated Data Protection Officer:

• Attention to: The Data Protection Officer, Quack's Gelato

• Primary Contact Link: Reachable directly via the official WhatsApp link displayed prominently on our homepage interface.

• Mailing Reference Address: 27 Dover Crescent, Singapore

11. Policy Modifications

• Quack's Gelato reserves the right to amend, update, or re-draft this Privacy Policy at any time to align with adjustments in Singapore regulations, technological platform changes, or evolving business frameworks.