PDPA Policy

Personal Data Protection Act Policy (PDPA Policy)

About Giftano

At Giftano Pte Ltd we take your privacy very seriously and we are committed to protecting your personal data. This privacy statement (together with any terms of use or terms and conditions, which you can find on the relevant Giftano's website, as defined below) explains how the members of Giftano Pte Ltd manage your personal data. It includes details of how we collect, store, use, record, hold, transfer and disclose your personal data. If you wish to contact us regarding this privacy statement, please see the contact details set out below. Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it.

DATA PROTECTION NOTICE

This Data Protection Notice (“Notice”) sets out the basis which Giftano Pte Ltd (“we”, “us”, or “our”) may collect, use, disclose or otherwise process personal data of our customers in accordance with the Personal Data Protection Act (“PDPA”). This Notice applies to personal data in our possession or under our control, including personal data in the possession of organizations which we have engaged to collect, use, disclose or process personal data for our purposes.

PERSONAL DATA

1. As used in this Notice: “customer” means an individual who (a) has contacted us through any means to find out more about any goods or services we provide, or (b) may, or has, entered into a contract with us for the supply of any goods or services by us; and “personal data” means data, whether true or not, about a customer who can be identified: (a) from that data; or (b) from that data and other information to which we have or are likely to have access.
2. Depending on the nature of your interaction with us, some examples of personal data which we may collect from you include your name and identification information such as your NRIC number, contact information such as your address, email address or telephone number, nationality, gender, date of birth, marital status, photographs and other audio-visual information, employment information and financial information such as credit card numbers, debit card numbers or bank account information.
3. Other terms used in this Notice shall have the meanings given to them in the PDPA (where the context so permits).
4. We generally do not collect your personal data unless (a) it is provided to us voluntarily by you directly or via a third party who has been duly authorised by you to disclose your personal data to us (your “authorised representative”) after (i) you (or your authorised representative) have been notified of the purposes for which the data is collected, and (ii) you (or your authorised representative) have provided written consent to the collection and usage of your personal data for those purposes, or (b) collection and use of personal data without consent is permitted or required by the PDPA or other laws. We shall seek your consent before collecting any additional personal data and before using your personal data for a purpose which has not been notified to you (except where permitted or authorised by law).
   • Data we collect includes:
     • when you place an order on Giftano’s Website or otherwise;
     • when you receive a gift from a buyer on our Website;
     • by filling in forms on Giftano's Website;
     • when you use our Website;
     • when you sign up to receive email updates from us;
     • when you ask us to provide you with marketing communications such as newsletters, updates or information about special events or promotions;
     • if you ask us to keep in touch with you or provide you with personalised content (such as targeted advertising);
     • if you contact us or correspond with us (for example, by phone, email or otherwise) for any reason; or
     • when you provide us with comments, opinions and/or feedback about Giftano.
   • Data we collect about you when you visit or use Giftano's Website:
     • technical information, including the type of device (and its unique device identifier) you use to access the our Website, the Internet protocol (IP) address used to connect your device to the Internet, your unique device identifier (UDID) or mobile equipment identifier (MEID) for your mobile device, your device and component serial numbers, your login information, browser type and version, time zone setting, browser plug in types and versions, operating systems, mobile network information and platform and details of any referring website or application; and
     • information about your visit on our Website including full Uniform Resource Locators (URL), clickstream to, through and from the Giftano's Website (including date and time), pages you viewed, page response time, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), and methods used to browse away from the page.
   • Data our merchant partners collect about you. For example, when you buy a gift from a partner merchant on Giftano’s website, the order information will be shared with the merchant.
   • Data we collect from or are provided with by third parties. We may be given information about you from third parties, such as social media platforms or anyone making a purchase on your behalf. We may also collect information that is publicly available, for example, when we interact with you through social media.
5. We may collect and use your personal data for any or all of the following purposes:
   • performing obligations in the course of or in connection with our provision of the goods and/or services requested by you;
   • verifying your identity;
   • responding to, handling, and processing queries, requests, applications, complaints, and feedback from you;
   • managing your relationship with us;
   • processing payment or credit transactions;
   • sending your marketing information about our goods or services including notifying you of our marketing events, initiatives and promotions, lucky draws, membership and rewards schemes and other promotions;
   • complying with any applicable laws, regulations, codes of practice, guidelines, or rules, or to assist in law enforcement and investigations conducted by any governmental and/or regulatory authority;
   • any other purposes for which you have provided the information;
   • transmitting to any unaffiliated third parties including our third party service providers and agents, and relevant governmental and/or regulatory authorities, whether in Singapore or abroad, for the aforementioned purposes; and
   • any other incidental business purposes related to or in connection with the above.
6. We may disclose your personal data:
   • where such disclosure is required for performing obligations in the course of or in connection with our provision of the goods or services requested by you; or
   • to third party service providers, agents, and other organisations we have engaged to perform any of the functions listed in clause 5 above for us.
7. The purposes listed in the above clauses may continue to apply even in situations where your relationship with us (for example, pursuant to a contract) has been terminated or altered in any way, for a reasonable period thereafter (including, where applicable, a period to enable us to enforce our rights under any contract with you).

WITHDRAWING YOUR CONSENT

8. The consent that you provide for the collection, use and disclosure of your personal data will remain valid until such time as it is being withdrawn by you in writing. You may withdraw your consent and request us to stop using and/or disclosing your personal data for any or all the purposes listed above by submitting your request in writing or via email to our Data Protection Officer at the contact details provided below.
9. Upon receipt of your written request to withdraw your consent, we may require reasonable time (depending on the complexity of the request and its impact on our relationship with you) for your request to be processed and for us to notify you of the consequences of us acceding to the same, including any legal consequences which may affect your rights and liabilities to us. In general, we shall seek to process your request within ten (10) business days of receiving it.
10. Whilst we respect your decision to withdraw your consent, please note that depending on the nature and scope of your request, we may not be in a position to continue providing our goods or services to you and we shall, in such circumstances, notify you before completing the processing of your request. Should you decide to cancel your withdrawal of consent, please inform us in writing in the manner described in clause 8 above.
11. Please note that withdrawing consent does not affect our right to continue to collect, use and disclose personal data where such collection, use and disclose without consent is permitted or required under applicable laws.

ACCESS TO AND CORRECTION OF PERSONAL DATA

12. If you wish to make (a) an access request for access to a copy of the personal data which we hold about you or information about the ways in which we use or disclose your personal data, or (b) a correction request to correct or update any of your personal data which we hold about you, you may submit your request in writing or via email to our Data Protection Officer at the contact details provided below.
13. Please note that a reasonable fee may be charged for an access request. If so, we will inform you of the fee before processing your request.
14. We will respond to your request as soon as reasonably possible. Should we not be able to respond to your request within thirty (30) days after receiving your request, we will inform you in writing within thirty (30) days of the time by which we will be able to respond to your request. If we are unable to provide you with any personal data or to make a correction requested by you, we shall generally inform you of the reasons why we are unable to do so (except where we are not required to do so under the PDPA).

PROTECTION OF PERSONAL DATA

15. To safeguard your personal data from unauthorised access, collection, use, disclosure, copying, modification, disposal or similar risks, we have introduced appropriate administrative, physical and technical measures such as up-to-date antivirus protection, encryption and the use of privacy filters to secure all storage and transmission of personal data by us, and disclosing personal data both internally and to our authorised third party service providers and agents only on a need-to-know basis.
16. You should be aware, however, that no method of transmission over the Internet or method of electronic storage is completely secure. While security cannot be guaranteed, we strive to protect the security of your information and are constantly reviewing and enhancing our information security measures.

ACCURACY OF PERSONAL DATA

17. We generally rely on personal data provided by you (or your authorised representative). In order to ensure that your personal data is current, complete and accurate, please update us if there are changes to your personal data by informing our Data Protection Officer in writing or via email at the contact details provided below.

RETENTION OF PERSONAL DATA

18. We may retain your personal data for as long as it is necessary to fulfil the purpose for which it was collected, or as required or permitted by applicable laws.
19. We will cease to retain your personal data, or remove the means by which the data can be associated with you, as soon as it is reasonable to assume that such retention no longer serves the purpose for which the personal data was collected, and is no longer necessary for legal or business purposes.

TRANSFERS OF PERSONAL DATA OUTSIDE OF SINGAPORE

20. We generally do not transfer your personal data to countries outside of Singapore. However, if we do so, we will obtain your consent for the transfer to be made and we will take steps to ensure that your personal data continues to receive a standard of protection that is at least comparable to that provided under the PDPA.

DATA PROTECTION OFFICER

21. You may contact our Data Protection Officer if you have any enquiries or feedback on our personal data protection policies and procedures, or if you wish to make any request, in the following manner:

Name of DPO: Anton

Email: [email protected]

Address: 1 George Street Level 10 Singapore 049145

EFFECT OF NOTICE AND CHANGES TO NOTICE

22. This Notice applies in conjunction with any other notices, contractual clauses and consent clauses that apply in relation to the collection, use and disclosure of your personal data by us.
23. We may revise this Notice from time to time without any prior notice. You may determine if any such revision has taken place by referring to the date on which this Notice was last updated. Your continued use of our services constitutes your acknowledgement and acceptance of such changes.

Privacy Policy

At Giftano Pte Ltd we take your privacy very seriously and we are committed to protecting your personal data.

This privacy statement (together with any terms of use or terms and conditions, which you can find on the relevant Giftano's website, as defined below) explains how the members of Giftano Pte Ltd manage your personal data. It includes details of how we collect, store, use, record, hold, transfer and disclose your personal data. If you wish to contact us regarding this privacy statement, please see the contact details set out below.

Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it.

Data We Collect from You and Our Sources

Your personal data includes any information that you provide to us, that we collect or that we are provided with by third parties and that identifies you, or from which you are identifiable, whether directly or indirectly. We may collect, use, store and transfer the following personal data about you :

• Data we collect includes :
  • when you receive a gift from a buyer on our Website;
  • when you place an order on Giftano’s Website or otherwise;
  • by filling in forms on Giftano's Website;
  • when you use our Website;
  • when you sign up to receive email updates from us;
  • when you ask us to provide you with marketing communications such as newsletters, updates or information about special events or promotions;
  • if you ask us to keep in touch with you or provide you with personalised content (such as targeted advertising);
  • if you contact us or correspond with us (for example, by phone, email or otherwise) for any reason; or
  • when you provide us with comments, opinions and/or feedback about Giftano
• Data we collect about you when you visit or use Giftano's Website :
  • technical information, including the type of device (and its unique device identifier) you use to access the our Website, the Internet protocol (IP) address used to connect your device to the Internet, your unique device identifier (UDID) or mobile equipment identifier (MEID) for your mobile device, your device and component serial numbers, your login information, browser type and version, time zone setting, browser plug in types and versions, operating systems, mobile network information and platform and details of any referring website or application; and
  • information about your visit on our Website including full Uniform Resource Locators (URL), clickstream to, through and from the Giftano's Website (including date and time), pages you viewed, page response time, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), and methods used to browse away from the page.
• Data our merchant partners collect about you. For example, when you buy a gift from a partner merchant on Giftano’s website, the order information will be shared with the merchant.
• Data we collect from or are provided with by third parties. We may be given information about you from third parties, such as social media platforms or anyone making a purchase on your behalf. We may also collect information that is publicly available, for example, when we interact with you through social media.

The provision of certain personal data by you to us (such as your name, email address, contact information, credit card and such other information) will be compulsory or obligatory in order for Giftano to perform the relevant services for the identified purposes. Giftano may not be able to perform the relevant services for the identified purposes if you fail to supply the relevant personal data

Where personal data of a minor is submitted by you, you confirm that you have authority to provide such data to us on behalf of that minor to enable us to process their personal data as described in this privacy statement.

How We Use Your Personal Data

Giftano uses the personal data for relevant purposes where we have a legal basis to use your personal data without consent, this privacy statement fulfils our duty to process personal data fairly and lawfully and in a manner that you would expect given the nature of our relationship with you, by giving you appropriate notice and explanation of the way in which your personal data will be used.

Where consent is required for our use of your personal data as described above, we will request your consent. Typically, we would collect your consent by you performing an action such as ticking the appropriate consent box or otherwise communicating your consent to us (for example, by email or by you providing us with nonmandatory information), you consent to our use of that personal data as set out in this privacy statement. For example, we will only process your personal data for marketing purposes if we have your consent to do so. Please see the Marketing section for further information on this.

Marketing

We will, if you have given us your consent and in line with your choices, provide you with information by post, telephone, email and SMS, which may be of interest to you in respect of Giftano. Where you have consented to receiving our direct marketing online this means that you could be presented with our advertisements while using the Giftano’s Websites or the services of our online partners. For example, if you have given us this consent we may run a Facebook advertisement campaign, which could include our advertisements being presented to you while you are on Facebook. We may also personalise the content that you see using analytical or profiling tools. We will only provide you with marketing communications if you would like us to. You will have the opportunity to clearly set out whether you wish to receive marketing messages from us by ticking the relevant boxes.

How We Share and Disclose Your Personal Data

We may share or disclose your personal data in connection with the purposes described in this privacy statement. This may include sharing your personal data with the following :

• all companies partnering with Giftano Pte Ltd for marketing, business, administrative and legal purposes (for example, payment, verification or membership awards and points);
• Facebook, Twitter or Instagram (if you use your account with them to sign up / in with us), if applicable;
• service providers, business partners, suppliers, subcontractors or agents (for example, fitness, medical and healthcare professionals providing assessments for treatments, IT services, travel planning, reservation, booking, rewards management, customer relationship management, business development and marketing support services) who perform functions such as marketing, payment, fulfilment and delivery of orders, administration and processing of payments, as well as bookings and reservations;
• professional advisors acting as processors or joint controllers including lawyers, bankers, auditors and insurers who provide consultancy, banking, legal, insurance and accounting services;
• vendors who provide services to us, such as fulfilling orders, providing data processing and other information technology services, managing promotions, carrying out research and analysis, and personalising individual Giftano customer experiences. We do not allow these vendors to use this information or to share it for any purpose other than to provide services on our behalf
• government or other law enforcement agencies, in connection with the investigation of unlawful activities or for other legal reasons (this may include your location information;
• third parties, who acquire us or substantially all of our assets, in which case your personal data (including any sensitive personal data) will be one of the transferred assets (however, we will let you know before this happens); and
• analytics and search engine providers that assist us in the improvement and optimisation of Giftano Website.

Where We Store Your Personal Data

The personal data that we collect from you may be transferred to, processed and stored, in different countries depending on the circumstances (including outside the European Economic Area). This includes any country where the Giftano and its partners are located including in Singapore, Bhutan, Brunei, Macau, Malaysia, New Zealand, Hong Kong, Indonesia, Philippines, Thailand, Taiwan, Vietnam, United Kingdom, the United States and Australia, but also countries where our external service providers are based or hosting your personal data on our behalf.

Please note that your personal data may be transferred to and stored in countries which do not provide the same level of protection for personal data as under your local law. However, we will ensure that a similar degree of protection is afforded to it by ensuring that one of the following safeguards is implemented :

• We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission.
• Where there is no adequacy decision by the European Commission in respect of these countries, which means they are not deemed to provide an adequate level of protection to your personal data, we will still ensure that your personal data receives an adequate level of protection. We have therefore put in place the following measures to ensure that your personal data is treated by those third parties in a way that is consistent with EU laws on data protection:
  • EU-US Privacy Shield; and/or
  • EU standard contractual clauses.

As mentioned above, please note that the rights of governmental and law enforcement authorities to access your personal data may also differ depending on where your personal data is held. If you would like to find out more about this, please contact us using the details in the CONTACT US section.

Links to Third Party Websites

Giftano Website may contain links to other third party websites and microsites, whose privacy practices may differ from those of Giftano. If you submit personal data to any of those sites, your personal data is not subject to this privacy statement.

We encourage you to review the privacy policy of any site you visit. By clicking on or activating such links and leaving Giftano's Website, our company does not exercise control over any data or any information which you give to any other entity after leaving our Website. Any access to such other sites or pages is entirely at your risk.

Retention of Personal Data

Your personal data will only be retained for as long as it is necessary to fulfil the purposes for which it was collected as outlined in this privacy statement and for the purpose of satisfying our business (accounting and reporting) or legal requirements, but also to properly resolve disputes or to troubleshoot problems.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements. In addition, certain information may be stored indefinitely due to technical constraints, and will be blocked from further processing for purposes which are not mandatory by law.

Should you want to know what data we have collected you may contact us using the details in the CONTACT US section on our website.

How We Store and Secure Your Personal Data

We are committed to taking appropriate measures designed to keep your personal data secure. Our technical and organisational procedures are designed to protect your personal data from accidental, unlawful or unauthorised loss, access, disclosure, use, alteration, or destruction. While we make efforts to protect our information systems, no website, mobile application, computer system, or transmission of information over the Internet or any other public network can be guaranteed to be 100% secure. Once we have received your personal data, we will use strict procedures and security features to try to prevent unauthorised access or inadvertent disclosure.

The personal data that we hold about you will be stored either on our servers or using third party data storage providers in Singapore or if elsewhere, in compliance with applicable data protection laws. We may post a notice on Giftano's Website, notify you by email or contact you otherwise if a security breach occurs and such breach presents a high risk to your rights and freedoms.

Your Legal Rights

You have the following rights with regard to your personal data :

• Access. You have the right to access data we hold about you. This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
• Rectification or erasure. You have the right to request that we rectify or delete any personal data that we hold about you (unless we have the legal right to retain it). This right does not extend to nonpersonal data. Please note that your rights to request erasure may be limited by applicable law.
• Restriction. You also have the right to restrict us from processing your personal data if the data is inaccurate, the processing is unlawful or we no longer need to your personal data for the purposes for which we hold it.
• Data portability. You have the right to obtain personal data we hold about you, in a structured, electronic format, and to transmit such data to another data controller if the legal basis for processing such personal data is consent.
• Object /change of preferences. You have a right to request that we stop processing your personal data where we are relying on a legitimate interest (or those of a third party). You have the right to object where we are processing your personal data for direct marketing purposes. For example, if you have given your consent to receive updates or other marketing communications, but have changed your mind, you have the ability to opt out from receiving such communications going forward by contacting us using the details in the CONTACT US section or by clicking the relevant link in any communications you receive.
• Complaints. If for any reason you are not happy with the way that we have handled your personal data, please see the QUERIES, COMMENTS, REQUESTS AND COMPLAINTS section for further information and contact us. If you are still not happy, you have the right to make a complaint to the Information Commissioner’s Office. To exercise any of the rights mentioned above, please contact us using the details in the CONTACT US section. Where available, you may also be able to access, rectify, request the erasure, export and restrict the use of your personal data, as well as update your preferences by signing into your account and selecting “Update Profile”

We will comply with your request to exercise the above mentioned rights, to the extent required by applicable law. However, if you ask us to stop processing your personal data in certain ways or erase your personal data, and this type of processing or data is needed to facilitate your use of Giftano Website or is required for us to provide you with a service (such as to manage your account), you may not be able to use Giftano's Website or the service as you did before.

This does not include your right to object to the processing of your personal data for the purposes of direct marketing. You can exercise this right at any time without restrictions. Please allow at least 3 working days for your request to be actioned.

You may also request for your data to be removed via this link. However, to protect your confidentiality and to comply with applicable data protection laws, we may need to confirm your identity before we can action your request. When contacting the Data Privacy Office, please state your name and provide valid contact details. As mentioned above, protecting your confidentiality, and complying with applicable data protection laws is important to us, Giftano Pte Ltd may therefore refuse to comply with any request unless it is supplied with such information as it may reasonably require verifying your identity. We will respond to your requests within a reasonable time and in accordance with the applicable data protection laws.

Cookies

A “cookie” is a small text file that is placed onto an Internet user’s web browser or device and is used to remember and/or obtain information about the user and a “web beacon” is a small object or image that is embedded into a web page, application, or email and is used to track activity, which are also sometimes referred to as pixels and tags.

We use the following cookies:

• Strictly necessary cookies. These are cookies that are required for the operation of Giftano’s Website. They include, for example, cookies that enable you to log into the Giftano Website.
• Analytical/performance cookies. They allow us to recognise and count the number of visitors and to see how visitors move around Giftano Website when they are using it. They also enable us to see how users use the Giftano Website. This helps us to improve the way our Website works.
• Functionality cookies. These are used to recognize you when you return to Giftano Website. This enables us to personalize our content for you, greet you by name and remember your preferences (for example, your choice of language or region).
• Targeting cookies. These cookies record your visit to Giftano Websites, the pages you have visited and the links you have followed. We will use this information to make the website and the advertising displayed on it more relevant to your interests. By accessing Giftano's Website, you accept our use of the cookies. You can block cookies by activating the setting on your browser that allows you to refuse the setting of all or some cookies. However, if you use your browser settings to block all cookies (including essential cookies) you may not be able to access all or parts of our Website.

For more detailed information about cookies and how they can be managed and deleted, please visit allaboutcookies.org.

Changes to the Privacy Statement

This privacy statement is in effect as of the date noted at the top of the statement. We may change our privacy statement from time to time. Any changes we may make to our privacy statement in the future will be posted on this page and, where appropriate, notified to you by e-mail.

Please check back frequently to see any updates or changes to our privacy statement. By continuing to use Giftano’s Website or continuing to allow us to retain or process your personal data following any such changes to our privacy statement, you are deemed to have accepted such changes unless you expressly notify us otherwise in writing (except to the extent we are required to make such changes in accordance with applicable law).

Where we need to seek updated, additional or different consents from you, we will, of course, do so.

Queries, Comments, Requests & Complaints

If you have any questions, comments, requests or complaints about our collection, use or disclosure of personal data, or regarding this privacy statement, please contact us using the details in the CONTACT US section. Please also contact us if you would like to update or amend any of your personal data which you have provided to us or if you believe our records relating to your personal data are incorrect. When contacting us please provide as much detail as possible in relation to your question, comment, request or complaint. We would like to reassure you that we will take any privacy complaint seriously and such complaint will be assessed by an appropriate person with the aim of resolving any issue in a timely and efficient manner. We request that you cooperate with us during this process and provide us with any relevant information that we may need (for example, your name and valid contact details, as well as proof of identity such as a scanned copy of your photo ID or details about your transactions with us). If we cannot reasonably satisfy ourselves of your identity, we may not be able to deal with your query, comment, request or complaint.

Contact Us

Giftano Pte Ltd - Office 1 Geroge Street, Level 10 Singapore 049145

Name of DPO- Anton Email: [email protected]

Languages

This privacy statement is published in the English Language (English Version) and in such other languages as set out below. In the event of any inconsistency in the terms of the privacy statement between the English Version and the other relevant versions, the terms of the privacy statement in the English Version shall prevail to the extent of such inconsistency.