PRIVACY POLICY

INK Parfum is an independent fragrance brand based in Singapore. We operate this website and decide how the personal data described in this policy is used, so we are responsible for it under Singapore’s Personal Data Protection Act 2012 (the “PDPA”).

All privacy questions, requests and complaints go to contact.inkparfum@gmail.com. We have not appointed a separate Data Protection Officer; privacy matters are handled by the person responsible for running the store, and requests sent to that address reach them.

This policy explains what personal data we collect through this website, why we collect it, who it is shared with, how it is protected, how long it is kept, and the choices and rights you have. It applies to visitors, customers and anyone who contacts us.

The current version and its effective date are shown at the top of this page. If we change this policy we will publish the new version with a new date; the version you acknowledged at checkout is recorded with your order, and a later version is not applied retrospectively to an earlier purchase.

When you check out, we collect your full name, contact number, email address and delivery address (street, building, unit number and postal code). We collect what the order needs to be produced, delivered and supported — nothing more.

If you create a fragrance, we record the notes you confirmed for the Top, Heart and Base layers, the bottle volume, and any bottle name you chose. These are saved with the order so that the fragrance can be produced correctly and so that we can identify what was supplied if you later raise a question about it.

We keep a record of what you ordered, the amount charged, any delivery charge, any coupon used, the payment method type, the order status and the dates of each step. This is our record of the transaction and is necessary to run the store and to meet legal and accounting obligations.

If you create an account, we hold your email address, your name as provided, and authentication data managed by our platform provider. If you sign in with Google, Google authenticates you and shares your email address and basic profile name with us. We do not receive your Google password.

Card details are entered on our payment provider’s own hosted payment page. We do not receive or store your full card number, security code or card expiry date. We do receive and keep a payment reference, the payment status, the amount and the payment method type, so that we can match a payment to an order and process refunds.

We record the delivery address, recipient name and contact number provided with an order, and the delivery status reported by the delivery partner. We share what the delivery partner needs to deliver your parcel.

If you use our contact form or email us, we receive your name, email address, the subject and the content of your message. Contact-form messages are delivered to our mailbox; they are not stored in this website’s database.

If you submit a review, we store the display name you give, your email address, the star rating, the review text and whether you are a verified buyer. Your email address is used to verify a purchase and is not published.

Our storefront shows an optional survey asking how you first discovered INK Parfum. If you answer it, we store the option you chose, any short detail you optionally add (such as a creator handle), the page you answered on, the time of submission, and a salted, hashed form of your IP address that we use only to limit repeated submissions. We do not store your name, email address or any other identifier with that answer, and declining the survey has no effect on your shopping experience.

When an order is placed, we record the IP address and browser user-agent string that submitted it, together with the time. This supports fraud prevention, dispute resolution and security investigations.

We do not ask for or collect your NRIC number, date of birth, financial account details, or health information. We do not store raw card details in our own database. Please do not send us sensitive personal data through the contact form or a bottle name.

Most of what we hold comes directly from you: at checkout, when you create a fragrance, when you create an account or sign in, when you write a review, when you answer the optional survey, and when you contact us.

A small amount is generated as you use the site — for example a bag identifier stored in your browser, the shipping destination used to price delivery, and the technical details recorded when an order is submitted.

Our payment provider tells us whether a payment was authorised and settled. Our platform provider processes authentication. If you choose Google sign-in, Google confirms your identity to us.

• to take, process and deliver your order, including producing a personalised fragrance;
• to confirm your identity as a customer and maintain your account, where you have one;
• to take payment and process refunds, and to keep an accurate transaction record;
• to provide delivery updates and respond to delivery problems;
• to answer your questions and handle returns, claims and goodwill requests;
• to publish reviews you choose to submit;
• to understand, in aggregate and without identifying you, how customers find us;
• to prevent and detect fraud and misuse of the site;
• to meet legal, tax and accounting obligations and to establish or defend legal claims;
• to improve our products, pages and checkout experience.

Where you have given consent — for example by submitting a review or answering the optional survey — we rely on that consent. Otherwise we use personal data because it is necessary to perform our contract with you (taking and delivering an order, handling a return), because we have a legitimate interest that is not overridden by your interests (keeping the store secure, preventing fraud, understanding which channels bring customers), or because the law requires it (transaction and accounting records).

We do not sell your personal data, and we do not share it for third-party advertising.

We ask for consent only where we need it, and we ask separately for each purpose that requires it. Agreeing to our Terms at checkout is not consent to marketing: the checkout acknowledgement concerns the terms of your purchase only, and no marketing box is pre-selected anywhere on the site.

You may withdraw your consent at any time by writing to contact.inkparfum@gmail.com. We will stop the processing that relied on it. Withdrawal does not affect processing carried out before the withdrawal, and it does not affect processing we carry out on another lawful basis — for example, we must still keep the transaction record of a completed order.

We do not currently make marketing calls or send marketing text messages. If we do in future, we will check the relevant Singapore Do Not Call registers and will honour any do-not-call instruction you give us directly.

The questionnaire behind Create a Scent is calculated in your browser in order to suggest notes. Your individual answers are not submitted to or stored on our servers. Only the notes you finally confirm — and any bottle name you enter — are saved, and only once they form part of an order or a bag you have built.

Your confirmed note selections and bottle name are kept with your order so that the fragrance can be produced correctly, and so that we can check the order against what was supplied if you contact us about it later. They are not used to build advertising profiles and are not shared beyond what is needed to make and deliver the order.

Items you add to your bag, including configured notes, are held against a bag identifier stored in your browser so that your bag survives a refresh. A bag that is never converted into an order expires automatically after 48 hours.

You can check out as a guest; an account is not required. If you create one, your email address and password are managed by our platform provider’s authentication service. Passwords are not visible to us. If you sign in with Google, Google authenticates you and passes us your email address and profile name.

A guest order is linked to the email address you provide so that we can send confirmations and handle any follow-up. It is not turned into an account without your action.

Write to contact.inkparfum@gmail.com to ask for an account to be closed. We will close it and delete the account data we are not required to keep, while retaining the transaction records of completed orders as described in section 15.

Card payments are processed by Stripe on its own hosted payment page. When you pay, you provide your card details directly to Stripe, which acts as an independent payment processor and handles that data under its own privacy terms. We receive confirmation of the result, the amount, the currency, the payment method type and a reference.

We do not receive your full card number, security code or expiry date, and we do not store them in this website’s database.

To deliver your order we share the recipient name, delivery address, contact number and what the parcel contains (so that it can be handled correctly) with our appointed delivery partner. We share only what is needed to complete the delivery.

Where the delivery partner provides tracking, we pass the tracking reference to you by email. Tracking events are generated and held by the delivery partner.

We send messages that are necessary to your order — an order confirmation, a payment receipt, a dispatch notice, a delivery problem, a refund confirmation, or a reply to something you asked us. These are not marketing messages and are sent because the order requires them.

A review you submit is published with the display name you choose. Your email address is used only to verify that you bought the product and is never published. Reviews are moderated before publication.

The survey is answered anonymously: we store the option chosen, any optional detail, the page and time, and a hashed form of your IP address used only for rate limiting. It is never combined with your order or account, and it is not used to contact you. Choosing “Not now” simply stops it being shown again for a period.

This site uses your browser’s local storage, not advertising cookies, for a few essential functions: keeping your bag between page loads, remembering the items on your wishlist, remembering that you have already answered or dismissed the optional survey, and holding your in-progress fragrance selection while you build it. This storage stays in your browser and can be cleared through your browser settings.

As at the effective date of this policy, we do not run third-party advertising pixels or third-party analytics trackers on this site. If we introduce analytics in future, we will update this policy first and, where consent is required, ask for it before any tracking runs.

We link to our Instagram and TikTok profiles. Those links take you to platforms we do not control, which collect data under their own privacy policies. Nothing from those platforms is embedded in this site.

If you choose “Continue with Google”, the sign-in is handled between your browser and Google. Google may set its own cookies for that process.

We do not currently operate a marketing mailing list and we do not send promotional email to customers who have not asked for it.

Any marketing opt-in we introduce will be separate from checkout, will never be pre-selected, and will not be a condition of buying anything. Every marketing message will carry a way to unsubscribe, and we will act on an unsubscribe request promptly.

• Our application platform provider — hosts this website, stores the database records described above, runs authentication, stores uploaded files and sends our transactional email. It processes data on our instructions.
• Our payment provider (Stripe) — processes card payments on its hosted page, takes payment and issues refunds, and handles the card data you enter there.
• Our appointed delivery partner — receives the recipient name, address, contact number and parcel contents needed to deliver an order.
• Our email provider — receives and stores messages sent to our contact address, including contact-form submissions.
• Google — only if you choose to sign in with Google, to authenticate you.

We may disclose personal data where we are required to by law or by a court or regulator, where it is necessary to establish, exercise or defend a legal claim, to investigate fraud or misuse, or to protect the rights and safety of our customers or our business. We may also disclose it to a professional adviser such as a lawyer or accountant under a duty of confidence.

We do not sell personal data, rent it, or trade it with third parties for their own marketing.

Our platform provider, payment provider and email provider operate global infrastructure, so personal data we hold may be stored or processed outside Singapore. Those providers publish their own data-location and sub-processor information.

Where personal data is transferred out of Singapore, the PDPA requires us to take steps to ensure it receives a standard of protection comparable to that provided under the PDPA. We rely on the contractual data-protection terms of the providers we use, and we remain responsible for the data we transfer to them.

We have described what we can verify. We do not publish a list of every provider sub-processor or storage region, because that information sits with those providers and changes; if you need it for a specific purpose, ask us at contact.inkparfum@gmail.com and we will obtain and share the current details.

Access to customer and order data is restricted to those who need it to run the store. Administrative access to the store backend is limited to authorised accounts. Card data never reaches our database because payments are taken on our provider’s hosted page. Data is transmitted over encrypted connections. These are reasonable safeguards appropriate to the size and nature of our business; no system can be guaranteed to be completely secure.

We keep personal data only for as long as we need it for the purpose it was collected for, or as long as the law requires. In practice: a bag that is never ordered expires after 48 hours; order, payment and delivery records are kept while the order may still give rise to a return, claim or legal obligation, and afterwards for as long as accounting and legal requirements apply; the optional survey answer is kept in anonymous form for reporting; and a contact message is kept only as long as needed to handle the enquiry and any follow-up.

When data is no longer needed, we delete it or anonymise it. Where we cannot delete a record immediately — for example because a legal retention obligation applies to a transaction — we will tell you why when you ask us to delete it.

You may ask us for a copy of the personal data we hold about you, and information about how it has been used and disclosed over the past year. You may also ask us to correct an error in it. Write to contact.inkparfum@gmail.com and tell us what you need; we may ask you to verify your identity so that we do not disclose your data to someone else. We will respond within the time the PDPA allows, and we may charge a reasonable fee for an access request where the law permits.

You may withdraw consent, ask us to stop using your data for a particular purpose, or ask us to delete data we no longer need. Sections 5 and 15 explain how those requests work and the limited situations in which we must keep a record.

If you are unhappy with how we have handled your personal data, please tell us first at contact.inkparfum@gmail.com so that we can try to put it right. You also have the right to complain to the Personal Data Protection Commission of Singapore.

If we become aware of a data breach that is likely to result in significant harm to affected individuals, or that is of a significant scale, we will assess it, contain it, and notify the Personal Data Protection Commission and affected individuals where the PDPA requires us to do so.

We may update this policy to reflect a change in our practices or in the law. The current version and effective date are shown at the top of this page, and earlier versions are available on request.