Privacy Policy

1. What We Collect

We collect the following types of personal data when you use our Platform:

• Account information: name, email address, phone number
• Order information: delivery address (including unit number, floor, and building), order history, payment records
• Merchant information: business name, contact number, food descriptions, pickup address, bank account details for payouts
• Location data: postal code and approximate location for merchant discovery and delivery purposes
• Technical data: IP address, browser type, device information, cookies
• Communications: messages sent through the Platform, customer support interactions

2. How We Use It

We use your personal data to:

• Process and fulfil your orders
• Create and manage your account
• Process payments and merchant payouts
• Send order updates and transactional notifications
• Display relevant merchants based on your location
• Improve the Platform and personalise your experience
• Comply with legal obligations and resolve disputes
• Send marketing communications (only with your consent)

3. Data Sharing

We do not sell your personal data. We share data only in the following circumstances:

• With merchants to fulfil your orders (e.g. your name and pickup or delivery details)
• With payment processors (Stripe) to process transactions securely
• With service providers who assist in operating the Platform (e.g. hosting, analytics, notifications)
• When required by law or to respond to legal processes

When we share delivery details with merchants for order fulfilment, only the information necessary to complete the delivery is disclosed.

4. Data Security

We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, loss, or misuse.

• Encryption at rest: Sensitive personal data, including phone numbers and unit numbers (floor, unit, and building details), are encrypted at rest using industry-standard encryption. This applies to both customer and merchant data.
• Encryption in transit: All data transmitted between your device and our servers is encrypted via TLS (HTTPS).
• Payment security: We do not store your full payment credentials on our servers. All payment processing is handled by our PCI DSS-compliant payment partner, Stripe.
• Access controls: Access to personal data is restricted to authorised personnel on a need-to-know basis.

5. Cookies

We use cookies and similar technologies to maintain your session, remember your preferences, and analyse Platform usage. Essential cookies are required for the Platform to function. Analytics cookies help us understand how the Platform is used. You can manage cookie preferences through your browser settings, though disabling essential cookies may affect Platform functionality.

6. Data Retention

We retain your personal data for as long as your account is active or as needed to provide services. Order records are retained for a minimum of five (5) years for accounting and legal compliance purposes. When data is no longer required, it is securely deleted or anonymised.

7. Your Rights Under the PDPA

Under the Personal Data Protection Act 2012, you have the right to:

• Access your personal data held by us
• Request correction of inaccurate or incomplete data
• Withdraw consent for marketing communications at any time
• Request deletion of your account and associated personal data

To exercise any of these rights, contact our Data Protection Officer at the email below. We will respond to your request within thirty (30) days.

8. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. We will notify you of material changes by posting the updated policy on the Platform with a revised "Last updated" date. Your continued use of the Platform after such changes constitutes acceptance of the updated policy.

9. Contact

If you have questions or concerns about this Privacy Policy or our data practices, please contact our Data Protection Officer at privacy@sidestop.sg.