Privacy Policy

Kaimaar is an online marketplace at kaimaar.com (the “Platform”) where independent Singapore creators sell handmade and designed goods to buyers. It is operated by KAIMAAR PTE. LTD. (UEN 202638990C), a company incorporated in Singapore (“Kaimaar”, “we”, “us” or “our”).

This Privacy Policy explains how we collect, use, disclose and protect personal data in line with the Personal Data Protection Act 2012 of Singapore (“PDPA”). “Personal data” means data, true or not, about an individual who can be identified from that data, alone or with other information we have.

This policy applies to everyone who uses the Platform: buyers, creators and their staff, and visitors who browse without an account (together “you”). Where a section applies to only one group, it says so.

This policy supplements, and does not replace, any other notice or consent you give us, such as our Terms of Use or Creator Agreement. By using the Platform or giving us your personal data, you agree to this policy. If you do not agree, please do not use the Platform.

We collect only the personal data we need to run the Platform. Depending on how you use it, this may include:

We do not ask for sensitive data such as health, religion or financial account numbers, and we ask you not to send it to us or to creators through the Platform.

Some fields are optional. If you do not provide required fields, we may be unable to create your account, complete an order or pay out to a creator.

If you give us personal data about someone else, such as a gift recipient’s name and address, you confirm that you are entitled to share it with us for delivery.

We collect personal data when you:

• create an account, place an order or apply to sell on the Platform;
• contact us, message a creator or buyer, leave a review or answer a survey;
• sign up for our newsletter, promotions or events;
• sign in using a third-party service such as Google or Apple, in which case we receive the details that service shares with your permission; and
• browse the Platform, through cookies and similar technologies (see Section 8).

We may also receive personal data from our partners, such as delivery status from couriers, payment and payout results from Stripe, and fraud signals from our service providers.

We collect, use and disclose personal data for the following purposes:

• creating and managing your account, and verifying who you are;
• processing orders and payments, arranging delivery through our couriers, and handling returns, refunds and disputes;
• onboarding, reviewing and paying out to creators, and checking that listings meet our marketplace rules;
• sending you order confirmations, delivery updates and important service notices;
• responding to questions, complaints and support requests;
• detecting and preventing fraud, abuse and security incidents;
• understanding how the Platform is used so we can improve it, including analytics and research;
• sending marketing about Kaimaar and our creators, where you have agreed to it (see Section 9); and
• meeting our legal, tax, accounting and regulatory obligations, and enforcing our terms.

We will not use your personal data for a new purpose without telling you first and, where the PDPA requires it, getting your consent.

We rely on your consent to collect, use and disclose your personal data, unless the PDPA allows us to do so without consent. You may give consent expressly (for example, by ticking a box), or be deemed to consent where you voluntarily provide data for a purpose, where it is needed to fulfil a contract with you, or where we have notified you of a purpose and you have not opted out.

In limited cases the PDPA permits us to use personal data without consent, such as for our legitimate interests (for example, fraud prevention) or to improve our services, after assessing that the benefit outweighs any adverse effect on you.

You may withdraw your consent at any time by writing to our Data Protection Officer (Section 17). We will act on your request within a reasonable time, generally within 10 business days, and tell you what the consequences will be. For example, if you withdraw consent to delivery data being used, we will not be able to deliver your order.

Withdrawing consent does not affect our right to keep and use personal data where the law requires or permits it, such as keeping transaction records for tax purposes.

We do not sell your personal data. We share it only as needed for the purposes in Section 4, with:

Our service providers process personal data only on our instructions and under contracts that require them to protect it. Stripe, Lalamove and SingPost also handle personal data under their own privacy policies, which we encourage you to read.

Reviews, shop profiles and other content you post publicly on the Platform can be seen by anyone.

We host the Platform on Amazon Web Services in Singapore. Some of our service providers, including payment and analytics providers, may store or process personal data outside Singapore, for example in the United States (for example, Stripe, Google and Mailchimp).

When we transfer personal data overseas, we take steps required by the PDPA to make sure it receives a standard of protection comparable to the PDPA. These include contracts with data protection clauses, or relying on recipients bound by binding corporate rules or recognised certifications such as APEC CBPR.

Cookies are small files stored on your device. We and our partners use cookies, pixels and similar technologies for these purposes:

• Essential: keeping you signed in, remembering your cart and securing checkout. The Platform cannot work without these.
• Analytics: understanding which pages are visited and how the Platform performs, using Google Analytics.

You can manage or block non-essential cookies through your browser’s settings. You can also block Google Analytics with Google’s opt-out browser add-on. Blocking essential cookies may stop parts of the Platform from working.

We send marketing emails, SMS or messaging-app messages only if you have opted in. You can unsubscribe at any time using the link in any email, by replying STOP to an SMS where offered, or by updating your account settings.

We will not send marketing messages by voice call, SMS or fax to a Singapore telephone number listed on the Do Not Call Registry unless you have given us clear and unambiguous consent, as required by Part 9 of the PDPA.

Even if you opt out of marketing, we will still send you messages about your orders, account, payouts and changes to our terms, as these are part of the service.

We make reasonable security arrangements to protect personal data from unauthorised access, collection, use, disclosure, copying, modification or disposal. These include encryption in transit, access controls limited to staff who need the data, and not storing full card details on our systems.

No method of transmission or storage is completely secure. Please keep your password private, use a strong unique password, and tell us immediately if you think your account has been compromised.

If a data breach occurs, we will assess it promptly. Where it is notifiable under the PDPA, we will notify the Personal Data Protection Commission within 3 calendar days of that assessment, and notify affected individuals as soon as practicable.

We keep personal data only as long as it serves the purposes it was collected for, or as long as the law requires. As a guide:

When we no longer need personal data, we delete it or anonymise it so it can no longer identify you.

You may ask us for a copy of the personal data we hold about you, and how it has been used or disclosed in the past year. You may also ask us to correct personal data that is wrong or incomplete. Much of your data can be updated directly in your account settings.

Send requests to our Data Protection Officer (Section 17). We may need to verify your identity before acting.

We will respond as soon as reasonably possible, and within 30 days. If we need longer, we will tell you within 30 days when we expect to respond. We may charge a reasonable fee for access requests and will tell you the amount before we proceed. Correction requests are free.

In some cases the PDPA allows or requires us to refuse a request, for example where it would reveal another person’s personal data. If so, we will explain why.

The Platform is intended for users aged 18 and above. Users aged 13 to 17 may use it only with the consent and supervision of a parent or guardian. We do not knowingly collect personal data from children under 13.

If you believe a child has given us personal data without appropriate consent, please contact our Data Protection Officer and we will take steps to delete it.

In line with the PDPC’s Advisory Guidelines on NRIC and other national identification numbers, we do not collect your NRIC, FIN, passport number or copies of these documents to use the Platform.

Where a creator’s identity must be verified to receive payouts, this is done directly by Stripe through Stripe Connect, under Stripe’s own obligations. We receive only the outcome of that check.

Creators are independent businesses. When a creator receives a buyer’s personal data through the Platform, the creator is responsible for handling it in line with the PDPA and our Creator Agreement.

Creators may use buyer personal data only to fulfil, support and resolve issues with the related order. Creators must not use it for their own marketing, share it with others, or keep it longer than needed, unless the buyer has separately agreed.

If you have a concern about how a creator has handled your personal data, please tell us and we will look into it.

The Platform may link to other websites, such as a creator’s own site or social media. We are not responsible for their privacy practices, so please read their policies.

We may update this policy from time to time. We will post the updated version on this page with a new “Last updated” date, and notify you by email or on the Platform if the changes are significant. Your continued use of the Platform after an update means you accept the revised policy, to the extent permitted by law.

This policy is governed by the laws of Singapore.