**Privacy Policy**
Last updated: 7 August 2026
This policy explains how Cardboard Collective Pte. Ltd. (UEN 202635416D) ("Cardboard Collective", "we", "us") collects, uses and discloses personal data, in line with Singapore's Personal Data Protection Act 2012 (PDPA).
**1. What we collect**
- **Account and contact details:** name, email address, mobile number.
- **Order details:** delivery address, items ordered, order history, and the payment reference or confirmation associated with your payment.
- **Communications:** messages you send us by email, WhatsApp or social media, and our replies.
- **Site data:** basic technical and usage information collected by our website platform, including cookies used to keep you logged in and to remember your cart.
We do not collect or store full card or bank account numbers. Payments are processed by our payment provider or made by direct transfer to our account.
**2. Why we use it**
- To take, verify, fulfil and deliver your orders, and to handle returns and refunds.
- To verify your identity at login, and to enforce per-customer purchase limits.
- To contact you about an order or an enquiry.
- To keep proper business, accounting and tax records.
- To send you marketing about products, drops and promotions — **only if you have opted in**. You can withdraw that consent at any time (see clause 6).
**3. Who we share it with**
We share personal data only where it is needed to run the business:
- **Delivery partners**, to deliver your order (name, address, mobile number).
- **Our e-commerce platform and payment provider**, to operate the store and process payments.
- **Our professional advisers** — for example accountants — where required.
- **Authorities**, where we are required by law to disclose.
We do not sell personal data.
Some of these service providers store data outside Singapore. Where that happens, we take reasonable steps to ensure the data receives a standard of protection comparable to the PDPA.
**4. How long we keep it**
We keep order and transaction records for as long as needed for the purpose collected, and for at least 5 years where tax and accounting law requires it. Account and marketing data is kept until you ask us to remove it, subject to those record-keeping obligations.
**5. Protecting it**
We restrict access to personal data to the people who need it to do their job, use access-controlled accounts and platforms, and take reasonable measures to prevent unauthorised access, loss or disclosure.
**6. Your choices and rights**
Under the PDPA you may:
- **Access** the personal data we hold about you, and ask how it has been used;
- **Correct** anything inaccurate or incomplete;
- **Withdraw consent** to any use of your data, including marketing.
Email contact@cardboard.sg and we will respond within a reasonable time. Withdrawing consent to essential processing may mean we can no longer fulfil your orders.
You can unsubscribe from marketing at any time using the link in any marketing email, or by messaging us.
**7. Do Not Call**
If you give us your Singapore mobile number, we will send you order-related messages, as these are necessary to complete your transaction. We will only send you marketing messages if you have given us clear consent to do so.
**8. Cookies**
Our site uses cookies to keep you signed in, remember your cart, and understand how the site is used. You can block cookies in your browser, but parts of the site may stop working.
**9. Data Protection Officer**
Our Data Protection Officer can be contacted at contact@cardboard.sg, or by post at Cardboard Collective Pte. Ltd., 160 Robinson Road, #14-04, Singapore Business Federation Center, Singapore 068914.
**10. Changes**
We may update this policy. The current version is always the one on this page.