Privacy Policy

BIRU SG

birusg.com

PRIVACY POLICY

Effective Date: 20 April 2026

Compliant with the Personal Data Protection Act 2012 (PDPA) of Singapore

1. Introduction

Biru SG ("we", "us", "our") is committed to protecting your personal data and your right to privacy. This Privacy Policy explains how we collect, use, disclose, store, and protect personal data obtained through our website birusg.com, our WhatsApp communications, contact forms, and email correspondence.

This Policy is made in compliance with the Personal Data Protection Act 2012 (No. 26 of 2012) of Singapore ("PDPA") and all subsidiary regulations and advisory guidelines issued by the Personal Data Protection Commission ("PDPC") thereunder.

By submitting personal data to us through any of our communication channels, you consent to the collection, use, and disclosure of your personal data as described in this Policy.

2. Who We Are

Biru SG is the data controller responsible for personal data collected through birusg.com. We have designated a Data Protection Officer ("DPO") whose contact details are set out in Section 12 of this Policy.

3. Personal Data We Collect

We collect personal data through three channels: our website contact form, WhatsApp, and email. The types of data we collect from each are as follows.

3.1 Contact Form (Website)

•       Full name

•       Email address

•       Phone number

•       Subject and content of your enquiry

•       Any other information you voluntarily provide

3.2 WhatsApp

•       WhatsApp display name and profile photo (where visible)

•       Phone number associated with your WhatsApp account

•       Content of messages and any files or media shared

•       Timestamps of communications

3.3 Email

•       Email address

•       Name (if included in your message or signature)

•       Content of email correspondence

•       Email metadata (e.g., timestamps)

3.4 Automatically Collected Data (Website)

•       IP address

•       Browser type, version, and operating system

•       Pages visited and time spent on the Website

•       Referring URLs and click paths

•       Cookie and session data (see Section 9)

4. Purposes of Collection and Use

We collect and use your personal data for the following purposes:

•       To respond to your enquiries, requests, and feedback;

•       To provide, fulfil, and manage our products and services;

•       To communicate with you about our services, promotions, and updates (where you have consented);

•       To improve and maintain the Website and our services;

•       To comply with our legal and regulatory obligations under Singapore law;

•       To maintain records required for business, legal, and accounting purposes;

•       To protect the security and integrity of the Website and our systems;

•       To enforce our Terms of Use and other legal rights;

•       For any other purpose for which you have given your consent.

We will not use your personal data for a purpose that is incompatible with the purpose for which it was collected without first obtaining your consent.

5. Legal Basis for Processing

Under the PDPA, we process your personal data on the following bases:

•       Consent: Where you have expressly consented to the collection, use, or disclosure of your personal data;

•       Contractual necessity: Where processing is necessary to perform a contract with you or to take steps you have requested before entering into a contract;

•       Legal obligation: Where we are required to process your data to comply with a legal obligation under Singapore law;

•    Legitimate interests: Where processing is necessary for our legitimate business purposes, provided such interests are not overridden by your data protection rights.

6. Disclosure to Third Parties

We do not sell, trade, or transfer your personal data to third parties for their marketing purposes. We may disclose your personal data only in the following circumstances:

•       Service providers: To third-party vendors and service providers engaged to support our business operations (e.g., web hosting, IT services, analytics), subject to appropriate data protection agreements;

•       Legal requirements: Where required by Singapore law, court order, or lawful request by a government authority, including the PDPC;

•       Protection of rights: Where reasonably necessary to protect the rights, property, or safety of Biru SG, our users, or the public;

•       Business transfers: In connection with a merger, acquisition, or sale of assets, where your data may be transferred as part of that transaction with appropriate notice given to you.

Any third-party service providers who receive your personal data are required to handle it in accordance with the PDPA and our data protection requirements.

7. WhatsApp Communications

When you contact us via WhatsApp, please note the following:

•       WhatsApp is operated by WhatsApp LLC (a Meta company). Your use of WhatsApp is subject to WhatsApp’s own Terms of Service and Privacy Policy, which are separate from this Policy;

•       We retain records of WhatsApp conversations that are relevant to your enquiry or transaction;

•       WhatsApp provides end-to-end encryption for message content in transit; however, once received, messages are accessible on both parties’ devices;

•       You should exercise caution when sending sensitive personal or financial data via any messaging platform;

•       All personal data we receive through WhatsApp is handled in accordance with this Privacy Policy and the PDPA.

8. Data Retention

We retain personal data only for as long as is necessary for the purposes for which it was collected or as required by Singapore law. Our standard retention periods are as follows:

•       Enquiry and contact form data: Up to 3 years from the date of last contact;

•       WhatsApp and email correspondence: Up to 3 years from the last communication;

•       Transaction and contractual records: 7 years, in accordance with the Companies Act 1967 and tax obligations;

•       Website analytics data: Up to 2 years.

When personal data is no longer required, we will securely delete or anonymise it in accordance with our internal data disposal procedures.

9. Cookies

Our Website may use cookies and similar tracking technologies. Cookies are small text files placed on your device when you visit a website. We may use:

•       Essential cookies: Required for the Website to function;

•       Analytics cookies: To understand how visitors use the Website (e.g., Google Analytics);

•       Preference cookies: To remember your settings across visits.

You may manage or disable cookies through your browser settings. Disabling certain cookies may affect the functionality of the Website. By continuing to use our Website, you consent to our use of cookies as described above.

10. Data Security

We implement appropriate technical and organisational measures to protect your personal data from unauthorised access, disclosure, alteration, loss, or destruction, in accordance with Section 24 of the PDPA. Our security measures include:

•       Transport Layer Security (TLS/SSL) encryption for all data transmitted via the Website;

•       Access controls and role-based permissions restricting data access to authorised personnel only;

•       Regular security assessments and system monitoring;

•       Staff training on PDPA obligations and data handling procedures;

•       Secure storage and access management for systems containing personal data.

In the event of a data breach that is notifiable under Part VIA of the PDPA (i.e., one that is likely to result in significant harm or affects 500 or more individuals), we will notify the PDPC and affected individuals as required by law as soon as practicable. We will also take prompt steps to contain and remediate the breach.

While we apply all reasonable security measures, no internet-based system is completely secure. We cannot guarantee the absolute security of data transmitted to us electronically.

11. Your Rights Under the PDPA

As a data subject under the PDPA, you have the following rights:

11.1 Right of Access

You may request access to the personal data we hold about you and information about how it has been used or disclosed within the past year. We will respond within 30 days, subject to applicable PDPA exemptions.

11.2 Right of Correction

You may request that we correct any personal data that is inaccurate, incomplete, or misleading. Where we are unable to make the requested correction, we will provide reasons and, where applicable, record a note of the correction requested.

11.3 Right to Withdraw Consent

You may withdraw consent to our collection, use, or disclosure of your personal data at any time by contacting us. Please note that withdrawal of consent may affect our ability to continue providing you with our services. Withdrawal will not affect the lawfulness of any processing carried out before the withdrawal.

11.4 Right to Data Portability

Where applicable under the PDPA, you may request that we transmit your personal data to another organisation in a structured, commonly used, machine-readable format.

11.5 Right to Lodge a Complaint

If you believe we have not complied with the PDPA, you may lodge a complaint with the Personal Data Protection Commission of Singapore at www.pdpc.gov.sg.

To exercise any of the above rights, please contact us in writing using the details in Section 12. We may require you to verify your identity before processing your request.

12. Data Protection Officer & Contact

For all enquiries, requests, or complaints relating to this Privacy Policy or our handling of your personal data, please contact our Data Protection Officer:

Organisation: Biru SG

Website: birusg.com

Contact Form: Available at birusg.com

WhatsApp: Available through the Website

Email: Available through the Website contact form

We will endeavour to respond to all requests within 30 days. Complex requests may take longer, and we will notify you accordingly.

13. International Data Transfers

Where personal data is transferred outside Singapore, we ensure that the transfer complies with the PDPA, including by putting in place appropriate safeguards to ensure the recipient provides a comparable level of data protection. Please note that WhatsApp may process your data on servers located outside Singapore, subject to WhatsApp LLC’s own data transfer mechanisms.

14. Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal obligations, or for other operational reasons. We will indicate the revised effective date at the top of this page. For material changes, we will take reasonable steps to notify you, such as posting a prominent notice on the Website. Your continued use of the Website following any update constitutes your acceptance of the revised Policy.

birusg.com  —  Privacy Policy  —  Last Updated: 20 April 2026

Governed by the Laws of the Republic of Singapore