Privacy Policy (Singapore)

1. Introduction and Definitions

Ctrl Collectibles Pte. Ltd. ("Ctrl Collectibles," "we," "our," or "us") respects your privacy and is committed to protecting your Personal Data (as defined below). This Privacy Policy explains how we collect, use, disclose, retain, and safeguard your Personal Data when you use our website (www.ctrlcollectibles.sg), platform, and services (together, the "Platform").

By using the Platform, you agree to the terms of this Privacy Policy.

Definitions:

• User: Any individual who accesses or uses the Platform.
• Buyer: A User who purchases items through the Platform.
• Seller: A User who offers items for sale through the Platform.
• Personal Data: Has the meaning set forth in the Personal Data Protection Act 2012 of Singapore ("PDPA"). This refers to data, whether true or not, about an individual who can be identified (i) from that data; or (ii) from that data and other information to which Ctrl Collectibles has or is likely to have access. Personal Data includes, for example, your name, contact details, identification documents, payment and transaction information, account details, and information relating to your use of the Platform.

2. Personal Data We Collect

We may collect and process different types of Personal Data, including:

• Account Data: Your name, email address, contact details, username, and password.
• Transaction Data: Payment information, purchase and sales history, billing and shipping addresses.
• Verification Data: Identification documents (e.g., passport, NRIC, or equivalent), and proof of address, where required for compliance (e.g., anti-money laundering, fraud prevention, or age verification).
• Usage Data: Information about how you use the Platform, including your IP address, device and browser type, operating system, and activity on the Platform.

3. How We Use Your Personal Data

We collect and use your Personal Data for purposes that are necessary to operate and improve the Platform, provide our services, and meet our legal obligations. We may use your Personal Data to:

• Provide, operate and maintain the Platform: Create and manage your account, facilitate transactions, arrange delivery of items, and provide customer support.
• Verify identity and compliance: Confirm the identity of Users and items, conduct age or identity checks where required, and comply with legal, regulatory, and compliance obligations (including anti-money laundering and fraud prevention).
• Process payments and transactions: Enable secure payments, issue refunds, administer payouts to Sellers, and maintain accurate financial and accounting records.
• Communicate with you: Send service-related notifications such as confirmations, updates, and security alerts; respond to your questions; and inform you of important changes to our terms or policies.
• Maintain security and integrity: Detect, investigate, and prevent fraud, misuse, or security incidents, and safeguard the rights, safety, and security of our Users and the Platform.
• Conduct analytics and improvements: Analyse how Users interact with the Platform, monitor performance, resolve issues, and develop new features and services.
• Send marketing communications (with consent): Provide you with promotional messages, newsletters, or special offers, including from selected partners, only where you have given consent. You may withdraw your consent or opt out at any time by updating your account preferences or unsubscribing from such communications.

We will not use your Personal Data for purposes unrelated to those described above without first informing you and obtaining your consent, unless required or permitted by law.

[3A. Automated Processing

We may use automated tools, for example fraud detection and identity verification systems, to help protect the Platform and its Users. These tools work alongside human review and are not intended to be the only factor in decisions that have legal or significant effects on you.]

4. Disclosure of Your Personal Data

We may disclose your Personal Data to the following parties where necessary to operate the Platform, fulfil transactions, comply with our legal obligations, or protect the rights and interests of our Users:

• Service Providers: Third-party vendors who support our operations, such as payment processors, logistics and shipping providers, IT service providers, and cloud hosting providers. These parties are required to protect Personal Data with appropriate safeguards.
• Business Partners: Partners who assist in facilitating transactions or enhancing our services, which may include:
  • Vaulting and storage partners for the safe storage of physical items.
  • Insurance providers for coverage during shipment or storage.
• Authorities: Government, regulatory, administrative, tax, or law enforcement agencies when disclosure is required by law, regulation, or court order. We may also disclose Personal Data, where permitted by law, to enforce our rights, protect the safety and security of the Platform or its Users, or prevent fraud and other unlawful activity.
• Other Users: Limited details, such as your first name or initials, may be shared with other Users to enable transactions on the Platform.

We do not sell or rent your Personal Data to third parties.

[4A. Third-Party Links

The Platform may contain links to third-party websites or services. We are not responsible for the privacy practices or content of such third parties, and we encourage you to review their policies before providing them with your Personal Data.]

5. Data Security

We take commercially reasonable technical, administrative, and organisational measures to ensure the secure handling of your Personal Data and to safeguard it against unauthorised access, collection, use, disclosure, modification, loss, or destruction. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security of your Personal Data.

Our security measures include, among others, access controls, encryption, network firewalls, and regular system monitoring. We also require our service providers and business partners who process Personal Data on our behalf to implement comparable safeguards.

In the event of a data breach that affects your Personal Data, Ctrl Collectibles will comply with our obligations under the PDPA and other applicable laws, which may include mandatory notifications to the Personal Data Protection Commission ("PDPC") and, where required, to affected individuals.

6. Data Retention

We retain your Personal Data only for as long as necessary to fulfil the purposes for which it was collected, or as required or permitted by law.

When Personal Data is no longer needed for these purposes, or retention is no longer required for legal, regulatory, tax, or business reasons, we will take appropriate steps to delete Personal Data in a secure manner or to anonymise it so that it can no longer be used to identify you.

Our retention periods may vary depending on the type of data, the nature of the transactions involved, and our legal and operational obligations. For example, financial and transaction records may be retained for at least five (5) years in accordance with Singapore legal requirements.

7. Your Rights

Under the PDPA, you have the following rights in relation to your Personal Data, subject to applicable legal and contractual restrictions:

• Access the Personal Data we hold about you and how it has been used or disclosed in the past twelve (12) months.
• Request correction of inaccurate or incomplete Personal Data.
• Withdraw consent for our collection, use, or disclosure of your Personal Data (subject to legal or contractual restrictions).
• Request deletion of Personal Data that is no longer needed, unless we are required to retain it by law or for business purposes.

Requests can be made by contacting us at support@ctrlcollectibles.com. We may need to verify your identity before responding. Please note that we may charge a reasonable fee to cover the cost of responding to access requests and will inform you of the fee before processing your request.

8. Cookies and Tracking

We use cookies and similar technologies to improve the Platform, enhance User experience, analyse usage, and deliver personalised content. Certain cookies are essential for the basic operation of the Platform and cannot be disabled. You may manage or disable non-essential cookies through your browser settings[, though some features of the Platform may not function properly if you do so].

9. International Data Transfers

We may transfer, store, or process your Personal Data outside Singapore to support operation of the Platform and provide our services. When we do so, we will ensure that your Personal Data is protected by safeguards that provide a standard of protection comparable to that under the PDPA, whether through contractual arrangements or other legally enforceable means.

By using the Platform and providing us with your Personal Data, you consent to such transfers. We will take appropriate steps to ensure that your Personal Data remains secure and protected wherever it is processed.

9A. Jurisdictional Scope

The Platform is operated from Singapore and is primarily intended for Users in Asia. Your Personal Data will be handled in accordance with Singapore law, including the PDPA. Ctrl Collectibles does not represent or warrant that the Platform complies with the data protection laws of any jurisdiction outside Singapore. Users who access the Platform from other jurisdictions do so at their own initiative and risk and are responsible for ensuring compliance with local laws.

10. Children and Minors

The Platform is intended for individuals aged eighteen (18) and above. We do not knowingly collect Personal Data from anyone under this age. If we learn that we collected Personal Data from a minor without appropriate consent, we will delete or anonymise such data as soon as reasonably practicable.

11. Changes to This Policy

We may update this Privacy Policy from time to time. The latest version will always be posted on the Platform with the effective date indicated at the top. Your continued use of the Platform after such updates constitutes your acknowledgement and acceptance of the revised Privacy Policy.

12. Contact

If you have any questions about this Privacy Policy or our data protection practices, please contact us at:

Email: support@ctrlcollectibles.com

You may also contact our Data Protection Officer (DPO) at the same email address with any questions, requests, or complaints relating to your Personal Data.