Privacy policy (PDPA)
Effective 7 Dec 2026- We only collect what we need to deliver your order and help you.
- We never sell your data.
- Card details are handled by Stripe. We never see or store them.
- Marketing emails only if you said yes. Unsubscribe any time.
Contents (9 sections)
1. What we collect
When you order: your name, email, mobile number and delivery address. If you create an account: your password (stored encrypted) and saved addresses.
When you browse: pages viewed and items added to cart, using cookies, only if you accept them.
2. How we use it
To process and deliver your order, send order and delivery updates, handle returns and warranty claims, and answer your questions.
To prevent fraud and keep the site secure. We use our payment provider Stripe’s fraud checks for this.
3. Marketing and your consent
We only send marketing emails, such as deals and new arrivals, if you tick the box to agree. The box is never ticked for you. Every marketing email has an Unsubscribe link, and you can also email us to stop.
Order and delivery emails are not marketing, so they still arrive. Price-drop and back-in-stock alerts you set yourself are separate: each one sends once, and you can remove it any time.
4. Who we share it with
Only with companies that help us run your order, and only what they need: delivery partners and suppliers’ couriers (name, address, mobile), Stripe for payments, our email provider for order emails, and the brand or its service centre when you make a warranty claim.
We never sell your data. We may also share it where the law requires us to.
5. Payments and cards
Card payments go through Stripe. We never see or store your full card number. Saved cards are stored by Stripe, and you can delete them any time. PayNow and GrabPay payments are handled by your bank or Grab.
6. Cookies and analytics
Essential cookies keep your cart and sign-in working. With your permission, we use analytics cookies (such as Google Analytics) to see how the site is used, so we can improve it. You can change your choice any time in your browser settings.
7. How long we keep it
Order records are kept for as long as the law requires for tax and accounting, usually 5 years. Account details are kept until you close your account. If you withdraw consent, we stop using your data for that purpose.
8. Your rights
Under Singapore’s Personal Data Protection Act (PDPA), you can ask to see the personal data we hold about you, ask us to correct it, and withdraw your consent for us to use it. We may need to check your identity first.
9. Contact our data protection officer
Our data protection officer is Deepti. To see, correct or delete your data, or withdraw consent, email deepti@xps.limited. We reply within 10 working days.