Privacy Policy

Effective Date: [5 July 2025]

Company: GALAX PLAN LIMITED

This Privacy Policy sets out how GALAX PLAN LIMITED (hereinafter referred to as “we”, “us” or “our”) collects, uses, stores, discloses and protects the personal data of users (hereinafter referred to as “you” or “User”) when you access and use our e-commerce platform, website, mobile application and related services (collectively the “Platform”).

By registering an account, browsing, purchasing products or continuing to use our services, you acknowledge that you have read, understood and unconditionally agreed to all terms of this Privacy Policy. If you do not agree with any part of this Policy, please stop using our Platform immediately.

1. Personal Data We Collect

We only collect necessary personal data reasonably required for providing e-commerce services.

1.1 Information You Voluntarily Provide

Account registration information: your name, mobile phone number, email address, login password and profile settings.
Transaction information: consignee name, delivery address, contact number, order records and billing information.
Profile information: avatar, gender, date of birth, shopping preferences and other content you actively fill in.
Customer service communication: messages, feedback, enquiry content and contact information when you communicate with our support team.

1.2 Information Automatically Collected

Device information: device model, operating system, unique device ID, IP address, browser type, network operator and device configuration.
Log data: access time, browsing pages, search records, click records, page stay time, system operation logs and crash logs.
Location information: with your permission, we may collect your approximate or precise location for delivery arrangement and location-based recommendation; we will not collect location data if you decline the permission.

1.3 Sensitive Personal Data

We will not intentionally collect your sensitive personal data including race, religion, health information, biometric data or political opinions. If it is necessary to collect sensitive data under special business scenarios, we will obtain your explicit consent in advance and only use it for specified legitimate purposes.

1.4 Non-Personal Data

We may collect anonymous, aggregated and de-identified data which cannot identify any individual. Such non-personal data may be used and analysed freely for business operation, market analysis and service optimisation.

2. How We Use Your Personal Data

We comply with the Personal Data Protection Act (PDPA) of Singapore and applicable laws and regulations. We use your personal data for the following purposes:

To register, maintain, manage and verify your account;
To process orders, complete payment, arrange logistics delivery and provide after-sales service;
To send order notifications, logistics updates, payment reminders and after-sales arrangement messages;
To optimise page display, recommend products and personalise your shopping experience;
With your consent, to send promotional offers, new product information and marketing activities via email, SMS or in-app notification. You may unsubscribe at any time;
To ensure platform security, prevent fraud, illegal transactions, malicious attacks and protect the legitimate rights and interests of users and our company;
To conduct internal data analysis, statistics and business optimisation to improve service quality;
To comply with legal obligations, regulatory requirements, judicial procedures and government official investigations.

We will not use your personal data for any purpose unrelated to the original collection purpose, unless we obtain your additional consent or are required by law.

3. Sharing, Transfer and Disclosure of Personal Data

We will not sell, trade or rent your personal data to any third party without your explicit consent.

3.1 Allowed Sharing

With your explicit authorisation and consent;
Necessary service partners: we may share your necessary data with logistics providers, payment institutions, cloud service providers, technical support vendors and customer service outsourced agencies, solely for the performance of e-commerce services. All third parties shall sign confidentiality agreements and strictly protect your personal data.

3.2 Business Transfer

In the event of merger, acquisition, asset transfer or liquidation, your personal data may be transferred as part of business assets. We will notify you in advance and ensure the transferee adopts the same protection standards as this Privacy Policy.

3.3 Legal Disclosure

We may disclose your personal data if required by law, court order, governmental regulatory request, or when necessary to protect public safety, legal rights and interests, and prevent illegal conduct.

3.4 Non-Personal Data

We may share anonymous and aggregated non-personal data freely without further notice.

4. Data Storage and Security

4.1 Storage Location

Your personal data may be stored in data centres located in Singapore and other jurisdictions with adequate data protection standards.

4.2 Retention Period

We retain your personal data only for the shortest period necessary to fulfil the collection purpose, unless laws require longer retention:

Account data: retained until you cancel or delete your account;
Transaction and order data: retained for 7 years for tax, compliance and legal purposes;
Operation and log data: retained for 1 year generally;
Marketing related data: retained until you unsubscribe or withdraw consent.

4.3 Security Protection

We adopt industry-standard technical and administrative measures to protect your personal data against unauthorised access, disclosure, tampering and destruction:

Adopt HTTPS encrypted transmission, encrypted storage for sensitive data, firewall and intrusion detection system;
Establish internal access permission control, operation log audit and employee confidentiality obligations;
Conduct regular security assessment, system maintenance and vulnerability repair;
Establish a data breach emergency response mechanism. Once any data security incident occurs, we will take remedial measures promptly and notify relevant users and regulators in accordance with legal requirements.

You acknowledge that internet data transmission cannot guarantee absolute security. You shall bear the network information risk under reasonable circumstances.

5. Your Rights

In accordance with Singapore PDPA and applicable laws, you have the following rights:

Right of Access: to request access and obtain a copy of your personal data we hold;
Right of Rectification: to require us to correct inaccurate or incomplete personal data;
Right of Erasure: to request deletion of your personal data, except for data we are legally obligated to retain;
Right to Restrict Processing: to restrict our processing of your personal data under legal conditions;
Right of Data Portability: to obtain your personal data in a machine-readable format or request transfer to a third party;
Right to Object: to object to marketing messages or certain data processing based on legitimate interests;
Right to Withdraw Consent: you may withdraw your consent at any time, without affecting the lawfulness of processing conducted before withdrawal;
Right to Complaint: you may lodge a complaint to the Personal Data Protection Commission (PDPC) of Singapore or relevant regulatory authorities if you believe we violate data protection laws.

You may exercise your rights via account privacy settings on the Platform or contact us through the contact information below. We will respond within a reasonable time after verifying your identity.

6. Minors Protection

Our Platform is intended for users aged 18 and above. If you are under 18 years old, please use our services under the supervision and consent of your legal guardian.

We do not knowingly collect personal data from minors. If a guardian finds that we have obtained minor’s personal data without consent, please contact us immediately, and we will delete the relevant information as soon as possible.

7. Cross-Border Data Transfer

Your personal data may be transferred to and stored in countries outside Singapore for service operation, technical support and data storage.

We will ensure cross-border data transfer complies with PDPA and relevant legal requirements, adopt appropriate protection measures such as standard contractual clauses and user consent to protect your personal data security.

8. Policy Updates

We reserve the right to update and revise this Privacy Policy from time to time. The updated Policy will be published on the Platform and take effect upon publication.

For material changes affecting your rights, we will post prominent notices on the Platform in advance. Your continued use of the Platform after the effective date constitutes acceptance of the updated Privacy Policy.

9. Contact Us

If you have any questions, suggestions or requests regarding this Privacy Policy or personal data protection, please contact us:

Company Name: GALAX PLAN LIMITED

We will respond to your enquiry within 15 working days.

GALAX PLAN LIMITED

End of Privacy Policy