Privacy Policy

This Privacy Policy explains how BrewSpark Pte. Ltd. ("BrewSpark", "we", "us" or "our"), UEN 202531628H, with its registered business address at 247 East Coast Road, #01-04, Singapore 428940, collects, uses, discloses and protects personal data when you visit brewspark.life, contact us, visit our salon or otherwise interact with our services. We are committed to complying with the Personal Data Protection Act 2012 of Singapore ("PDPA") and applicable subsidiary legislation.

1. Scope and acceptance

This Policy applies to personal data processed through our website, contact forms, email and telephone communications, in-salon transactions, workshop registrations and office order arrangements. By submitting personal data to us, visiting our website after viewing our cookie banner or using our services, you acknowledge that you have read this Policy. If you do not agree, please refrain from submitting personal data except where necessary for a transaction you initiate in the salon.

This Policy does not apply to third-party websites linked from brewspark.life. Those sites operate under their own privacy practices. We encourage you to review their policies before providing personal data to them.

2. Personal data we collect

Personal data means data, whether true or not, about an individual who can be identified from that data or from that data and other information to which we have or are likely to have access. Depending on your interaction with BrewSpark, we may collect the following categories:

• Identity and contact data: name, email address, telephone number, company name and job title when provided for office orders or corporate enquiries.
• Communication data: messages you send via our contact form, email or social correspondence, including workshop preferences and dietary information you voluntarily disclose.
• Transaction data: records of purchases, workshop bookings and office order history when you provide details for fulfilment or invoicing.
• Technical data: IP address, browser type, device identifiers, pages viewed, referring URLs and timestamps collected through server logs and optional analytics cookies where you have consented.
• Consent records: your cookie preferences stored in local storage and PDPA consent checkbox confirmations from form submissions.

We do not intentionally collect sensitive personal data such as national registration identity numbers, financial account numbers through the website contact form or health data beyond allergy information you voluntarily share for service safety. Please do not submit sensitive data unless we specifically request it for a defined purpose.

3. How we collect personal data

We collect personal data through several channels:

• Directly from you when you complete the contact form on contact.php, send email to [email protected], call +65 6442 1837 or speak with staff in the salon.
• Automatically when you browse brewspark.life, through essential server logs and, if you accept optional cookies, analytics tools that help us understand aggregate traffic patterns.
• From third-party service providers only where necessary — for example, email delivery infrastructure or payment terminals in the salon — and subject to contractual confidentiality obligations.

Where personal data relates to another individual — such as when you place an office order listing colleagues' names — you represent that you have obtained their consent or have another lawful basis to share their data with us.

4. Purposes of collection, use and disclosure

We collect and use personal data for purposes that a reasonable person would consider appropriate in the circumstances, including:

• Responding to enquiries, workshop booking requests, press questions and feedback submitted through our website or email.
• Fulfilling salon services, takeaway orders, office coffee bundles and workshop participation.
• Managing accounts receivable where corporate clients request invoicing, and maintaining records required by Singapore tax and accounting regulations.
• Operating, securing and improving brewspark.life, diagnosing technical issues and preventing fraud or abuse.
• Conducting aggregated statistical analysis of website usage where optional analytics cookies are accepted, without identifying individuals in published reports.
• Complying with legal obligations, responding to lawful requests from public authorities and establishing or defending legal claims.
• Sending service-related notices — for example, workshop date changes — where you have provided contact details for that purpose. We do not send unsolicited marketing email without consent.

We may disclose personal data to employees and contractors who need access to perform their duties, professional advisers bound by confidentiality, IT hosting providers located in Singapore or jurisdictions with comparable protection where contracts require appropriate safeguards, and authorities when required by law. We do not sell personal data.

5. Consent and withdrawal

Under the PDPA, we rely on consent, contractual necessity, legal obligation or legitimate interests as appropriate to each processing activity. Contact form submission requires explicit PDPA consent via checkbox before transmission. Optional analytics cookies require acceptance through our cookie banner; declining optional cookies limits collection to essential operations only.

You may withdraw consent for marketing or optional analytics at any time by emailing [email protected] with the subject "Consent Withdrawal". Withdrawal does not affect the lawfulness of processing before withdrawal. Some data must be retained after withdrawal where retention is required by law or for legitimate business records.

6. Accuracy and correction

We take reasonable steps to ensure personal data is accurate and complete when used for decisions affecting you. You may request correction of inaccurate data by contacting us with supporting details. We will respond within thirty days unless a longer period is permitted under the PDPA.

7. Protection and retention

We implement administrative, technical and physical safeguards appropriate to the sensitivity and volume of data we hold. Website forms transmit over HTTPS. Access to email and booking records is limited to authorised personnel. Salon payment terminals are operated in accordance with PCI-DSS requirements of our payment processor; we do not store full card numbers on our website.

We retain personal data only as long as necessary for the purposes collected or as required by law. Contact form records are typically retained for twenty-four months unless an ongoing relationship exists. Financial records may be retained for seven years in line with IRAS guidance. Server logs are rotated on a rolling ninety-day basis unless needed for security investigations.

8. Transfer outside Singapore

Where personal data is transferred outside Singapore — for example, to email infrastructure or cloud hosting — we ensure recipients are bound by legally enforceable obligations to provide a standard of protection comparable to the PDPA, consistent with Section 26 of the Act.

9. Your rights under the PDPA

Subject to exceptions under the PDPA, you have the right to:

• Request access to personal data we hold about you.
• Request correction of inaccurate or incomplete personal data.
• Withdraw consent for processing that relies on consent, subject to legal and contractual restrictions.
• Lodge a complaint with the Personal Data Protection Commission if you believe we have handled your data contrary to the PDPA.

Access requests should be sent to [email protected] with sufficient information for us to verify your identity. We may charge a reasonable fee for manifestly unfounded or excessive requests as permitted by law.

10. Children

Our website and salon services are not directed at children under thirteen. We do not knowingly collect personal data from children without parental consent. Workshop participants under eighteen should be registered by a parent or guardian.

11. Data breach notification

In the event of a data breach that is likely to result in significant harm or affect a significant number of individuals, we will assess the breach promptly, take containment measures and notify the PDPC and affected individuals where required under the PDPA and related guidance.

12. Changes to this Policy

We may update this Privacy Policy to reflect changes in law, technology or our practices. The "Last updated" date at the top will change accordingly. Material changes will be highlighted on brewspark.life for a reasonable period. Continued use after changes constitutes acknowledgement of the updated Policy where permitted by law.

13. Contact us

For privacy enquiries, access or correction requests, or complaints:

BrewSpark Pte. Ltd.
UEN 202531628H
247 East Coast Road, #01-04
Singapore 428940
Email: [email protected]
Phone: +65 6442 1837

We aim to acknowledge privacy correspondence within five business days and resolve standard requests within thirty days.

14. Third-party processors

Where we engage external processors to host the Site, deliver email or maintain salon point-of-sale systems, we require contractual terms that limit processing to documented instructions, impose confidentiality obligations and support your rights under the PDPA. A current list of processor categories — hosting, email transport and payment terminals — is available on request to [email protected]. We review processor practices periodically and update agreements when security standards or applicable law changes.

15. Notifiable data breaches

If we assess that a data breach is notifiable under PDPA guidance, we will document the incident, notify the Personal Data Protection Commission without undue delay where required and inform affected individuals when the breach is likely to result in significant harm.