1. Introduction

Stepanddry respects the privacy of individuals who visit our website, purchase our bathroom textile products or contact our customer service team. This Privacy Policy explains how personal data is collected, used, stored, disclosed and managed in connection with our website and retail activities.

We handle personal data in accordance with applicable data protection legislation, including Singapore’s Personal Data Protection Act 2012 (PDPA) and, where applicable, the European Union General Data Protection Regulation (GDPR), together with relevant national data protection legislation.

By using our website, submitting an enquiry or placing an order, you acknowledge that you have had the opportunity to read this Privacy Policy. Where consent is required by law, we will request it separately. Use of the website does not, by itself, constitute consent to every form of data processing described in this policy.

2. Data Controller

For the purposes of this Privacy Policy, Stepanddry acts as the data controller for personal data processed in connection with our website, customer enquiries, order administration and customer service, determining the purposes and means of such processing where applicable.

Registered Company Name: [Insert Registered Company Name]
Registered Business Address: [Insert Registered Business Address]
Contact Email: supervisor@stepanddry.com
Telephone: [Insert Business Telephone Number]
Website: https://www.stepanddry.com

For privacy-related enquiries, requests concerning personal data or questions about this policy, please contact us using the details above.

3. Personal Data We Collect

Depending on how you interact with our website, we may collect the following categories of personal data:

3.1 Identity and Contact Information

This may include your name, email address, telephone number, billing address, delivery address and other contact details you provide when placing an order or contacting us.

3.2 Order and Transaction Information

This may include order references, items purchased, quantities, prices, transaction dates, order status, delivery details, refund records and relevant correspondence relating to a purchase.

3.3 Payment-Related Information

Payments made through our website are processed by Stripe. Depending on the payment method and transaction, payment-related information may include transaction references, payment status, billing details and information required to process a payment.

Card details and other payment information are handled according to the payment process provided by Stripe and the relevant payment method. We do not intentionally collect or retain complete payment card credentials in our ordinary customer order records.

3.4 Communications

When you contact us, we may retain your email messages, contact form submissions, order-related correspondence and other information you choose to provide.

3.5 Website and Usage Information

When you visit our website, certain information may be collected through server records, cookies and similar technologies. Depending on the technologies in use, this may include your IP address, browser type, device information, pages visited, access times, referral information and website preference settings.

Non-essential cookies and similar technologies will be used in accordance with applicable consent requirements.

4. How We Collect Personal Data

Personal data may be collected:

• Directly from you when you place an order, complete a form or contact us.
• Through our website when you browse pages or interact with available functions.
• Through Stripe when payment-related information or transaction results are made available to us.
• Through service providers involved in website operation, order administration, communications and customer support.
• Where permitted by law, from other relevant sources for transaction verification, record administration or the handling of customer requests.

We collect information that is reasonably relevant to the purposes explained in this policy.

5. Purposes and Lawful Bases for Processing

We process personal data only where an applicable lawful basis exists and the processing is relevant to the stated purpose.

5.1 Order Processing and Contract Administration

We use relevant contact, billing, delivery and order information to receive and administer purchases, confirm transactions, manage order records, handle delivery enquiries and fulfil our contractual obligations.

Lawful basis: Performance of a contract or steps requested before entering into a contract, where applicable.

5.2 Payment Processing

We use relevant transaction information to facilitate payments, confirm payment outcomes, reconcile order records and administer refunds where applicable.

Lawful basis: Performance of a contract, compliance with applicable legal obligations and other lawful grounds where relevant.

5.3 Customer Service

We process enquiries and related correspondence to respond to questions, review order-related requests and maintain appropriate records of customer communications.

Lawful basis: Performance of a contract, legitimate interests or other applicable lawful grounds, depending on the enquiry.

5.4 Legal and Accounting Requirements

We may retain and process relevant records to meet accounting, tax, record-keeping and other applicable legal obligations, and to establish, exercise or defend legal claims where necessary.

Lawful basis: Compliance with legal obligations and, where applicable, legitimate interests.

5.5 Website Operation and Administration

We may use relevant website usage information to understand website activity, maintain service functionality, investigate technical issues and administer website preferences.

Lawful basis: Legitimate interests where permitted, or consent where required by applicable law.

5.6 Marketing Communications

Where permitted by law, we may send information about products or offers if you have subscribed or otherwise provided the required permission. You may withdraw your marketing consent or unsubscribe at any time.

We will not rely on this policy alone as permission to send marketing communications where separate consent is required.

Lawful basis: Consent or another lawful basis expressly permitted by applicable legislation.

6. Stripe Payment Processing

Stepanddry uses Stripe as its payment processor to facilitate transactions submitted through our website.

When you make a purchase, relevant information may be transmitted to Stripe, including your name, email address, billing details, transaction amount, order reference and payment-related information, as required for the selected payment method.

Stripe may process personal data in different capacities depending on the service involved. When processing personal data on our behalf, Stripe may act as a data processor. For certain activities, including activities for which Stripe determines its own purposes and means of processing, Stripe may act as an independent data controller or in another capacity described in its applicable legal documentation.

Stripe may process relevant information to:

• Authorise and process payments.
• Communicate transaction outcomes.
• Administer refunds and transaction records.
• Identify and review potentially fraudulent transactions.
• Meet applicable legal and regulatory obligations.
• Operate and administer the payment services it provides.

Stripe’s processing is also governed by its own privacy documentation and applicable terms.

For further information, please review the Stripe Privacy Policy and Stripe Data Processing Agreement.

Stepanddry does not control the personal data processing activities that Stripe undertakes independently as a data controller. Requests concerning processing undertaken independently by Stripe may need to be directed to Stripe.

7. Disclosure of Personal Data

We may disclose relevant personal data to the following categories of recipients where necessary and permitted by law:

• Stripe: To process payments and administer related transactions.
• Website and hosting providers: To operate and maintain the website and associated records.
• Order fulfilment and delivery providers: To prepare, dispatch and deliver purchases where their services are used.
• Customer communication providers: To manage customer enquiries and correspondence.
• Professional advisers: Where appropriate for accounting, legal or business administration purposes.
• Public authorities and regulators: Where disclosure is required by law or is otherwise lawfully permitted.

We disclose only information relevant to the applicable purpose. Service providers receiving personal data on our behalf are expected to handle it in accordance with their contractual obligations and applicable legislation.

We do not sell personal data to third parties.

8. International Data Transfers

Stepanddry operates from Singapore and may serve customers in European markets. Depending on the service providers involved, personal data may be processed or stored in Singapore or other countries.

Where the GDPR applies, transfers of personal data outside the European Economic Area will be carried out using an applicable transfer mechanism where required, such as an adequacy decision or appropriate safeguards under the GDPR. Where relevant, this may include the European Commission’s Standard Contractual Clauses and supplementary measures where necessary.

Where Singapore’s PDPA applies, transfers of personal data outside Singapore will be subject to the applicable requirements governing overseas transfers.

We take the applicable transfer requirements into account when arranging the processing of personal data through service providers.

9. Data Retention Periods

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including applicable legal, accounting, record-keeping and dispute-related requirements.

The following periods describe our intended retention approach. Where a mandatory legal retention period applies, that requirement takes precedence.

These periods are not intended to extend retention beyond what is necessary. Where personal data is no longer required and no applicable legal or business purpose justifies further retention, we will delete it, anonymise it or otherwise cease retaining identifiable records as appropriate.

Some transaction records may need to be retained after an account is closed or a deletion request is received to meet statutory obligations or establish, exercise or defend legal claims.

10. Data Protection and Confidentiality

We apply administrative and organisational measures appropriate to the nature of the personal data we handle. Access to customer records is limited according to relevant business responsibilities, and service providers are engaged subject to applicable contractual and legal requirements.

Where a personal data breach occurs, we will assess the circumstances and take any notification or other action required by applicable legislation.

No statement in this policy removes any obligation imposed on us by applicable law.

11. Cookies and Similar Technologies

Our website may use cookies and similar technologies to support essential website functions, remember preferences and, where applicable, understand website usage.

Cookies may include:

• Essential cookies: Required for functions such as maintaining a shopping basket or supporting checkout.
• Preference cookies: Used to remember selected website settings.
• Analytics cookies: Used to understand website visits and usage where such tools are enabled.
• Marketing cookies: Used for marketing-related purposes where such technologies are enabled and permitted.

Where consent is required, non-essential cookies will not be placed or accessed before the relevant consent has been obtained. You may manage your preferences through the available cookie settings and your browser controls.

Further information about individual cookies, their purposes and their expiry periods should be provided in our Cookie Policy or cookie settings, where applicable.

12. Your Data Protection Rights

Where the GDPR applies, you may have the right to:

• Request access to personal data held about you.
• Request correction of inaccurate or incomplete personal data.
• Request erasure where the applicable legal conditions are met.
• Request restriction of processing in qualifying circumstances.
• Receive certain personal data in a portable format.
• Object to processing based on legitimate interests, subject to the applicable legal conditions.
• Withdraw consent where processing relies on consent.
• Lodge a complaint with a competent data protection supervisory authority.

These rights are subject to the conditions and exceptions set out in applicable legislation. They do not require us to erase records that must be retained by law.

Under Singapore’s PDPA, you may have rights to request access to and correction of personal data, subject to applicable statutory provisions and exceptions. You may also withdraw consent where permitted by law.

To exercise a relevant right, contact supervisor@stepanddry.com. We may request information reasonably necessary to verify your identity and clarify the scope of your request.

We will review and respond to requests within the time limits prescribed by applicable law.

13. Direct Marketing

You may opt out of marketing emails by following the unsubscribe instructions included in the relevant message or by contacting us.

Following an opt-out, we will cease sending marketing communications covered by your request within the applicable period. We may retain limited information necessary to record your preference and avoid sending further communications contrary to that preference.

Transactional messages concerning purchases, refunds or other necessary customer service matters may continue where permitted by law.

14. Children’s Personal Data

Our website is intended for individuals who can lawfully make purchases under the applicable rules. We do not knowingly seek to collect children’s personal data where such collection would be unlawful.

Where we become aware that personal data has been collected unlawfully from a child, we will assess the circumstances and take appropriate action in accordance with applicable legislation.

15. Third-Party Websites and Services

Our website may contain links to external websites or services. Those websites operate under their own privacy terms and practices.

We encourage visitors to review the relevant privacy information before providing personal data to an external service. This policy applies to personal data processed by Stepanddry within the scope described above and does not replace the privacy policies of independent service providers.

16. Changes to This Privacy Policy

We may update this Privacy Policy when our business practices, website functions or applicable legal requirements change.

The revised version will be published on this page with an updated revision date. Where a change requires notice or consent under applicable law, we will take the relevant steps before implementing the affected processing.

17. Contact and Privacy Requests

For questions about this Privacy Policy, requests concerning personal data or enquiries regarding our data handling practices, please contact:

Brand: Stepanddry
Registered Company Name: [Insert Registered Company Name]
Registered Business Address: [Insert Registered Business Address]
Email: supervisor@stepanddry.com
Telephone: [Insert Business Telephone Number]
Website: https://www.stepanddry.com

Please include sufficient information to identify your request. We will review your enquiry and respond in accordance with applicable requirements.

18. Applicable Data Protection Legislation

This Privacy Policy is intended to operate in accordance with applicable Singapore data protection legislation and, where applicable, the GDPR and relevant European national data protection laws.

Nothing in this policy excludes or restricts a right or obligation that cannot lawfully be excluded or restricted.