Bundl Privacy Policy

Information we collect

We collect personal data that is reasonably necessary to operate Bundl and facilitate group buys:

Account information. When you register for Bundl, we may collect your email address, account name or username, login credentials and other information needed to create, authenticate and secure your account.

Buyer information. When you join or submit an order for a group buy, we may collect your name, contact details, order and item details, fulfilment preferences and other information you submit in connection with that group buy. If delivery is required, this may include your mailing address.

Where applicable, we may also collect screenshots, files or other evidence that you voluntarily submit in connection with an item, payment, shipment, refund, dispute or support request. You should avoid including unrelated personal or financial information in such uploads.

Host information. If you host a group buy, we may collect your name or account information, contact details such as a WhatsApp number or Telegram username, group buy information and, where you choose to receive payment directly from Buyers, your PayNow, PayLah or other payment identifier or payment instructions.

Technical and security information. When you use Bundl, our systems and service providers may collect information reasonably necessary to operate and secure the Platform, such as IP addresses, device or browser information, login and activity timestamps, error logs and security records.

How we use and share personal data

We may collect, use and disclose personal data, with your consent, deemed consent or otherwise where permitted or required by law, for purposes including:

1. creating, authenticating and maintaining your account;
2. operating the Platform and enabling users to create, join and manage group buys;
3. submitting and facilitating orders, payments made directly between users, fulfilment, delivery or collection;
4. enabling Buyers and Hosts to communicate about the relevant group buy;
5. generating records, notifications and order updates;
6. processing screenshots or other evidence submitted in connection with payments, shipments, refunds or disputes;
7. providing customer support and responding to enquiries, complaints and requests;
8. preventing fraud, abuse, unauthorised access and other misuse, and protecting users and the Platform;
9. enforcing our Terms of Service and investigating suspected violations; and
10. complying with applicable laws, regulatory requirements, court orders and lawful requests from public authorities.

We disclose personal data only where reasonably necessary for these purposes or otherwise permitted or required by law:

Sharing between Buyers and Hosts. When a Buyer joins a group buy, Bundl may disclose to the relevant host the information reasonably required to process and fulfil that Buyer's order, such as the Buyer's name, contact information, order details, fulfilment method, delivery address where delivery is selected, and relevant payment or fulfilment evidence.

Bundl may disclose a Host's contact details and, where the Host elects to receive payment directly, the Host's relevant payment identifier or instructions to Buyers who need that information for the group buy.

This information must not be used by a Host or Buyer for unrelated purposes such as unsolicited marketing, harassment, publication or sale of personal information.

Service providers. We may use third-party providers for functions such as authentication, infrastructure hosting, databases, file storage, email or communications, security and technical support. We disclose personal data to such providers only to the extent reasonably necessary for them to perform services for us and require appropriate handling and protection of the information.

Legal and safety disclosures. We may disclose information where reasonably necessary or legally required to investigate suspected fraud or unlawful activity, protect the rights or safety of users or others, respond to lawful requests, establish or defend legal claims, or comply with Singapore law.

No sale of personal data. Bundl does not sell users' personal data.

Retention, security, overseas transfers and your rights

Security. We make reasonable administrative, technical and organisational security arrangements appropriate to the nature of the personal data in our possession or control. These may include access restrictions, authentication controls, secure storage, system monitoring and measures intended to prevent unauthorised access, collection, use, disclosure, copying, modification or disposal.

No internet service or storage system is completely secure, and nothing in this Policy constitutes a guarantee that a security incident can never occur.

Where Bundl becomes aware of a personal data breach, we will assess and manage it in accordance with the PDPA, including notifying the Personal Data Protection Commission and affected individuals where notification is legally required.

Retention. We retain personal data only for as long as reasonably required for the purpose for which it was collected or for legitimate legal or business purposes, which may include providing the Platform, maintaining necessary transaction records, resolving disputes, preventing fraud or abuse and complying with legal obligations. When personal data is no longer required for such purposes, we will cease retaining it or remove the means by which it can be associated with an identifiable individual, where reasonably practicable.

Transfers outside Singapore. Some of our service providers may store or process personal data outside Singapore. Where personal data is transferred outside Singapore, we will take steps required under the PDPA to ensure that the transferred data receives a standard of protection comparable to that required by the PDPA, including through appropriate contractual or other legally recognised safeguards where applicable.

Access and correction. You may request:

• access to personal data about you that is in our possession or under our control, together with information about the ways in which it has been used or disclosed during the preceding year; or
• correction of an error or omission in personal data about you.

We may need to verify your identity before responding. We will respond as soon as reasonably possible and, if we cannot respond within 30 calendar days, will inform you of when we expect to respond.

Withdrawal of consent. Where our collection, use or disclosure of your personal data depends on your consent, you may withdraw that consent on reasonable notice by contacting us. We will inform you of the likely consequences and will cease the relevant collection, use or disclosure after a reasonable period, unless continued handling is permitted or required by law. Withdrawal may mean that we can no longer provide features that require the affected information.

Account closure. You may request closure of your Bundl account. Closing an account does not necessarily require immediate deletion of every record: information may continue to be retained where reasonably necessary for legal or business purposes, including outstanding group buys, disputes, fraud prevention and legal compliance.

Accuracy. Please keep your contact, fulfilment and other material information accurate and up to date. We may take reasonable steps to verify information where its accuracy is important to a decision affecting you or before disclosing it to another organisation.

Changes to this Policy. We may amend this Privacy Policy when our practices, Platform or legal obligations change. We will publish the revised Policy with its effective date and, where appropriate, provide reasonable notice of material changes. Where a change requires fresh consent under applicable law, we will obtain that consent rather than relying solely on continued use of the Platform.

Privacy enquiries, access or correction requests, withdrawal-of-consent requests and complaints may be sent to enquiries@bundl.sg.