Singapore Privacy Notice (PDPA)

This notice adds Singapore-specific information to the Tanqory Global Privacy Policy. It applies when Singapore's Personal Data Protection Act 2012 ("PDPA") applies to how Tanqory Inc. ("Tanqory", "we", "us") handles your personal data. Where this notice and the Global Privacy Policy differ for a person in Singapore, this notice applies.

Official references:

• Personal Data Protection Commission (PDPC): https://www.pdpc.gov.sg/
• PDPA text (Singapore Statutes Online): https://sso.agc.gov.sg/Act/PDPA2012
• Do Not Call Registry: https://www.dnc.gov.sg/

---

1. Who is responsible

• Tanqory Inc. is the organisation responsible for personal data about merchants, developers, visitors to Tanqory websites and users of Tanqory apps. Tanqory Inc., c/o Harvard Business Services, Inc., 16192 Coastal Highway, Lewes, DE 19958, USA.
• Merchant stores: when you buy from a store that runs on Tanqory, the merchant is the organisation responsible for your data and Tanqory acts as its data intermediary under our Data Processing Addendum. As a data intermediary we are bound by the PDPA's protection, retention and breach duties (ss.24, 25 and 26C). Ask the merchant first about your rights; we help the merchant answer.
• Data Protection Officer (s.11(3)): privacy@tanqory.com. Please write "PDPA request" in the subject line.

2. What we collect and why (ss.13 to 20)

The categories of data, purposes, recipients and retention periods are listed in the Global Privacy Policy (sections "Personal Data We Collect", "How We Use Personal Data", "Sharing of Personal Data with Third Parties" and "Data Retention and Deletion"). We tell you the purposes at or before collection (s.20). The PDPA basis we rely on for each purpose is:

Where we rely on the legitimate interests exception, the PDPA requires us to weigh our interests against any adverse effect on you first. You can ask us about that reliance at privacy@tanqory.com.

We do not ask for NRIC, FIN or passport numbers to use Tanqory. If a payment or identity-check provider needs one to meet a legal requirement, it collects it directly under its own notice, in line with the PDPC's Advisory Guidelines on NRIC and other national identification numbers.

3. Your rights (ss.16, 21 and 22)

You can ask us to:

• give you access to your personal data in our possession or under our control, and tell you how it has been used or disclosed in the past year (s.21);
• correct an error or omission in your personal data (s.22);
• stop using your data for a purpose that relies on consent, by withdrawing that consent (s.16). We tell you the likely consequences before we act on a withdrawal. Unsubscribe links and your account settings work at any time.

Send requests to privacy@tanqory.com. We will check your identity before we act. We answer as soon as reasonably possible. If we cannot answer an access or correction request within 30 days, we tell you within that time when we will. Correction is free. For access we may charge a reasonable fee only where it covers our actual cost, and we tell you the amount before we proceed. Some information is exempt from access under the Fifth Schedule; if we refuse, we tell you why.

You can also complain to the PDPC through https://www.pdpc.gov.sg/. We would like the chance to fix the problem first, but you do not need to contact us before you complain.

4. Children

Tanqory is built for businesses and is not meant for children. You must be 18 or older to open a merchant account. We do not knowingly collect data from children, and we follow the PDPC's Advisory Guidelines on the PDPA for Children's Personal Data. If we learn that we collected a child's data without a valid basis, we delete it.

5. Do Not Call rules (PDPA Part 9)

We send marketing SMS only to people who have given consent, in every country. Before sending a marketing message to a Singapore number we check the Do Not Call Registry, unless you have given us clear and unambiguous consent in writing or another form accessible for later reference, or an exemption under the PDPA applies. Every marketing message identifies Tanqory and tells you how to opt out. We keep records of consent and opt-outs so we can honour them.

6. Cookies and similar technologies

Strictly necessary cookies are always on. For other cookies (analytics and ad measurement) on Tanqory websites, visitors in Singapore see our cookie notice and can switch them off at any time in the cookie settings. We also honour Global Privacy Control signals from your browser. The full list is in our Cookie Policy.

7. Where your data is stored and transfers outside Singapore (s.26)

Today our platform data is hosted by DigitalOcean in Singapore. Some of our service providers process data in the United States and other countries (see the subprocessor list). When personal data leaves Singapore we take the steps the Personal Data Protection Regulations 2021 require to make sure the recipient is bound by legally enforceable obligations giving a standard of protection comparable to the PDPA, usually through contract terms. You can ask us for a copy of the safeguards that apply to your data.

8. Security and data breaches (ss.24 and 26A to 26E)

We protect personal data with the measures described in the Global Privacy Policy section "Data Security Measures". If we suspect a data breach, we assess it promptly. If it is notifiable (it is likely to result in significant harm to the people affected, or affects 500 or more people), we notify the PDPC as soon as practicable and no later than 3 calendar days after we determine that it is notifiable. Where significant harm is likely, we also tell the people affected as soon as practicable, including what they can do to protect themselves. When we act as a data intermediary, we tell the merchant without undue delay so that it can meet its own duties.

9. How long we keep data (s.25)

We keep personal data only as long as the purposes in section 2 need, or longer if a law requires it (for example tax records). Periods are listed in our Data Retention Policy. After that we delete or anonymise the data.

10. Changes

We will post changes to this notice here and change the "Last updated" date. For a material change we will also tell you prominently, for example by email or with a notice on our website or app. Disputes are handled as set out in the Global Privacy Policy; nothing in it limits your right to complain to the PDPC.

Change history