PRIVACY POLICY

This Privacy Policy governs the data processing practices of greengantry. We respect the privacy of our users and are committed to processing personal data in a lawful, transparent, and orderly manner.

1. Data Controller

   For the purposes of the Singapore Personal Data Protection Act (PDPA) and the General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679), the data controller responsible for your personal information is:
   Corporate Entity: SG GARDEN PTE. LTD.
   Company Registration Number (UEN): 202005523C
   Registered Office Address: 61 Ubi Road 1, #03-16, Oxley Bizhub, Singapore 408727
   Official Enquiries: indoor@greengantry.com

2. Information We Collect

   To facilitate the purchase and delivery of our multi-tier plant stands, we collect necessary transactional information, including:
   Identity Data: Full name, title, and business name (where applicable).
   Contact Data: Delivery address, billing address, email address, and telephone number.
   Financial & Transaction Data: Details regarding payments made on our platform and items purchased.

3. Third-Party Payment Processing

   All financial transactions performed on our website are managed securely through our designated third-party payment infrastructure provider, Stripe.
   When you proceed with a checkout transaction, your payment credential data is transmitted directly to Stripe. SG GARDEN PTE. LTD. does not store, retain, or have access to your full credit card numbers or sensitive payment authentication codes. Stripe processes this data strictly in accordance with the Payment Card Industry Data Security Standard (PCI-DSS) and its independent privacy regulations to facilitate lawful order settlement.

4. Legal Basis for Processing (EEA & Singapore)

   We process your personal information under the following legitimate frameworks:
   Performance of a Contract: To process, package, and fulfil your order of our multi-tier structures.
   Legal Compliance: To satisfy corporate accounting, tax declarations, and statutory auditing liabilities under Singaporean and European authorities.
   Legitimate Interests: To provide standard customer assistance, communications, and logistical tracking.

5. Data Retention Periods

   In alignment with statutory limits prescribed by the Inland Revenue Authority of Singapore (IRAS) and European financial tracking mandates, your data will be retained as follows:
   Transactional & Financial Records: Retained for a mandatory period of 5 to 7 financial years from the date of the transaction to comply with fiscal and corporate record-keeping laws.
   Customer Correspondence Records: Retained for up to 2 years following the resolution of your query to preserve administrative clarity and history.
   Upon the expiration of these statutory durations, or upon a valid deletion request where legally permissible, your information will be irreversibly anonymised or permanently erased from our operational networks.

6. Your Statutory Rights

   Depending on your geographical jurisdiction (specifically applicable to residents within the European Economic Area under GDPR and individuals under Singapore’s PDPA), you possess the following rights regarding your data:
   The Right of Access: To request confirmation and copies of the personal data held by us.
   The Right to Rectification: To demand the correction of inaccurate or incomplete corporate or personal details.
   The Right to Erasure (Right to be Forgotten): To request the deletion of data, subject to overarching statutory tax and accounting retention requirements.
   The Right to Restriction or Objection: To restrict or oppose specific processing routines based on legitimate interests.
   To exercise any of these privileges, please forward a formal written request to our designated legal liaison email: indoor@greengantry.com.

7. Data Protection Standards

   We implement standard administrative and operational measures intended to reduce risks of unauthorised access, alteration, or disclosure of data. While we deploy industry-standard structural protocols to protect customer information, users acknowledge that no digital transmission over the internet or automated network infrastructure can be described as entirely immune from potential external interference.