Privacy Policy

1. Introduction

Yogalume respects the privacy of visitors and customers of www.yogalume.com. This Privacy Policy explains how personal data is collected, used, stored, disclosed and retained when you visit our website, place an order or contact us.

This Policy is intended to comply with the Singapore Personal Data Protection Act 2012 (PDPA), the EU General Data Protection Regulation (GDPR), where applicable, and relevant data protection requirements in the European Economic Area.

For the purposes of this Policy, Yogalume is the data controller responsible for determining the purposes and means of processing personal data collected through our website, except where another organisation independently determines its own processing purposes and means.

2. Personal Data We Collect

Depending on how you interact with our website, we may collect the following categories of personal data:

• Identity information: Name and other details provided when placing an order.
• Contact information: Email address, telephone number and billing or delivery address.
• Order information: Products purchased, order references, transaction status and related correspondence.
• Payment-related information: Payment status, transaction references and relevant billing details.
• Technical and usage information: IP address, browser type, device information, access logs and website interactions.
• Customer service information: Messages, questions and other information you submit when contacting us.
• Cookie and preference information: Cookie choices and relevant identifiers, subject to applicable consent requirements.

We collect only information that is relevant to the purposes described in this Policy or otherwise permitted by applicable law.

3. How We Collect Personal Data

Personal data may be collected when you:

• Visit or browse our website.
• Place an order or proceed through checkout.
• Submit your contact details or communicate with us.
• Select cookie preferences through our cookie banner.
• Interact with payment services or other functions available on our website.

Certain information is provided directly by you. Other information may be generated through website operation or received from payment service providers where necessary to process or verify a transaction.

4. Purposes and Legal Bases for Processing

We process personal data for the following purposes:

Order administration: To receive and manage orders, confirm transactions and maintain relevant purchase records.

Customer service: To respond to enquiries, address order-related questions and communicate with customers.

Payment processing: To facilitate payments, receive transaction confirmations and review payment-related issues.

Website operation: To maintain website functionality, remember permitted preferences and understand website usage.

Legal and accounting obligations: To maintain records, respond to lawful requests and meet applicable statutory requirements.

Transaction review: To identify unusual order activity and investigate suspected unauthorised transactions where appropriate.

Where the GDPR applies, the legal basis for processing may include performance of a contract, compliance with a legal obligation, legitimate interests pursued in accordance with applicable law, or consent where required.

Under Singapore’s PDPA, we collect, use and disclose personal data in accordance with applicable consent, notification, purpose limitation and other relevant requirements.

Where processing relies on consent, you may withdraw that consent subject to applicable law. Withdrawal does not affect processing lawfully carried out before withdrawal.

5. Payment Processing by Stripe

Payments made through our website are processed by Stripe, an independent payment service provider.

When you make a purchase, relevant information may be transmitted to Stripe to process the payment. This may include your name, email address, billing details, transaction amount, order reference, IP address and payment method information, depending on the transaction and payment method selected.

Stripe may process personal data in different capacities. When processing payment information on our instructions to provide payment services, Stripe acts as a data processor. For certain activities, including its own regulatory obligations, transaction monitoring and fraud prevention, Stripe may act as an independent data controller.

Stripe may share relevant information with financial institutions, payment method providers, affiliated entities and service providers as necessary for its stated purposes and applicable legal obligations.

Please consult Stripe’s official Privacy Policy for further information about its processing activities:https://stripe.com/privacy

Yogalume processes payment-related information only for relevant business, transaction administration and legal purposes.

6. Cookies and Similar Technologies

Our website uses cookies and similar technologies to support essential functions and, where permitted, understand website usage and remember preferences.

A cookie banner allows you to manage your preferences. Non-essential cookies are activated only after you click “Accept” on the cookie banner and provide consent. Strictly necessary cookies may operate without consent where permitted by applicable law.

Stripe may also use cookies or similar technologies in connection with payment processing, subject to applicable consent requirements.

You can change or withdraw your cookie consent through the available preference settings. Further information about cookie categories and retention periods is provided in our Cookie Policy.

7. Disclosure to Other Parties

We may disclose relevant personal data to the following recipients where necessary and lawful:

• Stripe: For payment processing and related transaction activities.
• Order fulfilment and delivery service providers: For handling and delivering customer orders.
• Website hosting and service providers: For operating and maintaining website functions.
• Professional advisers: Where necessary for accounting, legal or business compliance purposes.
• Public authorities and regulators: Where disclosure is required by law or a lawful request.

We limit disclosures to information relevant to the applicable purpose. Service providers processing personal data on our behalf are expected to handle it in accordance with applicable contractual and legal requirements.

8. International Data Transfers

Personal data may be processed in Singapore, the EEA or other jurisdictions where our service providers operate.

Where personal data is transferred outside Singapore, we apply the transfer requirements of the PDPA. Where the GDPR applies, transfers outside the EEA are made in accordance with the relevant GDPR requirements, including an applicable adequacy decision or appropriate safeguards where required.

These safeguards may include standard contractual clauses or other lawful transfer mechanisms, depending on the circumstances.

9. Personal Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, including applicable accounting, tax, legal and business record-keeping requirements.

Our general retention schedule is as follows:

• Order and transaction records: Generally up to 7 years after the relevant transaction, where required or justified for accounting, tax, legal or dispute-related purposes.
• Customer service correspondence: Generally up to 24 months after the enquiry has been resolved, unless further retention is necessary for an ongoing matter or legal obligation.
• Uncompleted checkout information: Generally up to 30 days, where the information is retained and no further purpose justifies a longer period.
• Website access logs: Generally up to 12 months, unless a longer period is necessary to investigate an incident or meet a legal requirement.
• Cookie preference records: Generally up to 6 months before renewal or review of the recorded choice, subject to applicable requirements.
• Marketing preferences: Until consent is withdrawn or the relevant information is no longer required, with suppression records retained where necessary to respect opt-out requests.
• Payment records held by Stripe: According to Stripe’s applicable retention practices, legal obligations and service terms.

These periods are internal retention guidelines, not universal statutory periods. Where a specific legal obligation requires a different period, the applicable legal period takes precedence.

When personal data is no longer needed and no legal or legitimate business purpose justifies continued retention, we will delete it or remove identifying links, as appropriate and permitted by law.

10. Data Protection

We maintain appropriate organisational and administrative measures to manage personal data and reduce the risk of unauthorised access, disclosure, alteration or loss.

Access to personal data is limited according to relevant business responsibilities. We also expect service providers handling personal data on our behalf to apply measures appropriate to the nature of the information and the services provided.

Where a personal data breach occurs, we will assess and respond to it in accordance with applicable legal requirements, including relevant notification obligations.

11. Your Data Protection Rights

Depending on your location and the applicable law, you may have the right to:

• Request access to personal data we hold about you.
• Request correction of inaccurate or incomplete information.
• Request erasure of personal data where the relevant legal conditions are met.
• Request restriction of processing in circumstances provided by law.
• Object to certain processing activities where applicable.
• Request portability of personal data where the GDPR conditions apply.
• Withdraw consent where processing is based on consent.
• Lodge a complaint with the relevant data protection authority.

These rights are subject to applicable legal conditions and exceptions. We may need to verify your identity before responding to a request.

Under Singapore’s PDPA, individuals may request access to and correction of personal data, subject to applicable statutory exceptions. Retention and deletion requests are handled in accordance with the applicable requirements.

12. Children’s Personal Data

Our website is intended for general customers purchasing clothing. We do not knowingly seek to collect personal data from children in circumstances where consent or other legal requirements have not been met.

Where applicable law requires parental or guardian involvement, we will handle the relevant information in accordance with those requirements.

13. Changes to This Privacy Policy

We may update this Policy when our data processing practices, website functions or applicable legal requirements change.

The updated version will be published on this page with a revised date. We encourage visitors to review this Policy periodically.

14. Contact Information

For questions, access requests, correction requests or other enquiries concerning personal data, please contact us using the details below.

Brand: Yogalume
Email: wear@yogalume.com
Address: 6 Raffles Blvd, #02-341 Marina Square, Singapore 039594
Phone: +65 8394 5896

We aim to respond to enquiries within 24–48 hours. Requests involving identity verification, complex records or statutory procedures will be handled within the time limits required by applicable law.