Privacy Policy

1. Who is responsible for your data

SECOND MATCHA HOUSE is responsible for personal data under its control. Our Data Protection Officer is the Second Matcha House Team. For privacy questions, requests, or complaints, contact the Data Protection Officer at secondmatchahouse@gmail.com. Please include “Privacy” in the subject line.

2. Personal data we collect

Depending on how you use our services, we may collect:

• identity and contact details, including your name, phone number, and any contact details you choose to provide;
• order and fulfilment details, including items, customisations, notes, pickup location or delivery address, area, postal code, date, and time;
• transaction details, including order number, amount, status, discounts, and refunds;
• loyalty and promotion information, including your points, reward and code usage, purchase history, and marketing preference;
• communications and feedback, including Telegram identifiers when you link Telegram, messages you send us, ratings, comments, and review activity; and
• technical and usage information, such as IP address, device/browser information, pages visited, referring source, and approximate location derived from network information.

If you provide personal data about another person, you confirm that you are authorised to do so and to let us use it for the relevant purpose.

3. How we collect personal data

We collect data directly from you at checkout, when you submit feedback, contact us, or interact with our Telegram bot. We also collect data automatically through website operation, analytics, security, and rate-limiting technologies, and may receive transaction or delivery information from service providers involved in your order.

4. Why we use personal data

We use personal data where reasonably necessary to:

• receive, verify, prepare, deliver, and support your order;
• verify payments and process refunds, promotions, and loyalty rewards;
• send transactional updates through the order page, phone, Telegram, WhatsApp, or another channel you use with us;
• respond to enquiries, requests, complaints, and feedback;
• maintain customer records, understand aggregate sales and customer trends, and improve our menu, service, and website;
• send promotional Telegram messages only where you have opted in, and record your opt-out if you later withdraw that choice;
• detect fraud, abuse, security incidents, and technical problems; and
• meet accounting, tax, regulatory, dispute, and legal obligations.

We will notify you and obtain consent where required before using your data for a materially different purpose. You may withdraw consent with reasonable notice by contacting us, subject to legal or operational consequences that we will explain. For example, we may be unable to fulfil an order without the details needed to prepare or deliver it.

5. Cookies, local storage, and analytics

The website stores your cart and pending promotional code in your browser's local storage so they remain available between visits. You can clear this through your browser settings, but doing so may empty your cart.

We use Vercel Web Analytics to understand visits and website performance. Our back-office pages are excluded from these analytics. Hosting, security, and rate-limiting services may also process IP addresses and request information needed to operate and protect the website. Browser controls may let you restrict storage or tracking, although parts of the website may then work differently.

6. Who we disclose data to

We may disclose relevant data to:

• hosting, database, file-storage, analytics, security, and rate-limiting providers, including Vercel, Supabase, and Upstash;
• Telegram, WhatsApp, delivery providers, map providers, or other communications and fulfilment services when you or we use them for your order;
• professional advisers, insurers, auditors, banks, payment providers, and public authorities where reasonably required; and
• a buyer, successor, or adviser in connection with a genuine business transaction, subject to appropriate confidentiality safeguards.

We do not sell or rent your personal data. Service providers may process data only for the service they provide to us or as otherwise permitted by law and their applicable terms.

7. Overseas transfers

We currently accept orders for fulfilment within Singapore only. However, some technology and communications service providers may process or store data outside Singapore. Where the Singapore Personal Data Protection Act 2012 applies, we take reasonable steps to ensure that transferred personal data receives a standard of protection comparable to that required in Singapore.

8. Retention

We retain personal data only while it is reasonably needed for the purposes described above, including order support, accounting and tax, fraud prevention, dispute handling, and legal requirements. Retention periods vary by record type. When data is no longer required for a business or legal purpose, we will delete it, anonymise it, or otherwise cease retaining it in identifiable form where reasonably practicable.

9. Security

We use reasonable administrative, technical, and physical safeguards to protect personal data, including restricted administrative access and service-provider security controls. No internet transmission or storage method is completely secure, so we cannot guarantee absolute security. Please avoid including unnecessary sensitive information in order notes.

10. Your choices and requests

You may ask to access personal data we hold about you, learn how it was used or disclosed during the applicable period, or correct inaccurate or incomplete data. You may also withdraw consent or opt out of promotional messages. Contact secondmatchahouse@gmail.com. We may need to verify your identity and may charge a reasonable fee for an access request where permitted, after informing you in advance. Exceptions under law may apply.

11. Children

Our ordering service is not directed at children who cannot validly consent to the handling of their personal data. A parent or guardian should place an order on their behalf. If you believe a child has provided data without appropriate consent, please contact us.

12. Third-party links and changes

Third-party websites and apps linked from our service have their own privacy practices. We may update this Policy to reflect operational or legal changes. The revised version takes effect when posted with its new effective date. For material changes, we will provide additional notice where appropriate.