1. Introduction

Drapeandlayer (“we”, “us” or “our”) respects the privacy of individuals who visit www.drapeandlayer.com, purchase our products or contact us regarding our business.

This Privacy Policy explains how we collect, use, disclose, retain and otherwise process personal data in connection with our website and services. It applies to visitors, customers and individuals who communicate with us through our website or other available contact channels.

We handle personal data in accordance with applicable data protection legislation, including Singapore’s Personal Data Protection Act 2012 (PDPA) and, where applicable, the European Union General Data Protection Regulation (GDPR), the UK GDPR and relevant national data protection legislation.

By using our website, you acknowledge that you have been given access to this Privacy Policy. Where consent is required by law, we will request it separately. Your use of the website does not constitute consent to every form of data processing described below.

2. Data Controller

Brand Name: Drapeandlayer

Website: https://www.drapeandlayer.com

Registration No.: 202300687E
Address: 16 KALLANG PLACE #01-35 SINGAPORE 339156
Tel: +65 8894 3341
Email: xiangpay@drapeandlayer.com

Drapeandlayer acts as the data controller for personal data processed to operate its website, manage customer relationships, administer orders and provide customer service.

As data controller, Drapeandlayer determines the purposes and means of processing personal data within the scope of its business activities and is responsible for handling such data in accordance with applicable requirements.

3. Personal Data We Collect

Depending on how you interact with our website, we may collect the following categories of personal data:

3.1 Identification and Contact Details

This may include your name, email address, telephone number, billing address, delivery address and other contact details you provide when placing an order or contacting us.

3.2 Order and Transaction Information

This may include order references, purchased items, quantities, prices, order dates, delivery details, transaction status, refund records and related customer service correspondence.

3.3 Payment-Related Information

Payments made through our website are processed by Stripe, our payment processing provider.

Depending on the payment method used, payment-related information may include transaction references, payment status, card-related information and billing details. Card details entered through Stripe’s payment interface are handled in accordance with Stripe’s applicable terms and privacy documentation.

Drapeandlayer does not intend to collect or retain complete card security codes. We may receive transaction confirmations, payment references and other information necessary to administer an order.

3.4 Website and Device Information

When you visit our website, certain information may be collected through server records, cookies and similar technologies. This may include your IP address, browser type, device information, pages visited, access times, referral information and basic interaction records.

The information collected depends on the website functions you use and your cookie preferences.

3.5 Communications

If you contact us by email or through an available contact form, we may retain your contact details, the contents of your enquiry and our subsequent correspondence for customer service, record-keeping and related business purposes.

4. How We Use Personal Data

Drapeandlayer processes personal data for the following purposes:

  • To receive, confirm and administer customer orders.
  • To arrange payment processing and maintain transaction records.
  • To communicate order confirmations, order updates and relevant service information.
  • To respond to product enquiries and customer service requests.
  • To administer returns, refunds and other matters relating to purchases.
  • To maintain website functionality and understand general website usage.
  • To identify suspicious transactions, investigate irregular activity and protect our business operations.
  • To maintain accounting, tax and other business records required by applicable law.
  • To handle complaints, establish relevant facts and exercise or defend legal claims.
  • To send promotional communications where permitted by applicable law and, where required, with your consent.

We do not intentionally collect personal data that is unnecessary for these purposes.

5. Legal Grounds for Processing

Where the GDPR or UK GDPR applies, we rely on the following legal grounds, as appropriate to the circumstances:

Contractual necessity: Processing required to accept and administer your order, arrange payment and fulfil our obligations arising from a purchase.

Legal obligations: Processing required to meet applicable accounting, tax, record-keeping or other statutory obligations.

Legitimate interests: Processing reasonably necessary for customer service, website administration, business records, the prevention of fraudulent activity and the establishment or defence of legal claims, provided that your rights and interests do not override those interests.

Consent: Processing based on your freely given consent, such as certain non-essential cookies or promotional communications where consent is required.

Where processing relies on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Under Singapore’s PDPA, personal data is collected, used and disclosed in accordance with the applicable consent, notification, purpose limitation and other relevant requirements.

6. Payment Processing by Stripe

Drapeandlayer uses Stripe as its payment processing provider to facilitate payments for purchases made through our website.

When you proceed to payment, relevant information may be transmitted to Stripe, including your name, email address, billing details, transaction amount, order reference and payment-related information required to process the transaction.

Stripe processes payment information in accordance with its applicable terms, privacy documentation and data protection obligations.

Depending on the specific processing activity, Stripe may act as a data processor on behalf of Drapeandlayer or as an independent data controller for activities where Stripe determines its own processing purposes and means. Stripe’s handling of personal data in its capacity as an independent controller is governed by Stripe’s own privacy documentation.

For further information, please refer to Stripe’s Privacy Centre.

Drapeandlayer uses payment-related information received from Stripe to confirm transaction status, administer orders, handle relevant enquiries and maintain business records.

7. Disclosure of Personal Data

We may disclose relevant personal data to the following categories of recipients where necessary and permitted by law:

Stripe: To process payments, confirm transactions and administer payment-related matters.

Delivery and fulfilment providers: To prepare, dispatch and deliver customer orders using the information required for those activities.

Website hosting and service providers: To maintain website operations, process customer enquiries and support relevant business functions.

Professional advisers: To obtain accounting, legal or other professional assistance where required.

Public authorities and competent bodies: Where disclosure is required by law, a lawful request or a relevant legal proceeding.

We limit disclosures to information relevant to the applicable purpose. We do not sell customers’ personal data in exchange for payment.

8. International Transfers

Drapeandlayer operates from Singapore and serves customers in European markets. Depending on the services used, personal data may be processed or accessed in Singapore, within Europe or in other countries where our service providers operate.

Where personal data is transferred internationally, we take the steps required by applicable law. Where the Singapore PDPA applies, relevant overseas transfers must meet the applicable requirements for comparable protection. Where the GDPR applies, transfers to countries outside the European Economic Area must rely on an applicable transfer mechanism, such as an adequacy decision or appropriate safeguards, where required.

Information about relevant transfer arrangements may be requested by contacting us at xiangpay@drapeandlayer.com.

9. Data Retention Periods

Drapeandlayer retains personal data only for as long as reasonably necessary for the purposes for which it was collected, taking account of applicable legal requirements, accounting obligations, operational needs and the establishment or defence of legal claims.

The following retention periods are our general operational guidelines:

Order and transaction records: Up to seven years from the relevant transaction or the end of the relevant accounting period, where necessary for accounting, tax, record-keeping or legal purposes.

Customer service correspondence: Generally up to 24 months after the enquiry has been closed, unless a longer period is required to resolve an outstanding matter or maintain relevant records.

Customer account information: While the account remains active and, following closure, for a period reasonably necessary to complete outstanding matters, meet applicable legal obligations or address relevant claims.

Marketing preferences and consent records: Until consent is withdrawn or the relevant processing purpose ends, with records retained for an appropriate period where necessary to demonstrate compliance with applicable requirements.

Website access and technical logs: Generally up to 12 months, unless a longer period is reasonably necessary to investigate an incident, maintain website operations or meet a legal obligation.

Cookie-related information: For the duration specified for the relevant cookie or similar technology, as described in our Cookie Policy or the website’s cookie preference settings.

Payment records held by Stripe: Retention is governed by the applicable arrangements between Stripe and the relevant parties, as well as Stripe’s own retention obligations and policies.

These periods are applied according to the category of information and its continuing purpose. Where information is no longer required and no legal or legitimate business reason remains for retaining it, we will delete it, anonymise it or otherwise cease retaining it in accordance with applicable law.

Where a legal claim, investigation or statutory requirement necessitates longer retention, the relevant information may be retained for the period reasonably required for that purpose.

10. Cookies and Similar Technologies

Our website may use cookies and similar technologies to support essential website functions, remember relevant preferences, understand website usage and support other functions described in our Cookie Policy.

Where consent is required for non-essential cookies, those cookies will be used only after the relevant consent has been obtained. You may manage available preferences through the website’s cookie settings.

Disabling certain cookies may affect the availability or operation of some website functions.

Please refer to our Cookie Policy for further information about cookie categories, purposes and applicable retention periods.

11. Data Protection

Drapeandlayer takes reasonable organisational and technical measures appropriate to the nature of the personal data it handles. These measures are intended to reduce the risk of unauthorised access, disclosure, alteration, loss or misuse.

Access to personal data is limited according to relevant business requirements. Where service providers process personal data on our behalf, we take appropriate steps to address their handling of that information through relevant contractual and operational arrangements.

No method of electronic transmission or data storage is entirely free from risk. We review relevant practices as appropriate to our business operations and applicable legal obligations.

12. Your Data Protection Rights

Where the GDPR or UK GDPR applies, you may have the following rights, subject to applicable legal conditions and exceptions:

  • Access: Request information about the personal data we process about you and obtain a copy where applicable.
  • Rectification: Request correction of inaccurate or incomplete personal data.
  • Erasure: Request deletion of personal data where the applicable legal conditions are met.
  • Restriction: Request that certain processing activities be restricted in qualifying circumstances.
  • Data portability: Request a copy of eligible personal data in a commonly used, machine-readable format where the right applies.
  • Objection: Object to processing based on legitimate interests in circumstances provided by law and object to direct marketing.
  • Withdrawal of consent: Withdraw consent where processing relies on consent.
  • Complaint: Lodge a complaint with the competent data protection supervisory authority.

These rights are subject to applicable conditions. We may need to retain certain information to comply with legal obligations or establish, exercise or defend legal claims.

Under Singapore’s PDPA, individuals may also exercise applicable rights to request access to or correction of their personal data, subject to statutory exceptions.

To exercise a relevant right, contact us at xiangpay@drapeandlayer.com. We may request information reasonably necessary to verify your identity and understand your request before responding.

Where the GDPR applies, we will respond within the applicable statutory timeframe. Where permitted by law, additional time may be available for complex or numerous requests.

13. Marketing Communications

We may send information about our products or business where permitted by applicable law.

Where consent is required, we will obtain it before sending the relevant communications. You may withdraw consent or opt out of marketing communications at any time using the unsubscribe facility provided or by contacting xiangpay@drapeandlayer.com.

Opting out of marketing communications does not prevent us from sending non-promotional messages necessary to administer an existing order or respond to a request.

14. Children’s Privacy

Our website is intended for individuals who are legally able to enter into purchases under the laws applicable to them. We do not knowingly seek to collect personal data from children where such collection is prohibited by applicable law.

If we become aware that personal data has been collected in circumstances that are not permitted, we will assess the matter and take appropriate action in accordance with applicable legal requirements.

15. Third-Party Websites and Services

Our website may contain links to websites or services operated by other organisations, including Stripe’s payment-related information pages.

Those organisations may process personal data under their own privacy policies and terms. Drapeandlayer does not control the privacy practices of independent websites and encourages visitors to review the relevant information before providing personal data to them.

16. Changes to This Privacy Policy

We may revise this Privacy Policy when our business practices, website functions or applicable legal requirements change.

The revised version will be published on this page with an updated revision date. Where applicable law requires additional notice or consent for a material change, we will take the relevant steps.

17. Contact Us

For questions about this Privacy Policy, requests concerning personal data or other privacy-related matters, please contact:

Email: xiangpay@drapeandlayer.com

Please describe your request clearly and include relevant information to help us identify the matter. Do not include complete payment card details or other unnecessary confidential information in your email.

We will review and respond to privacy enquiries in accordance with applicable legal requirements.