Privacy Policy

Who we are

VELDT & VEIN ("we", "us", "our") is a brand operated by [Legal Entity Name], a private limited company incorporated in Singapore with company registration number [UEN], registered address [Address], Singapore [Postcode]. We are the data controller for the personal data described in this policy.

You can contact us, including our Data Protection Officer, at:

• Email: [email protected]
• Postal: [Address], Singapore [Postcode]
• Data Protection Officer: the person responsible for our data-protection practices, reachable at the same email.

What this policy covers

This policy applies to your use of veldtandvein.com (the "Site") and to any data we collect when you contact us, sign up for our newsletter, or submit a wholesale or press enquiry. We are an editorial-stage brand and do not currently sell directly to consumers through this Site. If we add direct sales in future, this policy will be updated and you will be notified.

Personal data we collect

We collect only what we need.

Contact form

Your name, email address, and the content of your message.

Newsletter sign-up

Your email address. Optionally, your first name and country.

Wholesale / trade enquiry form

Your business name, your name, business email, country, business website, the content of your message, and optionally your retail category and approximate annual purchase volume.

Press enquiry form

Your name, the publication you write for, your email, and the content of your enquiry.

Server logs

Through our hosting and analytics provider, Cloudflare, we receive truncated and anonymised IP addresses, browser user-agent strings, page URLs, referring URLs, and timestamps. We use Cloudflare Web Analytics, which is cookieless and does not fingerprint individuals or track you across sites.

What we do not collect

We do not currently take payments. We do not operate a customer account system. We do not collect special category or sensitive personal data (health information, biometric data, religious or political beliefs, sexual orientation). We do not knowingly collect personal data from children.

Why we process your data, and on what legal basis

We process your personal data for the following purposes, with the following legal bases under the GDPR (and equivalent under the Singapore PDPA):

• Responding to your enquiries. Legal basis: legitimate interest in responding to communications you initiate, and pre-contractual steps you request (GDPR Art.6(1)(b) and (f); deemed consent under PDPA s.15).
• Sending you our newsletter, where you opted in. Legal basis: your consent (GDPR Art.6(1)(a); PDPA s.13). You can withdraw at any time using the unsubscribe link in any newsletter, or by emailing us.
• Wholesale and press correspondence. Legal basis: legitimate interest, and pre-contractual steps where applicable.
• Site analytics and security. Legal basis: legitimate interest in operating a secure, performant website.
• Compliance with legal obligations. Including responding to lawful requests from public authorities.

Who receives your data

We share your data only with carefully selected service providers acting as processors on our behalf:

• Cloudflare, Inc. — hosting, content delivery network, analytics, and key-value storage of form submissions. Cloudflare operates globally with data centres in the European Union and Singapore. It is bound by Standard Contractual Clauses for transfers from the EU/EEA and provides a comparable standard of protection for transfers from Singapore.
• Our email service provider — for sending transactional and newsletter emails.
• Our professional advisors — including lawyers and accountants — and authorities where legally required.

We do not sell or rent your personal data. We do not engage in cross-context behavioural advertising. We do not use your data to train AI models.

International transfers

Because we operate globally, your data may be transferred to and stored in countries outside Singapore, the European Economic Area, the United Kingdom, or your country of residence, including the United States. Where we transfer data:

• From the EEA/UK: we rely on Standard Contractual Clauses approved by the European Commission, and the UK International Data Transfer Addendum where applicable.
• From Singapore: we ensure recipients provide a standard of protection comparable to the PDPA, in line with PDPA s.26 and the Personal Data Protection Regulations 2021.

How long we keep your data

We retain personal data only as long as needed for the purpose it was collected:

• Contact and press enquiries: up to 24 months from your last contact.
• Wholesale enquiries: up to 36 months, longer if a commercial relationship begins (in which case retention is governed by that relationship).
• Newsletter: until you unsubscribe; backup copies are purged within 90 days.
• Server logs: 30 days.

After these periods, data is deleted or fully anonymised.

Your rights

Depending on where you live, you have rights to:

• Access the personal data we hold about you.
• Correct data that is inaccurate or incomplete.
• Request deletion ("right to be forgotten" under GDPR; equivalent rights exist under CCPA and PDPA).
• Object to or restrict our processing.
• Data portability — to receive your data in a structured, machine-readable format.
• Withdraw consent at any time, without affecting the lawfulness of prior processing.
• Lodge a complaint with a supervisory authority (see below).

Supervisory authorities

• Singapore: Personal Data Protection Commission, pdpc.gov.sg
• European Union / EEA: your local Data Protection Authority
• United Kingdom: Information Commissioner's Office, ico.org.uk
• California: California Privacy Protection Agency, cppa.ca.gov

To exercise any of these rights, email [email protected]. We will respond within the period required by applicable law (30 days under Singapore PDPA, one month under GDPR, 45 days under CCPA).

Children

The Site is not directed at children, and we do not knowingly collect personal data from anyone under 16. If you believe we have, please contact us and we will delete the data.

Security

We use industry-standard technical and organisational measures, including TLS encryption in transit, encryption at rest for stored form data in Cloudflare KV, role-based access controls, and regular security review. No system is perfectly secure. We will notify you and the relevant supervisory authority of a notifiable data breach in line with applicable law.

Cookies and tracking

We do not use marketing or advertising cookies. We use Cloudflare Web Analytics, which is cookieless. Cloudflare's security platform may set strictly-necessary cookies (such as __cf_bm) for bot detection; these are exempt from consent requirements under EU ePrivacy rules. Full details are in our Cookie Notice.

Changes to this policy

We may update this policy. Material changes will be flagged at the top with a new "Last updated" date and, where required, by direct notice (such as a newsletter email).

Jurisdiction

This policy is governed by the laws of Singapore, without prejudice to any mandatory rights you have under your local data protection law.