Privacy Policy

1. Who we are

This privacy policy explains how TYT Spring (UEN 53523462K), 11 Silat Avenue, Singapore 168877 (“TYT Spring”, “we”, “us”) collects, uses and discloses personal data through massageoil.sg (the “Website”). It also explains how you can contact us about it.

We follow the Personal Data Protection Act 2012 of Singapore (“PDPA”).

2. Our Data Protection Officer

Contact our Data Protection Officer if you have a question about your personal data, want to see or correct it, or want to withdraw consent:

• Name: Jonathan
• Email: support@massageoil.sg
• Phone / WhatsApp: +65 8996 0336
• Address: 11 Silat Avenue, Singapore 168877

3. What we collect

3.1 When you send an enquiry through the form

When you submit the enquiry form on the Website, we collect:

• your name;
• your email address;
• your business/entity/company name;
• how many jars you need;
• your message, and anything else you choose to tell us in it.

Some of this may be business contact information, for example a business email address you give us for your parlour. We treat all enquiry details as personal data and protect them the same way.

3.2 When you message us on WhatsApp

If you tap a WhatsApp button, WhatsApp opens a chat with our WhatsApp Business number. We receive your phone number, your WhatsApp profile name and what you write to us. The Website itself does not see or store your chat.

3.3 When you visit the Website

Like every website, ours receives basic technical information each time a page loads: your IP address, your browser and device type, the page requested and the time. Our hosting provider uses this to deliver the Website and keep it secure.

3.4 Only if you accept optional tracking

If you click Accept on our cookie banner, we also collect information about how you use the Website:

• the pages and buttons you view or click;
• how you arrived, including campaign tags in the link (such as utm_source);
• your approximate location, worked out from your IP address;
• your device and browser details.

We also measure whether our Meta (Facebook and Instagram) adverts led to an enquiry. Section 5 explains the tools involved.

We do not collect the contents of the form through these tools. A form submission is recorded only as “an enquiry was sent”. Session recordings hide all on-page text and everything typed into the form.

4. Why we use it

• Enquiry form details: to reply to your enquiry, prepare a quote, arrange your order and delivery, and keep a record of what we agreed.
• WhatsApp messages: to reply to you and arrange your order and delivery.
• Technical information: to deliver the Website, keep it secure and fix problems.
• Optional tracking (with your consent): to see how many people visit and enquire, which adverts and links bring them, and where the Website is hard to use, so we can improve it.

We will only contact you about your enquiry and any order that follows. We will not send you marketing messages unless you separately agree to receive them.

5. Cookies, local storage and tracking

Cookies are small files a website saves in your browser. Local storage is similar browser storage that is not a cookie.

• Cookie banner (Website, always): remembers whether you accepted or refused optional tracking. Saved in your browser’s local storage and not sent to us.
• Hosting and security (Cloudflare, always): delivers the Website and protects it from attacks. May set security cookies.
• Google Tag Manager (Google, always): loads the tools below, and only after you accept. It loads nothing optional without consent.
• Google Analytics 4 (Google, only if you accept): visitor and enquiry statistics, and which campaigns bring visitors.
• Microsoft Clarity (Microsoft, only if you accept): shows where visitors click and scroll, and records sessions with all text hidden, to find usability problems.
• Meta Pixel (Meta, only if you accept): measures whether our Facebook and Instagram adverts lead to enquiries, and helps Meta show our adverts to people likely to enquire.

If you refuse, none of the optional tools load. The Website, form and WhatsApp buttons work exactly the same.

To change your mind, go to our privacy policy page at massageoil.sg/privacy-policy and change your cookie choice there. If you withdraw consent, the optional tools stop loading. We also remove their cookies from our domain where your browser allows. Information collected before you withdrew stays with the provider for the period in Section 8.

No retargeting. We do not use remarketing or retargeting. We do not build advertising audiences from Website visitors or enquiries, and we never upload your details to an advertising platform.

6. Who we share it with

We do not sell your personal data. We share it only with the service providers that run the Website for us, under their terms, and only for the purposes above:

• Web3Forms: your enquiry form details, to deliver the form to our inbox.
• Cloudflare: technical information for each visit, for hosting, delivery and security.
• Google: analytics data (only if you accept), for Google Analytics 4 and Tag Manager.
• Microsoft: usage data (only if you accept), for Microsoft Clarity.
• Meta: advert measurement data (only if you accept) and WhatsApp chats you start with us, for the Meta Pixel and WhatsApp.
• V and Bruno LLC (United Arab Emirates): access to the services above, only to build, maintain and fix the Website on our instructions.

We may also disclose personal data where the law requires it, or to professional advisers bound by confidentiality.

7. Transfers outside Singapore

Some of these providers process data outside Singapore:

• Cloudflare runs a global network.
• Web3Forms is hosted on Amazon Web Services.
• Microsoft stores Clarity data in its Azure cloud.
• Google and Meta operate internationally.
• Technical support for the Website, such as fixing errors, may be provided from outside Singapore.

When we transfer personal data overseas, we make sure it is protected to a standard comparable to the PDPA. We do this through each provider’s data-processing terms and through our written agreement with our agency.

8. How long we keep it

• Enquiry form copies held by Web3Forms: deleted automatically 30 days after submission.
• Enquiries and orders in our own records: as long as needed to handle your enquiry or order, and up to 5 years for business and tax records.
• WhatsApp chats: as long as needed to handle your enquiry or order, and up to 5 years for business and tax records.
• Google Analytics 4: 14 months.
• Microsoft Clarity session recordings: up to 30 days; other Clarity data under Microsoft’s terms.
• Meta Pixel data: under Meta’s terms.
• Cloudflare request and security logs: under Cloudflare’s terms.
• Your cookie choice: in your browser until you clear it or we change the tools we use.

When we no longer need personal data for these purposes or for legal or business reasons, we delete or anonymise it.

9. How we protect it

The Website and form use HTTPS. Access to our accounts is limited to the people who need it, and is protected by multi-factor authentication where available. Our providers protect data on their own systems under their terms. No method of sending or storing data is completely secure, but we take reasonable steps to protect yours.

10. Your choices and rights

• Access: ask what personal data we hold about you and how we have used or disclosed it in the past year.
• Correction: ask us to correct personal data that is wrong or incomplete.
• Withdraw consent: for optional tracking, change your cookie choice on our privacy policy page (massageoil.sg/privacy-policy). For anything else, contact our Data Protection Officer. We will tell you what withdrawing means, for example that we may not be able to complete an order.

To make a request, contact our Data Protection Officer (Section 2). We will reply as soon as reasonably possible: within 30 days, or we will tell you when we can. We may ask you to confirm your identity. We may charge a reasonable fee for access requests, and will tell you about it first.

11. Children

The Website is for businesses and adults. We do not knowingly collect personal data from children.

12. Data breaches

If a data breach affects your personal data and is likely to cause you significant harm, we will notify you and the Personal Data Protection Commission as the PDPA requires.

13. Changes to this policy

We will update this policy, and the date above, when we change how the Website handles personal data. If we add a new tracking tool, we will ask for your consent again first.