Privacy Policy
This Privacy Policy explains how Mintflux Co (“we”, “us”) collects, uses, discloses and protects your personal data when you sell items to us or otherwise deal with us, in line with Singapore’s Personal Data Protection Act 2012 (PDPA). It forms part of our Terms of Service, and by using our services you acknowledge that you have read and understood it.
1. Who this policy covers
It covers sellers and anyone else who deals with us; it does not cover the third parties you also deal with.
This policy applies to sellers and anyone else who contacts us, submits an order, uses our website or joins a community platform we run. It covers how we buy items from sellers, inspect them, ship them and pay you. It does not cover third-party platforms, payment providers and carriers, which have their own privacy policies.
2. Personal data we collect
What you give us, what we observe, what we receive from carriers and providers, and what we create ourselves.
From you. Your name, email address or username, contact details, shipping and return addresses, payout details (Wise, bank account, PayPal or crypto wallet details), order and item details, receipts and photos, tax or identification information where the law requires it, and the messages you send us, including on third-party platforms.
Verification data. Where the law requires it, identification documents such as your NRIC, passport or equivalent, and proof of address, for compliance purposes such as anti-money laundering, fraud prevention or age verification.
Records of your acceptance. The ticket, message or order in which you accepted our Terms and this policy, and when you did so.
Automatically. If you use our website, technical data such as your IP address, browser and device type, and the pages you view and when.
From third parties. Tracking and delivery information from carriers, payout confirmations from payment providers, and, where the law allows, information from fraud-prevention sources.
Created by us. Order, inspection and payout records, photographs and notes from inspecting your items, and fraud-prevention records such as account flags and investigation notes.
Accuracy. Please keep your details up to date so that we can process your orders and payouts correctly.
3. Why we use your personal data
To buy from you, pay you, ship your goods, keep the platform honest and meet our legal obligations.
Purposes. We use your personal data to process your orders and pay you; arrange shipping and handle courier claims; inspect items and verify their authenticity; verify who you are; prevent, detect and investigate fraud and counterfeit or tampered items; communicate with you about your account and orders; handle disputes and appeals; enforce our Terms; meet our legal obligations, including tax and record-keeping; protect the rights, property and safety of Mintflux Co and others; improve our services; and for any other purpose you consent to.
No selling. We do not sell your personal data.
4. Consent and other bases
We act on your consent, and on the narrower grounds the PDPA allows where consent is not the right basis.
Consent. We collect, use and disclose your personal data with your consent. By providing your details or using our services, you consent to the purposes in this policy.
When we do not need fresh consent. The PDPA also allows us to use your data in some cases without asking again: where it is needed to perform our contract with you (for example, to ship your order and pay you), where we have notified you and you do not object, where the law requires it, and for legitimate interests such as preventing fraud and keeping our platform secure. Where we rely on legitimate interests, we first assess that they outweigh any adverse effect on you.
Withdrawing consent. You may withdraw your consent at any time by giving us reasonable notice through our Data Protection Officer. We will tell you the likely consequences, which may include that we can no longer process your orders or payouts, and we will act on your request within a reasonable time. Withdrawal does not affect any legal consequences that arise from it.
Other people’s data. If you give us another person’s personal data, you confirm that you have their consent to do so.
5. Fraud prevention and item authenticity
To keep our platform trustworthy, we check who is selling to us and what we receive.
What we do. We inspect and photograph items on arrival, compare shipment, tracking and box-count records, and keep account flags and investigation notes. We use these records to verify that items are authentic, to exclude items that fail inspection from your payout or return them as our Terms describe, to detect duplicate or evasive accounts, and to resolve disputes and courier claims.
Reporting. Where we suspect fraud, tampering, counterfeiting or other unlawful activity, we may report it to the relevant authorities and rights holders and share the records needed for that purpose, as our Terms describe.
Why and how long. We do this because it is necessary to protect our business and other sellers from fraud, and we keep these records for as long as needed for an investigation, a claim or a legal time limit.
6. Messages and marketing
Messages about your orders are not marketing, and marketing only reaches you if you asked for it.
Service messages. We send messages about your account, orders, payouts, security and changes to our terms through our ticket channels, email or other channels you use with us. These are not marketing messages.
Marketing. We send marketing messages, such as promotions or offers, only if you have agreed to receive them, and each one will tell you how to opt out. You can also opt out at any time by telling us. For Singapore telephone numbers, we follow the PDPA’s Do Not Call rules.
7. Who we share it with
Only those who need it to pay you, move your goods, keep us lawful or protect the platform.
Recipients. We share personal data only where needed for the purposes above. This includes payment providers and banks that process your payouts; carriers and couriers that move your shipments, including for courier claims; service providers that supply hosting, communication, analytics and support tools; professional advisers, auditors and insurers; law enforcement, regulators and courts where the law requires it or where we suspect fraud, counterfeiting or other unlawful activity; rights holders, where we report suspected counterfeit items; a buyer or successor if our business is sold, subject to the protections in this policy; and anyone else with your consent.
Payout details. We use your payout details only to pay you and to keep records of payments.
Service providers. We take steps to make sure our service providers protect your data and use it only for the services they provide to us.
8. Transfers and storage outside Singapore
Your data may be handled abroad, with protection comparable to the PDPA.
Transfers. Your data may be handled outside Singapore, for example by payment providers, carriers and cloud services, and in the country your shipment is sent to. Where this happens, we take steps to make sure it receives a standard of protection comparable to the PDPA, for example through contracts with the recipient.
Where data is stored. Your personal data is stored on cloud services located in Singapore and the United States.
9. Cookies and analytics
Our website uses cookies for essential functions and to understand how it is used.
Cookies. If you visit our website, it may use cookies and similar technologies for essential functions such as security and sessions, to remember your preferences, and to understand how the site is used.
Analytics. We may use analytics tools to understand how our services are used and to improve them. We use this information to improve our services, and we do not sell it.
Your choices. You can manage or block cookies in your browser settings. Blocking essential cookies may stop parts of our website from working.
10. How long we keep it
Only as long as we need it, and then we delete or anonymise it.
Retention. We keep personal data only for as long as we need it for the purposes above or for business and legal reasons, and then delete or anonymise it. If you ask us to delete data, we may still keep what the law permits or requires, such as records for tax, fraud prevention and legal claims.
We generally keep:
| Record | Kept for |
|---|---|
| Transaction, payout and tax records | 5 years |
| Account and contact details | As long as your account is active, and 2 years after that |
| Support messages | 2 years |
| Website logs | 12 months |
| Fraud investigation records | Until the matter, and any related claim period, has ended |
11. Security and data breaches
We protect your data with reasonable safeguards, and we report a notifiable breach.
Security. We use reasonable security arrangements to protect personal data, including limiting access to people who need it, protecting our accounts and systems, and choosing and reviewing the providers we use. No method of storage or transmission is completely secure.
Data breaches. If a data breach occurs that we are required to report, we will notify the Personal Data Protection Commission, generally within 3 calendar days of assessing that it is notifiable, and affected individuals as the PDPA requires.
12. Your rights: access, correction and withdrawal
You may ask what we hold, ask us to correct it, and withdraw your consent.
Access. You may ask for the personal data we hold about you and how it has been used or disclosed in the year before your request. We may charge a reasonable fee for access requests, and we will tell you before we do.
Correction. You may ask us to correct an error or omission in your personal data. We do not charge for correction requests.
Withdrawal. You may withdraw your consent as described in Section 4.
How to ask. Contact our Data Protection Officer in writing, for example by email or through a ticket. We may need to verify your identity first.
How we respond. We aim to respond within 30 days. If we need longer, we will tell you in writing when we can respond. If we cannot fully meet a request, we will explain why where the PDPA requires. If you are not satisfied, please contact us first; you may also raise a concern with the Personal Data Protection Commission.
13. Age
Our services are for adults, or for minors with a parent or guardian’s consent.
Our services are for people who are 18 or older, or who have the consent of a parent or legal guardian. If you believe a minor has given us personal data without that consent, contact us and we will take steps to delete it. Parents and guardians can also contact our Data Protection Officer to ask about a minor’s personal data.
14. Third-party platforms and links
Their policies, not ours, cover what you give them.
Our services may link to or run alongside third-party platforms, carriers and payment providers. Their own privacy policies apply to information you give them, and this policy does not.
15. Changes and governing law
We will tell you before a material change takes effect, where we reasonably can.
Changes. We may update this policy from time to time. Where reasonably possible, we will give notice of material changes through our ticket channels or on our platform before they take effect, and we will update the “Last updated” date above. If we want to use your data for a new purpose, we will ask for your consent where the PDPA requires it.
Governing law. This policy is governed by the laws of Singapore, in line with our Terms of Service.
16. Contact us
One inbox reaches both the company and our Data Protection Officer.
Data Protection Officer and company. For any question about this policy, or to make a request under Section 12, contact us at mintfluxco@gmail.com. This inbox also reaches our Data Protection Officer.
This policy is issued by Mintflux Co, trading as and operated by Mintflux Trading.