- Data Controller
The Data Controller responsible for your personal data is www.ringandrail.com (“Ringandrail”, “we”, “us”, or “our”).
Brand Name: Ringandrail
Website: www.ringandrail.com
Postal Address: xxx
Telephone: xxx
Email: order@ringandrail.com
- General Principles & Compliance
We are committed to respecting and protecting your privacy. This Privacy Policy sets out the basis on which personal data collected from you, or provided by you, will be processed by us. This policy complies with applicable data protection laws, including the Singapore Personal Data Protection Act (PDPA) and the European Union General Data Protection Regulation (EU GDPR) / UK GDPR. - Personal Data We Collect
We collect and process personal data necessary for fulfilling your orders and managing our commercial relationship with you. This includes:
Identity & Contact Data: Name, shipping address, billing address, email address, and contact telephone number.
Transactional Data: Details of products ordered, order history, and payment status.
Technical Data: Internet Protocol (IP) address, browser type, time zone setting, operating system, and standard web access logs collected automatically during your visit.
- Legal Basis and Purpose of Processing
We process personal data based on the following legal grounds:
Contract Performance: Processing is necessary to fulfill and deliver your orders, manage your account, and provide customer support.
Legal Obligation: Processing is required to comply with statutory accounting, taxation, and regulatory duties under applicable laws.
Legitimate Interests: Processing is necessary for our legitimate business interests, including maintaining website security and improving customer service efficiency.
- Payment Processing
All payment transactions conducted on our website are processed by our third-party payment service provider, Stripe.
When you place an order, payment details (such as card details and billing addresses) are transmitted directly to Stripe’s encrypted servers. www.ringandrail.com does not collect, store, or process complete payment card numbers or security credentials on its servers. Stripe handles personal data in accordance with their strict privacy standards and regulatory security frameworks.
- Data Sharing and Third Parties
We do not sell, trade, or rent personal data to third parties. We disclose personal data solely to trusted third-party service providers acting on our behalf for essential operations:
Payment Processor: Stripe, for secure transaction authorization and processing.
Logistics & Delivery Partners: Fulfilment and courier services to dispatch and deliver physical goods to your designated shipping address.
IT & Hosting Services: Technical infrastructure providers that support our website operations.
All service providers are bound by strict contractual obligations to handle your data confidentially and solely in accordance with our instructions.
- International Data Transfers
As our operations are located in Singapore and we serve customers located in Europe, personal data may be transferred, stored, or processed across international borders.
When transferring data from the European Economic Area (EEA) or UK to Singapore or other international jurisdictions, we ensure appropriate safeguards are implemented in compliance with GDPR requirements (such as Standard Contractual Clauses) and Singapore PDPA transfer rules, ensuring a level of data protection consistent with applicable legislation.
- Data Retention
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, or to comply with statutory legal, accounting, and reporting obligations.
Order and Transaction Records: Retained for up to 7 years following completion of an order to comply with statutory tax, legal, and financial reporting duties under Singapore and European commercial laws.
Customer Communication Logs: Retained for up to 3 years from the date of last interaction for administrative and customer support reference.
Technical and Access Logs: Retained for a maximum period of 12 months for website management and operational diagnostics.
Upon expiration of the applicable retention period, personal data will be securely deleted or permanently anonymised.
- Your Legal Rights
Under Singapore PDPA and European Data Protection Laws (GDPR), you possess specific legal rights regarding your personal data, subject to legal limits:
Right of Access: The right to request copies of the personal data we hold about you.
Right to Rectification: The right to request correction of inaccurate or incomplete personal data.
Right to Erasure: The right to request deletion of your personal data where there is no legal requirement for its continued retention.
Right to Restrict Processing: The right to request limitation of data processing under certain conditions.
Right to Data Portability: The right to receive personal data concerning you in a structured, commonly used machine-readable format.
Right to Object: The right to object to the processing of personal data processed on the legal basis of legitimate interests.
To exercise any of these rights, please contact our Data Protection point of contact via email at order@ringandrail.com.
- Data Protection Measures
We maintain standard technical and organisational measures designed to protect personal data against accidental loss, unauthorized access, disclosure, alteration, or destruction. Access to personal data is restricted to authorized personnel who require access for legitimate operational purposes. - Amendments to this Privacy Policy
We reserve the right to modify this Privacy Policy as necessary to reflect operational, legal, or regulatory updates. Any changes will be posted on this page with an updated effective date. Continued use of our website constitutes acknowledgement of the updated policy terms.
