1. Introduction

Festestockco (“we”, “us” or “our”) respects your privacy and is committed to handling personal data responsibly. This Privacy Policy explains how we collect, use, disclose, retain and otherwise process personal data when you visit www.festestockco.com, purchase our party and festive decoration supplies, or contact us.

We process personal data in accordance with applicable data protection laws, including Singapore’s Personal Data Protection Act 2012 (“PDPA”) and, where applicable, the European Union General Data Protection Regulation (“GDPR”) and relevant national data protection legislation.

By using our website or providing personal data to us, you acknowledge that you have had the opportunity to read this Privacy Policy. Where consent is required by law, we will seek your consent before carrying out the relevant processing.

2. Data Controller and Contact Details

For the purposes of this Privacy Policy, Festestockco is the designated data controller responsible for determining the purposes and means of processing personal data collected through our website and customer service activities, subject to the respective legal roles of other parties involved in processing.

Data Controller: Festestockco

Website: www.festestockco.com

Email: stock@festestockco.com

Telephone: +65 6443 5526

Business Address: 62 Ubi Road 1, #02-03, Oxley BizHub 2, Singapore 408734

For questions about this Privacy Policy or requests concerning your personal data, please contact us using the details above.

3. Personal Data We Collect

Depending on how you interact with our website, we may collect the following categories of personal data.

3.1 Information You Provide

This may include:

• Name and contact details, including email address and telephone number.
• Billing and delivery addresses.
• Order details, purchased items, quantities and transaction references.
• Information you provide when contacting customer service or submitting a return or refund request.
• Preferences and communication choices that you voluntarily provide.

3.2 Payment and Transaction Information

We use Stripe as our payment processor to process payments for purchases made through our website.

Depending on the payment method used, payment processing may involve payment card details, billing information, transaction identifiers, payment status and related transaction records.

Payment card details submitted through Stripe’s payment services are handled in accordance with Stripe’s applicable privacy terms and processing arrangements. We do not intend to store complete payment card numbers or card verification codes in our own customer records.

We may receive payment confirmations, transaction references, payment status and other information necessary to administer orders, process refunds, maintain transaction records and respond to payment-related enquiries.

Stripe may act as a data processor when providing payment services on our instructions and as an independent data controller for certain activities it determines, including its own legal compliance and fraud-prevention activities. Stripe’s processing is also governed by its own applicable privacy policy.

For further information, please refer to Stripe’s Privacy Centre.

3.3 Automatically Collected Information

When you visit our website, certain information may be collected automatically, depending on the website functions and settings in use. This may include:

• IP address and general device information.
• Browser type, operating system and language preferences.
• Pages viewed, referring pages and approximate visit times.
• Website interaction records and diagnostic logs.
• Cookie identifiers and related preference information.

We use this information where necessary to operate the website, understand general usage patterns, maintain records of user preferences and identify technical issues.

4. Purposes and Legal Grounds for Processing

We process personal data only for specified purposes and where an applicable legal ground permits us to do so.

Purpose	Legal ground, where applicable
Processing purchases and administering orders	Performance of a contract or steps taken at your request before entering into a contract
Processing payments and refunds	Performance of a contract and compliance with applicable legal obligations
Responding to enquiries and providing customer service	Performance of a contract, legitimate interests or consent, as applicable
Maintaining accounting, tax and transaction records	Compliance with applicable legal obligations
Maintaining website records and addressing operational issues	Legitimate interests, where these are not overridden by your rights and interests
Identifying suspicious transactions and handling payment-related concerns	Legitimate interests or applicable legal obligations, as appropriate
Sending promotional communications	Consent or another lawful basis where permitted by applicable law
Using non-essential cookies and similar technologies	Consent where required by applicable law

Where we rely on legitimate interests, those interests may include administering our business, maintaining transaction records, responding to customer enquiries and protecting our legal position. We consider the necessity of the processing and its impact on individuals.

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect processing lawfully carried out before withdrawal.

5. How We Use Personal Data

We may use personal data to:

1. Receive and administer orders.
2. Process payments, refunds and related transaction enquiries.
3. Communicate order confirmations and relevant order updates.
4. Respond to questions, complaints and customer service requests.
5. Maintain accounting, tax and business records.
6. Administer returns and assess requests relating to purchases.
7. Operate and maintain website functions.
8. Review suspicious activity and address potential misuse.
9. Meet applicable legal and regulatory requirements.
10. Send permitted promotional communications in accordance with your preferences and applicable law.

We do not use personal data for purposes that are incompatible with the purposes for which it was collected unless an applicable legal ground permits the further processing.

6. Disclosure of Personal Data

We may disclose relevant personal data to the following categories of recipients where necessary and lawful.

6.1 Stripe

Stripe processes payment-related information to facilitate transactions, communicate payment results and provide related payment services. Depending on the activity, Stripe may process information on our instructions or determine its own purposes and means of processing.

Stripe’s handling of personal data is subject to its applicable privacy policy and contractual arrangements.

6.2 Service Providers

We may share relevant information with providers supporting our website hosting, website maintenance, order administration, customer communications and other business operations.

Such providers may process personal data on our behalf where required to deliver their services, subject to applicable contractual and legal obligations.

6.3 Delivery and Fulfilment Providers

We may disclose the recipient’s name, delivery address, contact details and relevant order information to delivery or fulfilment providers when necessary to fulfil a purchase and arrange delivery.

6.4 Professional Advisers and Authorities

We may disclose personal data to accountants, legal advisers, insurers, courts, regulators, law enforcement bodies or other relevant authorities where reasonably necessary to comply with legal obligations, establish or defend legal claims, or respond to lawful requests.

6.5 Business Transfers

Where relevant to a proposed or completed business sale, restructuring or transfer of business assets, personal data may be disclosed to the parties involved where permitted by applicable law and subject to appropriate safeguards.

We do not sell personal data in exchange for payment.

7. International Transfers of Personal Data

Festestockco operates from Singapore and serves customers in European markets. Personal data may therefore be processed or accessed in Singapore and other countries where our service providers or payment processing arrangements operate.

Where the GDPR applies, transfers of personal data outside the European Economic Area (“EEA”) will be carried out in accordance with applicable international transfer requirements. Depending on the circumstances, this may involve an adequacy decision, appropriate contractual safeguards such as the European Commission’s Standard Contractual Clauses, or another lawful transfer mechanism.

Where required, we will assess the relevant transfer arrangements and implement appropriate supplementary measures.

For transfers governed by Singapore’s PDPA, we will comply with the applicable requirements concerning overseas transfers of personal data.

8. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, including the fulfilment of legal, accounting, tax and record-keeping obligations.

Our intended retention periods are as follows:

Data category	Intended retention period
Order, transaction and accounting records	Up to 7 years after the relevant transaction or completion of the relevant business relationship, where appropriate for accounting, tax, legal and claim-management purposes
Customer service correspondence and general enquiries	Up to 24 months after the enquiry is closed, unless further retention is required for an unresolved matter or legal claim
Return, refund and complaint records	Up to 7 years after the matter is closed where reasonably necessary for transaction records, legal obligations or the establishment or defence of claims
Marketing preferences and subscription records	Until consent is withdrawn or the relevant lawful basis ends, with periodic review and deletion or suppression when no longer needed
Website diagnostic and access logs	Normally up to 12 months, unless a longer period is reasonably required to investigate an incident or comply with legal obligations
Cookie and consent preference records	For the period stated in the applicable cookie settings or consent mechanism, with periodic review

These are our intended operational retention periods, not a statement that every category must be retained for the same period under every applicable law.

Where applicable law requires a longer period, we will retain the relevant information for that period. Where personal data is no longer required and no legal or legitimate business purpose justifies further retention, we will delete it, anonymise it or otherwise dispose of it appropriately.

Where a deletion request is subject to a lawful retention requirement or a need to establish, exercise or defend legal claims, the relevant information may be retained for that limited purpose.

9. Cookies and Similar Technologies

Our website may use cookies and similar technologies to support essential website functions, remember user preferences, record consent choices and understand website usage.

Depending on the functions enabled, cookies may be set by us or by service providers involved in website operation and payment processing.

Where required by applicable European law, non-essential cookies and similar technologies will be activated only after the required consent has been obtained. You may manage your preferences through the cookie settings available on our website or through your browser settings.

Disabling certain cookies may affect some website functions.

For more information, please refer to our Cookie Policy.

10. Data Protection and Confidentiality

We apply reasonable administrative, organisational and technical measures appropriate to the nature of the personal data we process. These measures are intended to reduce the risk of unauthorised access, disclosure, alteration, loss or misuse.

Access to personal data is limited to individuals and service providers who require it for relevant business purposes, subject to applicable confidentiality and data protection obligations.

Where a personal data breach triggers a notification requirement under applicable law, we will take the steps required by that law.

11. Your Data Protection Rights

Where the GDPR applies, you may have the following rights, subject to the conditions and exceptions set out in the law:

• Right of access: Request access to your personal data and information about how it is processed.
• Right to rectification: Request correction of inaccurate or incomplete personal data.
• Right to erasure: Request deletion of personal data where the legal conditions are met.
• Right to restriction: Request that certain processing activities be restricted in applicable circumstances.
• Right to data portability: Request a copy of qualifying personal data in a commonly used, machine-readable format.
• Right to object: Object to processing based on legitimate interests in circumstances provided by law, and object at any time to processing for direct marketing.
• Right to withdraw consent: Withdraw consent where processing relies on consent.
• Rights concerning automated decisions: Exercise applicable rights where a decision is based solely on automated processing and has legal or similarly significant effects.

These rights are not absolute and may be subject to legal conditions and exceptions.

Under Singapore’s PDPA, you may also have rights to request access to and correction of personal data, subject to applicable statutory exceptions. We will handle such requests in accordance with Singapore law.

To exercise a right, contact stock@festestockco.com and describe your request. We may ask for information reasonably necessary to verify your identity before responding.

We will respond within the period required by applicable law. Where a request cannot be fulfilled in full, we will explain the position where legally required.

12. Marketing Communications

We may send promotional emails where permitted by applicable law and where the necessary consent or other lawful basis has been obtained.

You may unsubscribe using the link included in a promotional email or contact us at stock@festestockco.com.

Unsubscribing from promotional communications will not prevent us from sending non-promotional messages necessary to administer an order, process a refund or respond to a customer service request.

We maintain relevant suppression records where necessary to respect your communication preferences.

13. Children’s Personal Data

Our website is intended for general customers purchasing party and festive decoration supplies and is not specifically directed at children.

We do not knowingly seek to collect personal data directly from children where such collection would be contrary to applicable law. Where we become aware that personal data has been collected unlawfully, we will take appropriate steps in accordance with applicable legal requirements.

14. Third-Party Websites and Services

Our website may contain links to websites or services operated by other organisations, including Stripe’s payment services.

When you visit or use an external service, its own privacy policy and terms may apply to the processing it carries out. We encourage you to review the relevant information before providing personal data directly to that service.

This Privacy Policy governs personal data processing carried out by or on behalf of Festestockco within the scope described above.

15. Changes to This Privacy Policy

We may update this Privacy Policy when our business practices, website functions or applicable legal requirements change.

The revised version will be published on www.festestockco.com with an updated revision date. Where applicable law requires specific notice or consent for a material change, we will follow the relevant requirements.

We encourage you to review this page periodically to remain informed about how personal data is handled.