Política de privacidade

Welcome to BuyAsATeam.com ("BuyAsATeam", "Platform", "we", "us", or "our").

We respect your privacy and are committed to protecting the personal data entrusted to us.

This Privacy Policy explains how we collect, use, disclose, process, store, transfer and protect personal data when you access or use BuyAsATeam.com, our mobile applications, digital services, marketplaces, referral programmes, purchasing programmes, seller services, group-buying services and other related products and services collectively referred to as the "Services".

This Privacy Policy is intended to comply with the Singapore Personal Data Protection Act 2012 ("PDPA"), its subsidiary legislation and applicable guidance issued by the Personal Data Protection Commission of Singapore ("PDPC").

Because BuyAsATeam may provide Services internationally, we also seek to follow recognised global privacy principles including transparency, purpose limitation, data minimisation, security, accountability, user control and privacy by design. Where the laws of another jurisdiction grant you additional mandatory privacy rights, those rights will apply to you to the extent required by law.

By using our Services or providing personal data to us, you acknowledge that you have read this Privacy Policy.

Where consent is required by applicable law, we will obtain the necessary consent before collecting, using or disclosing personal data for the relevant purpose.

The organisation responsible for personal data processed through BuyAsATeam.com is:

Legal name

[to be completed]

Operating as

BuyAsATeam / BuyAsATeam.com

UEN/Registration Number

[to be completed]

Registered Address

[to be completed]

Country

Singapore

For privacy-related enquiries, please contact our Data Protection Officer using the information provided under Section 25 of this Privacy Policy.

For purposes of this Privacy Policy, "personal data" means data, whether true or not, about an individual who can be identified:

1. from that data; or
2. from that data together with other information to which we have or are likely to have access.

Personal data may include information that directly identifies you as well as information that becomes identifiable when combined with other information.

Depending on how you use BuyAsATeam, we may collect the following categories of information.

4.1 Registration and Account Information

This may include:

• full name;
• username;
• email address;
• telephone number;
• country;
• city or region;
• preferred language;
• password or authentication information;
• profile photograph;
• account status;
• membership category;
• referral code;
• invitation link;
• inviter or sponsor information; and
• account creation and login history.

4.2 Identity and Verification Information

Where reasonably necessary for identity verification, fraud prevention, regulatory compliance or high-risk transactions, we may collect:

• date of birth;
• nationality;
• residential address;
• government-issued identification details;
• passport information;
• national identification information;
• identification-document images;
• selfie or liveness verification information;
• verification results; and
• information supplied by identity-verification service providers.

We seek to collect identification information only where reasonably necessary or legally required.

We do not use NRIC numbers, passport numbers or similar national identification numbers as passwords, default passwords or ordinary account-authentication credentials.

4.3 Buyer Information

When you purchase or participate in a purchase, we may process:

• products or services selected;
• quantities requested;
• group-buying participation;
• purchase contributions;
• fractional or proportional participation information where applicable;
• pricing;
• discounts;
• referral discounts;
• transaction history;
• delivery instructions;
• shipping address;
• refund information;
• disputes;
• returns; and
• communications relating to the transaction.

4.4 Seller and Service Provider Information

If you sell products or provide services through BuyAsATeam, we may collect:

• business name;
• business-registration information;
• owner or authorised representative details;
• contact information;
• seller profile;
• product and service listings;
• prices;
• wholesale or volume-pricing information;
• bank or payment settlement details;
• licences or permits where relevant;
• verification records;
• ratings;
• reviews;
• complaints;
• fulfilment information; and
• transaction history.

4.5 Payment and Financial Information

We may process information associated with payments, refunds, commissions, discounts, revenue sharing and withdrawals, including:

• payment method;
• payment provider;
• transaction reference;
• currency;
• payment amount;
• wallet information where applicable;
• payment status;
• commission information;
• withdrawal information;
• billing address;
• invoices and receipts; and
• transaction records.

Where payment-card processing is provided by a third-party payment processor, we may not receive or store your complete card details.

4.6 Referral and Commission Information

Where our referral, invitation, discount or commission programmes are used, we may process:

• referral links;
• referral codes;
• inviter relationships;
• referred members;
• referral attribution;
• purchases attributed to referrals;
• discounts generated through referrals;
• commissions earned;
• commission levels;
• payment history; and
• fraud-prevention information relating to referral activities.

This information is used to correctly calculate discounts, commissions, rewards and other programme benefits.

4.7 Communications and Customer Support Information

We may collect information contained in:

• customer-support requests;
• emails;
• live chats;
• complaint submissions;
• dispute-resolution communications;
• survey responses;
• feedback;
• telephone communications where lawfully recorded;
• seller-buyer communications conducted through the Platform; and
• communications with our compliance team.

4.8 Device and Technical Information

When you use the Platform, we may automatically collect information such as:

• IP address;
• device type;
• operating system;
• browser type;
• browser settings;
• device identifiers;
• login timestamps;
• referring URLs;
• pages visited;
• session information;
• approximate geographic location derived from IP address;
• error logs; and
• security and fraud-detection information.

4.9 Cookies and Similar Technologies

We may use:

• cookies;
• pixels;
• tags;
• local storage;
• software development kits;
• analytics technologies; and
• similar technologies.

These technologies may help us operate the Platform, remember preferences, secure accounts, understand usage, measure advertising effectiveness and personalise Services.

4.10 Fraud, Risk and Compliance Information

We may generate or receive information concerning:

• suspected fraudulent transactions;
• duplicate accounts;
• account takeovers;
• unusual payment behaviour;
• referral-programme abuse;
• sanctions screening where applicable;
• anti-money laundering checks where applicable;
• chargebacks;
• disputed transactions;
• policy violations; and
• security threats.

4.11 Information You Make Public

Certain information may be visible to other users if you choose to publish it, including:

• username;
• profile photograph;
• seller profile;
• business information;
• listings;
• ratings;
• reviews;
• public comments; and
• other information you intentionally publish.

You should not publish information that you wish to keep private.

We may obtain personal data:

1. directly from you;
2. automatically when you use our Services;
3. from sellers, buyers or service providers involved in your transaction;
4. through a person who refers or invites you to BuyAsATeam;
5. from payment service providers;
6. from identity-verification providers;
7. from fraud-prevention and cybersecurity providers;
8. from logistics and fulfilment providers;
9. from publicly available sources where lawful;
10. from affiliated companies;
11. from business partners; and
12. from regulatory, compliance or professional service providers where permitted by law.

We may collect, use or disclose personal data for purposes including:

Account Administration

• creating and maintaining your account;
• authenticating users;
• recovering accounts;
• maintaining user profiles;
• administering memberships; and
• communicating account information.

Marketplace Operations

• enabling buyers and sellers to transact;
• facilitating group purchases;
• combining purchasing demand;
• coordinating transaction groups;
• processing orders;
• facilitating seller fulfilment;
• administering proportional participation where applicable; and
• processing cancellations, refunds and returns.

Referral and Reward Programmes

• tracking invitation links and referral codes;
• identifying qualifying inviters;
• calculating buyer discounts;
• calculating commissions;
• allocating rewards;
• preventing referral fraud; and
• maintaining referral histories.

Payments

• facilitating payments;
• reconciling transactions;
• processing refunds;
• processing withdrawals;
• generating invoices and receipts;
• paying commissions;
• maintaining accounting records; and
• preventing payment fraud.

Identity Verification and Compliance

• verifying identity;
• preventing impersonation;
• investigating suspicious activity;
• complying with applicable legal requirements;
• performing fraud-prevention checks; and
• complying with regulatory or law-enforcement requests where legally required.

Customer Support

• responding to enquiries;
• resolving complaints;
• resolving transaction disputes;
• providing technical support; and
• communicating important changes to the Services.

Platform Improvement

• conducting analytics;
• testing new features;
• improving usability;
• understanding user behaviour;
• identifying system errors;
• developing new Services; and
• improving recommendations.

Security

• protecting accounts;
• detecting unauthorised access;
• detecting malicious activity;
• preventing cyberattacks;
• investigating security incidents;
• maintaining audit trails; and
• protecting BuyAsATeam, our users and third parties.

Legal and Business Administration

• maintaining business records;
• exercising or defending legal claims;
• enforcing agreements;
• conducting audits;
• obtaining professional advice;
• complying with tax or accounting requirements; and
• facilitating corporate transactions.

Where required under Singapore law, we will obtain consent before collecting, using or disclosing your personal data.

Depending on the circumstances and applicable law, personal data may also be processed based on:

• deemed consent;
• contractual necessity;
• compliance with legal obligations;
• legitimate interests where permitted;
• business-improvement purposes where permitted;
• fraud detection or prevention;
• emergencies;
• investigations;
• establishment, exercise or defence of legal claims; or
• other exceptions permitted under the PDPA or applicable law.

Where the PDPA requires an assessment before relying on a relevant exception, we will conduct the required assessment.

We will not require you to consent to the collection, use or disclosure of personal data beyond what is reasonably necessary to provide a requested product or service unless another lawful basis applies.

Where our processing depends upon your consent, you may withdraw that consent by contacting us.

Before processing your request, we may explain the likely consequences of withdrawing consent.

Withdrawal of consent does not affect processing that:

• occurred lawfully before withdrawal;
• is required by law;
• is necessary for legal claims;
• is authorised under another applicable provision of law; or
• must be retained for legitimate legal or business purposes.

Withdrawal of consent may prevent us from continuing to provide certain Services where the relevant personal data is necessary to provide those Services.

We take reasonable steps to ensure that personal data used to make decisions affecting individuals, or disclosed to other organisations, is accurate and complete.

You are responsible for keeping your account details reasonably accurate and current.

You may update certain information through your account or request corrections from us.

We do not disclose personal data indiscriminately.

Where reasonably necessary for the purposes described in this Privacy Policy, personal data may be disclosed to the following recipients.

10.1 Buyers and Sellers

Information necessary to complete transactions may be shared between transaction participants.

For example, sellers may receive information necessary for order fulfilment, while buyers may receive relevant seller information.

10.2 Payment Providers

Information may be provided to banks, payment gateways, payment processors, digital-payment providers and other payment infrastructure providers.

10.3 Identity Verification and Compliance Providers

We may use specialist providers to perform identity verification, fraud detection or compliance screening.

10.4 Logistics Providers

Shipping information may be disclosed to logistics providers, couriers, warehouses and fulfilment partners.

10.5 Technology Providers

We may use service providers for:

• hosting;
• cloud infrastructure;
• cybersecurity;
• email delivery;
• SMS delivery;
• customer support;
• database management;
• analytics;
• artificial intelligence;
• data storage;
• software development; and
• system monitoring.

10.6 Professional Advisers

Information may be disclosed where reasonably necessary to:

• lawyers;
• accountants;
• auditors;
• insurers;
• consultants; and
• other professional advisers.

10.7 Government and Regulatory Authorities

We may disclose information where required or permitted by applicable law, regulation, court order, legal process or lawful request by a competent authority.

10.8 Corporate Transactions

Personal data may be disclosed in connection with:

• mergers;
• acquisitions;
• investments;
• restructurings;
• financing;
• insolvencies;
• sales of businesses or assets; or
• similar corporate transactions.

Appropriate confidentiality and data-protection measures will be applied where reasonably practicable.

BuyAsATeam does not sell your personal data to third parties for monetary consideration.

Some jurisdictions define "sale", "sharing", "targeted advertising" or similar concepts more broadly.

Where applicable law treats particular advertising or analytics disclosures as a sale or sharing of personal information, we will provide any choices or opt-out mechanisms required by that law.

We may use cookies and similar technologies for several categories of purposes.

Strictly Necessary Technologies

These support:

• account login;
• cybersecurity;
• fraud prevention;
• payment processing;
• shopping functionality;
• preferences essential to the Service; and
• Platform operation.

Analytics Technologies

These help us understand:

• visitor numbers;
• traffic sources;
• Platform performance;
• user journeys; and
• feature usage.

Preference Technologies

These may remember:

• language;
• location preferences;
• currency;
• account preferences; and
• interface settings.

Advertising Technologies

Where used, these technologies may help us:

• measure campaigns;
• attribute referrals;
• display relevant advertising; and
• evaluate advertising performance.

Where required by applicable law, non-essential cookies or tracking technologies will be activated only after obtaining the appropriate consent.

Users may manage available cookie preferences through our cookie-management interface or browser settings.

Disabling certain cookies may affect Platform functionality.

BuyAsATeam may use cookies, referral identifiers, account records or similar technologies to determine whether a purchase or registration resulted from a particular invitation link or referral code.

This processing may be necessary to:

• calculate referral commissions;
• apply referral discounts;
• prevent duplicate claims;
• identify fraudulent referrals;
• correctly attribute purchases; and
• maintain programme integrity.

Users participating in referral programmes must not collect, disclose or misuse other users' personal information contrary to applicable law or our policies.

BuyAsATeam may use artificial intelligence, machine learning or automated systems to support functions such as:

• product recommendations;
• seller recommendations;
• buyer matching;
• demand forecasting;
• fraud detection;
• risk assessment;
• moderation;
• customer support;
• pricing insights;
• transaction monitoring;
• search ranking; and
• personalisation.

Where personal data is used in an AI system, we seek to apply principles of:

• purpose limitation;
• data minimisation;
• security;
• appropriate transparency;
• accuracy;
• human oversight where appropriate; and
• responsible AI governance.

We will not intentionally use highly sensitive personal data to train general-purpose AI models unless appropriate consent or another lawful basis exists and suitable safeguards have been implemented.

Where an automated decision has significant consequences for an individual and applicable law provides a right to human intervention, explanation or review, we will provide that mechanism as required by law.

BuyAsATeam may operate internationally and may use service providers located outside Singapore.

As a result, personal data may be transferred to or processed in countries other than the country in which you live.

Where personal data protected under Singapore's PDPA is transferred outside Singapore, we will take appropriate steps to ensure that the overseas recipient provides a standard of protection that is at least comparable to the protection required under the PDPA.

Depending on the circumstances, safeguards may include:

• contractual data-protection obligations;
• appropriate intra-group arrangements;
• recognised certifications;
• legally enforceable obligations;
• due diligence on service providers;
• security requirements; and
• other transfer mechanisms permitted under Singapore law.

We take reasonable administrative, technical and organisational measures to protect personal data against risks including:

• unauthorised access;
• unauthorised collection;
• unauthorised use;
• unauthorised disclosure;
• copying;
• modification;
• deletion;
• loss;
• misuse; and
• cyberattack.

Depending on the system and risk involved, measures may include:

• encryption;
• encrypted communications;
• access controls;
• role-based access;
• strong authentication;
• multi-factor authentication;
• network protection;
• secure software-development practices;
• logging;
• security monitoring;
• vulnerability management;
• data backups;
• incident-response procedures;
• employee access restrictions;
• confidentiality requirements;
• vendor-security assessments; and
• cybersecurity training.

No online platform can guarantee absolute security. Users should also protect their accounts by maintaining strong passwords, enabling available multi-factor authentication and protecting login credentials.

Government-issued identifiers may create heightened risks if misused.

BuyAsATeam therefore seeks to minimise collection of national identification information.

We may collect such information where:

• required by applicable law;
• necessary for legitimate identity-verification purposes;
• necessary to verify identity to an appropriately high level of confidence;
• necessary for fraud prevention; or
• otherwise permitted under applicable law.

We do not use full or partial NRIC numbers, passport numbers or similar national identification numbers as passwords or authentication secrets.

Where verification can reasonably be completed without retaining a complete identification document, we may retain only the verification result or information necessary for the relevant legal or business purpose.

We retain personal data only for as long as reasonably necessary to fulfil the purpose for which it was collected and for legitimate legal or business purposes.

Retention periods may depend on:

• the nature of the information;
• transaction history;
• contractual obligations;
• accounting obligations;
• tax requirements;
• fraud-prevention needs;
• pending disputes;
• litigation;
• regulatory obligations;
• security requirements; and
• statutory limitation periods.

When personal data is no longer reasonably required, we will take appropriate steps to:

• securely delete it;
• destroy it;
• anonymise it; or
• remove the means by which it can reasonably be associated with an individual.

Backup copies may remain temporarily until they are overwritten or securely deleted under our backup-retention procedures.

We maintain procedures for identifying, investigating, managing and responding to personal-data breaches.

Where a breach is notifiable under Singapore's PDPA, we will assess the incident and notify the Personal Data Protection Commission and affected individuals where required by law.

Where other jurisdictions impose mandatory breach-notification obligations, we will comply with those requirements to the extent applicable.

Depending upon applicable law and your circumstances, you may have rights relating to your personal data.

These may include the right to:

• request access to personal data held about you;
• request information regarding certain uses or disclosures of your personal data;
• request correction of inaccurate or incomplete personal data;
• withdraw consent;
• object to particular processing where applicable;
• request deletion where applicable;
• restrict certain processing where applicable;
• opt out of direct marketing;
• manage cookie preferences; and
• lodge a complaint with a competent data-protection authority.

These rights are subject to exceptions, restrictions and procedural requirements under applicable law.

We may need to verify your identity before responding to a privacy request.

Where permitted by law, reasonable fees may apply to certain access requests, particularly where significant effort is required. Where applicable, we will inform you of the estimated fee before processing the request.

Where permitted by law and subject to applicable consent requirements, we may send information regarding:

• new products;
• new services;
• promotions;
• seller offers;
• referral programmes;
• discounts;
• membership benefits; and
• other BuyAsATeam opportunities.

Marketing preferences may be changed through available account settings or unsubscribe mechanisms.

Transactional or service communications, such as payment confirmations, security notices or important account messages, may still be sent where necessary even if you opt out of promotional marketing.

Where we send marketing communications to Singapore telephone numbers, we will seek to comply with the applicable provisions of Singapore's Do Not Call regime.

Where required, we will:

• obtain appropriate consent or check the relevant Do Not Call Register;
• identify the sender;
• provide relevant contact information;
• provide applicable opt-out mechanisms; and
• not conceal caller identification where prohibited.

For unsolicited commercial electronic messages regulated by Singapore's Spam Control Act, we will provide the required unsubscribe facility and process qualifying unsubscribe requests within the legally required timeframe.

We will not use address-harvesting software, dictionary attacks or similar prohibited methods to generate electronic marketing recipient lists.

BuyAsATeam is primarily intended for persons legally capable of entering into transactions offered through the Platform.

Unless expressly permitted under our Terms of Service and applicable law, persons under 18 should not independently create transaction accounts or make purchases through the Platform.

Where we knowingly process personal data belonging to children or younger users, we will apply safeguards appropriate to:

• the individual's age;
• the sensitivity of the information;
• the purpose of processing;
• applicable parental or guardian requirements; and
• applicable Singapore guidance relating to children's and minors' personal data.

If you believe a child has provided personal information contrary to our rules, please contact our Data Protection Officer.

Our Platform may contain links to third-party websites, applications or services.

Those third parties operate independently and may maintain privacy practices different from ours.

BuyAsATeam is not responsible for the privacy practices of unrelated third parties.

Users should review the privacy policies of third-party services before providing personal information to them.

In accordance with Singapore's data-protection requirements, BuyAsATeam will designate at least one Data Protection Officer responsible for overseeing personal-data protection matters.

You may contact our Data Protection Officer regarding:

• questions about this Privacy Policy;
• access requests;
• correction requests;
• withdrawal of consent;
• complaints;
• suspected misuse of personal data;
• data-protection concerns; or
• other privacy-related matters.

Data Protection Officer

BuyAsATeam

Email

privacy@buyasateam.com

Postal Address

[to be completed]

Please include sufficient information for us to understand and appropriately respond to your request.

If you believe that we have not properly handled your personal data, please contact our Data Protection Officer first so that we can investigate the matter.

We aim to address privacy complaints fairly and within a reasonable period.

Nothing in this Privacy Policy restricts any right you may have to submit a complaint to the Personal Data Protection Commission of Singapore or another competent privacy regulator.

We may update this Privacy Policy periodically to reflect:

• changes to our Services;
• new technologies;
• regulatory developments;
• legal requirements;
• security practices; or
• changes to our business operations.

The revised Privacy Policy will be published on this page with an updated "Last Updated" date.

Where a change materially affects how we use personal data and applicable law requires additional notification or consent, we will provide such notification or obtain such consent.

We seek to incorporate privacy considerations into the design and operation of BuyAsATeam.

Our privacy-governance programme may include:

• data inventories;
• access controls;
• retention schedules;
• vendor assessments;
• privacy impact assessments;
• security reviews;
• employee training;
• incident-response procedures;
• consent management;
• data-processing agreements;
• privacy reviews of new functionality; and
• periodic compliance assessments.

Features involving significant new uses of personal data, artificial intelligence, behavioural profiling or sensitive information may be subject to enhanced privacy and security assessments before deployment.

This Privacy Policy is primarily structured to comply with the privacy and personal-data protection requirements applicable to the Singapore entity operating BuyAsATeam.

Nothing in this Privacy Policy is intended to reduce any mandatory privacy right granted to an individual under applicable law.

Where local law provides a higher mandatory level of protection, we will apply that protection to the extent required.

Questions regarding privacy or personal-data protection may be sent to:

Contact

BuyAsATeam Data Protection Officer

Legal entity

[to be completed]

Website

www.buyasateam.com

Email

privacy@buyasateam.com

Registered Address

[to be completed]