Privacy Policy

1. Who we are

Xuan Wei Ya 暄瑋雅 ("we", "us", "our") runs the website xuanweiya.com and sells Tibetan-style dzi bead and natural crystal jewellery to customers in Singapore. Our pieces are sold through our Carousell shop, and we answer enquiries through Carousell chat, Facebook Messenger and email.

We are committed to handling your personal data in line with Singapore's Personal Data Protection Act 2012 (PDPA). This policy explains what personal data we collect, why, and the choices you have.

2. Personal data we collect

When you contact us or buy from us (through Carousell chat, Facebook Messenger or email), we may receive:

• Your name or username
• Your email address or phone number, if you share it with us
• Your delivery address in Singapore, or meet-up arrangements, when you choose delivery or a meet-up
• Details of the pieces you ask about or buy, and anything else you choose to tell us in your messages (for example, a custom bracelet request)

When you browse our website, we automatically collect limited technical information through Google Analytics (via the Site Kit plugin) and our website security and hosting tools. This may include your IP address, device and browser type, approximate location, and the pages you visit.

We do not take payments on this website and we do not collect or store any card or bank details. Payments for Carousell purchases are handled by Carousell.

3. How we use your personal data

Purpose	Examples
To answer your enquiries	Replying to your questions, sending more photos, suggesting pieces
To complete your purchase	Arranging a meet-up at Boon Lay MRT or delivery within Singapore
To make custom pieces	Understanding your preferences for a custom bracelet
To improve our website	Understanding which pages visitors find useful, using anonymous statistics
To keep our website secure	Blocking spam and suspicious activity
To meet legal obligations	Keeping basic sales records where required by law

We only use your personal data for these purposes, or purposes reasonably related to them, unless we ask for your further consent. We will not send you marketing messages unless you have agreed to receive them.

4. Third-party platforms

When you contact or buy from us through Carousell or Facebook Messenger (Meta), those platforms also collect and process your data under their own privacy policies. We encourage you to read them. Our website also uses Google Analytics (Google) to understand visitor numbers.

5. Who we share your data with

We do not sell your personal data. We only share it where needed for the purposes above, with:

• Delivery or courier providers, to deliver your order within Singapore
• Our website hosting, security and analytics providers
• Government authorities or law enforcement, where required by law

6. Transfers outside Singapore

Some of the service providers above (such as Google, Meta and our website host) may store or process data on servers outside Singapore. Where this happens, we rely on these providers' own safeguards to protect your data to a standard comparable to the PDPA.

7. How long we keep your data

We keep personal data only for as long as it is needed for the purposes above, or as required by law. When it is no longer needed, we delete it or make it anonymous.

8. How we protect your data

We take reasonable steps to protect your personal data, including using a secure (HTTPS) website, security software, and limiting who can access your information. However, no method of sending or storing data online is completely secure, so we cannot guarantee absolute security.

9. Cookies

Our website uses cookies, including Google Analytics cookies, to understand how visitors use the site. You can block or delete cookies in your browser settings. The website will still work if you do.

10. Your rights

Subject to exceptions under the PDPA, you can ask us to:

• Tell you what personal data we hold about you and how it has been used
• Correct personal data that is wrong or incomplete
• Stop using your personal data by withdrawing your consent

Withdrawing consent may mean we can no longer respond to your enquiries or complete your purchase. We will respond to requests as soon as reasonably possible, and normally within 30 days.

11. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top of this page shows when it was last changed.

12. Contact us / Data Protection Officer

For any questions, requests or concerns about your personal data, please contact our Data Protection Officer:

Xuan Wei Ya 暄瑋雅
Data Protection Officer
Email: support@xuanweiya.com