Privacy Notice

Melrose Label is a modest-fashion label run by ARISTUDIO (UEN 53482045W), Singapore. We sell at melroselabel.shop and at pop-up booths. In this notice, “we” means ARISTUDIO.

We follow the Personal Data Protection Act 2012 (PDPA). Our data protection contact is themelroselabel@gmail.com. Our Data Protection Officer is The Owner, Melrose Label, reachable at the same email. Address: Melrose Label, Singapore.

• Name, mobile number and email address. Email is required to join the Society, online or at a booth. We use it for your receipts, to sign you in, and for notices about your membership. Marketing emails stay optional and are only sent if you opt in.
• Order history: what you bought, when, where (online or at a booth), how you paid, and any refund. For an order you ask us to deliver, the order also holds the delivery address you enter at checkout. We do not ask for an address when you join the Society.
• For Society members, the membership record built from the above: your tier, points balance and points history, and the choices you made when joining (which notice you saw, and any marketing opt-in) and, if you joined with one, the referral code you used.

Birthday (day and month, optional) — used only to give you a birthday coupon in your birthday month and, if you agreed to marketing emails, to email it to you. You can add it when you join (online or at a booth) or later in your account. We never ask for the year. You can remove it any time in your account: we then delete it and switch off any unused birthday coupon. A birthday coupon you have already used stays in your order and coupon history, which shows the month it was valid for.

We do not ask for your NRIC, FIN or passport number, and our staff will never ask for it. We do not store card details; payment is by PayNow or bank transfer.

• Your orders: to process, deliver and support your order, and to email your receipt and order updates.
• Melrose Society: to run your membership: add and use points, apply your tier discount, recognise you at our booths by your mobile number, and send you notices about your membership, such as notice of a change to the Society terms. These are service messages, not marketing, and go to every member we have an email address for.
• Referral codes: if you join with a referral code, we record which code you used and when you joined, and give you the welcome coupon that comes with it. We use this to see how many members each partner brings and, in total, how much those members buy. Partners never see your name, contact details or orders. If we share results with a partner, we share only combined totals, and never numbers so small they could point to you.
• Marketing: only if you opt in. When you join online, there are separate boxes for email and WhatsApp offers. They are unticked by default, and joining does not depend on them. Joining at a booth does not include a marketing opt-in; you can opt in online later. You can opt out at any time. We do not send marketing by SMS, WhatsApp or phone call without your opt-in.
• Every marketing email includes an unsubscribe link. Any marketing SMS is labelled <ADV>, as the Spam Control Act requires.
• To meet legal duties, such as keeping business and tax records.

We do not sell your personal data.

We use these service providers. They handle your data only to provide their service to us:

• Supabase (our database), hosted in Seoul, South Korea.
• Vercel (hosts our website), a United States company. Our site runs in its Singapore region.
• DigitalOcean (a server we run), Singapore.
• Resend (sends our emails, such as receipts), based in the United States.
• Sentry (error monitoring for our website), in its European Union region. We set it to remove contact details before errors are sent.
• Telegram (servers outside Singapore), for internal alerts to the owner and staff only. An alert may show your first name, the order number, the amount, payment and delivery method, and the items ordered. It never shows your phone number, email or address, and we never message you through it.

Some of these providers store or process data outside Singapore (South Korea, the United States, the European Union and elsewhere). We use providers whose terms include data-protection commitments, so that your data keeps a standard of protection comparable to the PDPA.

We may also disclose data where the law requires it, for example to a government authority.

• Order and payment records: 5 years, as IRAS requires for business records, then deleted or anonymised.
• Melrose Society membership: while you are a member (membership does not expire). When you leave, or your account is closed, your personal details are deleted. Order records are kept separately for the 5 years above.
• Records of your consent: for the life of the membership plus 2 years, then deleted.
• Back-in-stock requests from shoppers who are not members: deleted 3 days after the email is sent, or after 90 days if it is never sent (section 10).

• Access: ask for a copy of your personal data and how it has been used or disclosed in the past year.
• Correction: ask us to correct anything that is wrong.
• Withdraw consent: stop marketing at any time using the unsubscribe link or by emailing us. You can also leave the Melrose Society. Before we act, we will tell you what you lose (your points and tier). We keep order records we are legally required to keep, unlinked from you where possible.
• Back-in-stock requests: cancel one at any time before it is sent by emailing us (see section 10). Members can also remove it in their account.

Email themelroselabel@gmail.com or tell our staff at a booth (they pass it to the owner; staff do not change records at the booth). We may ask you to confirm your identity. We stop marketing within 10 business days of your request, and we respond to access, correction or deletion requests within 30 days. We may charge a reasonable fee for an access request and will tell you the amount first.

Access to member data is limited by role: staff at the booth see only what they need to find your membership. Data is sent over encrypted connections. No system is perfectly secure, so we also keep a plan for incidents.

To stop misuse of sign-ups and referral codes, we briefly keep a scrambled (hashed) form of the internet address a sign-up comes from. We don't store the address itself or link it to your membership, and we delete it within 24 hours.

The same applies to back-in-stock requests: to stop one person sending many, we briefly keep a scrambled (hashed) form of the internet address and of the email a request comes from, separately from the request itself, and we delete these within 24 hours.

If we suspect a breach, we assess it promptly. If it is likely to cause you significant harm, or affects 500 or more people, we notify the Personal Data Protection Commission within 3 calendar days of deciding that, and we tell affected people as soon as practicable where there is likely significant harm.

Melrose Society is open to people aged 13 and over.

We may update this notice. We change the version and date above when we do, and tell members by email about significant changes.

See also our Melrose Society terms.