1. Who We Are

1Plus1Gold ("we", "us", "our") is a gold dealer based in Singapore, licensed by the Ministry of Law (Singapore) under the Precious Stones and Precious Metals (PSPM) Act. Our AML/CFT obligations are supervised by the Monetary Authority of Singapore (MAS). Our registered office is in Singapore 437986.

This Privacy Policy explains how we collect, use, disclose, and protect personal data in accordance with the Singapore Personal Data Protection Act 2012 (PDPA).

2. Personal Data We Collect

We collect the following categories of personal data:

• Identity data — full name, date of birth, nationality, NRIC/passport number (for KYC/AML compliance required under the PSPM Act).
• Contact data — mobile phone number, email address, delivery address, postal code.
• Transaction data — orders placed, gold weights, amounts paid, payment references.
• Technical data — IP address, browser type, device information, session logs.
• Communications data — WhatsApp messages and emails sent to or received from our business channels for order coordination and customer support.

3. How We Collect Personal Data

• When you register or sign in using one of our supported methods (WhatsApp OTP, email OTP, passkey, Apple, or Google).
• When you complete our Know Your Customer (KYC) verification flow.
• When you place an order, submit a delivery address, or make a payment.
• When you contact us via WhatsApp, email, or through our website contact form.
• Automatically via cookies and server logs when you browse our website.

4. Purposes of Collection and Use

We use your personal data to:

• Verify your identity and comply with anti-money laundering (AML) and counter-financing of terrorism (CFT) obligations under the PSPM Act.
• Process your gold purchase orders and arrange delivery or self-collection.
• Send order confirmations, receipts, and delivery updates via WhatsApp and email (whichever channels you have on file).
• Maintain your account and transaction history.
• Detect and prevent fraud, suspicious activity, or unauthorised access.
• Respond to customer service enquiries.
• Comply with our legal and regulatory obligations, including record-keeping requirements.

5. Disclosure to Third Parties

We disclose personal data only to service providers necessary to operate our business:

• Sumsub — identity verification and KYC/AML screening.
• Twilio — WhatsApp OTP authentication and order notification delivery.
• Resend — transactional email delivery (OTPs, receipts, order updates).
• Lalamove / NinjaVan — last-mile delivery of physical gold, limited to your name and delivery address.
• Supabase — cloud database hosting in Singapore-region infrastructure.
• MAS and law enforcement — where required by law or regulatory order.

We do not sell, rent, or trade your personal data to any third party for marketing purposes.

6. Data Retention

We retain personal data for as long as necessary to fulfil the purposes set out in this policy, and for a minimum of five (5) years after your last transaction to satisfy AML record-keeping obligations under the PSPM Act. KYC documents are retained for the period required by MAS guidelines.

7. Cookies

Our website uses essential session cookies required for authentication and security. We do not use tracking cookies or third-party advertising cookies. You may disable cookies in your browser settings, but this will prevent you from logging in to your account.

8. Security

We implement appropriate technical and organisational measures to protect your personal data, including encrypted data storage, TLS in transit, access controls, and row-level security on our database. No method of transmission over the internet is 100% secure; we cannot guarantee absolute security but commit to notifying affected individuals promptly if a breach occurs.

9. Your Rights

Under the PDPA, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate personal data.
• Withdraw consent to non-essential processing (note: withdrawal does not affect processing required by law).
• Data portability — request your data in a commonly used format where technically feasible.
• Delete your account (see Section 10 below).

To exercise any of these rights, please reach us through our Contact page. We will respond within 30 days.

10. Deleting Your Account

You may delete your 1Plus1Gold account at any time, in either of two ways:

• Self-service (preferred) — sign in and go to Account → Security, scroll to the "Delete account" section, and follow the in-app confirmation flow. Deletion takes effect immediately on submission.
• By request — if you cannot access your account, reach us through our Contact page with the subject "Account deletion request" from the WhatsApp number or email address registered on your account. We will action the request within 30 days.

Upon deletion we will permanently remove your profile, contact details, saved addresses, gift-message history, referral data, and account preferences. The following data must, however, be retained even after account deletion in order to comply with our legal obligations:

• Transaction records, KYC documents, and AML screening results — retained for a minimum of five (5) years after your last transaction under the PSPM Act and MAS guidelines. These records are segregated and accessed only for regulatory compliance, audit, or law-enforcement requests.
• Records required to defend or pursue legal claims — retained for the period prescribed by the Limitation Act or other applicable law.

Deletion of your account ends our active processing of your data for service delivery, marketing, and account-management purposes. It does not affect the lawfulness of any processing carried out before deletion.

If you have an open order, an unresolved dispute, or an outstanding payment with us, we will complete those obligations before processing the deletion.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated to registered users via WhatsApp or email (whichever channels you have on file). The "Last updated" date at the top of this page reflects the most recent revision.

12. Contact Us

For any privacy-related queries or complaints, please reach our Data Protection Officer through our Contact page. You may also direct complaints to the Personal Data Protection Commission (PDPC) at www.pdpc.gov.sg.