Qi-Cha 启茶 is operated by The Midnight Project Pte. Ltd. (UEN: 202041052D), a company incorporated in Singapore ("we", "us", "our"). We are committed to protecting your personal data in accordance with Singapore's Personal Data Protection Act 2012 (PDPA), as amended, and overseen by the Personal Data Protection Commission (PDPC).
This policy explains how we collect, use, disclose, and protect your personal data when you visit qi-cha.store, purchase from us, or interact with us through any channel.
Personal Data We Collect
We collect personal data in the following categories depending on how you interact with us:
Information you provide directly
- Contact details: name, email address, phone number, delivery address
- Order information: items purchased, payment details, transaction history
- Communications: enquiries, feedback, or messages you send us
Information collected automatically
- Device and usage data: IP address, browser type, pages visited, time on site
- Cookies and tracking technologies (see Cookies section)
Information from third parties
- Order and payment data processed through Shopify
- Analytics data from Google Analytics and Meta Pixel
We do not collect sensitive personal data such as NRIC numbers, health records, or financial account numbers beyond what is necessary to process your payment.
How We Use Your Personal Data
We process your personal data on the following legal bases:
- To fulfil our contract with you — processing orders, arranging delivery, handling returns and refunds, and sending order confirmations and tracking updates.
- Legitimate interest — to manage and improve our products and services, conduct analytics on how customers use our store, protect against fraud, and communicate information relevant to your purchases.
- Legal obligation — to comply with applicable Singapore laws and regulations, respond to lawful requests from authorities, and maintain records required for tax and accounting purposes.
- With your consent — to send you marketing communications by email or SMS where you have opted in, and to use cookies for analytics and advertising purposes.
Marketing Communications
We may send you marketing emails, promotional updates, and product news where you have given us consent to do so. You may withdraw this consent at any time by using the unsubscribe link in any marketing email or by contacting us at [email protected].
For marketing via phone or SMS, we check the Singapore Do-Not-Call (DNC) Registry before contacting you. You may register your number at dnc.gov.sg to opt out of unsolicited marketing calls and texts.
Withdrawing consent for marketing does not affect the processing of data required to fulfil your orders.
Cookies and Tracking Technologies
We use cookies and similar tracking technologies on our website. These include:
- Strictly necessary cookies — required for the site to function, including session management, shopping cart, and checkout.
- Analytics cookies — to understand how visitors use our site, including Google Analytics. You can opt out of Google Analytics at tools.google.com/dlpage/gaoptout.
- Marketing and advertising cookies — placed by Meta Pixel and similar tools to show you relevant ads and measure campaign effectiveness. You can manage your ad preferences through your Facebook/Meta account settings.
You can control or disable cookies through your browser settings. Disabling all cookies may affect your ability to use certain features of our site.
How We Share Your Personal Data
We do not sell your personal data. We may share it with the following categories of recipients for the purposes described in this policy:
- Shopify — our e-commerce platform stores and processes order and payment data. Shopify's servers and data infrastructure are based in the United States. By using our Services, your personal data may be stored and processed in the US. Shopify's privacy policy is available at shopify.com/legal/privacy.
- AI shopping platforms — as part of Shopify's Agentic Storefronts feature, our product catalogue and relevant transaction data may be shared with AI shopping platforms including ChatGPT, Microsoft Copilot, and Perplexity, to enable product discovery and purchase within those platforms. No personal customer data is shared with these platforms beyond what is necessary to complete a transaction.
- Delivery and logistics partners — trusted local courier services we engage for order fulfilment. We share only the information necessary to complete delivery.
- Analytics providers — including Google Analytics and Meta, for site analytics and advertising. These providers process data in accordance with their own privacy policies.
- Legal and regulatory authorities — where required by law, court order, or regulatory request.
- Payment processors — payment card data is handled by Shopify Payments and processed in accordance with PCI-DSS standards. We do not store full payment card details.
Where recipients are located outside Singapore, we ensure adequate protections are in place as required under the Third Schedule of the PDPA.
Data Security
We take reasonable technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. All payment transactions are encrypted via SSL. Access to personal data is restricted to authorised personnel only.
No method of transmission over the internet is completely secure. While we do our best to protect your data, we cannot guarantee absolute security.
Data Retention
We retain personal data only for as long as necessary for the purposes it was collected, or as required by law:
- Order and transaction data: 5 years (for tax, accounting, and legal compliance)
- Marketing preferences and communication history: until you withdraw consent, or 3 years from your last interaction, whichever is earlier
- Customer support correspondence: 2 years from resolution
- Account data: for the duration of your account and 2 years after closure or inactivity
Your Rights Under the PDPA
As a Singapore resident, you have the following rights in relation to your personal data:
- Right to access — you may request a copy of the personal data we hold about you.
- Right to correction — you may request that we correct any inaccurate or incomplete personal data.
- Right to withdraw consent — you may withdraw consent for any processing based on consent (such as marketing communications) at any time. This does not affect processing carried out before withdrawal.
To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. We may need to verify your identity before processing your request.
If you are dissatisfied with our response, you may lodge a complaint with the PDPC at pdpc.gov.sg.
International Customers
If you are accessing our Services or purchasing from outside Singapore, additional privacy rights may apply to you depending on your country or jurisdiction of residence. Where such rights apply, we will honour them to the extent required by applicable law.
To exercise any additional rights, contact us at [email protected] with the subject line "Data / Privacy Enquiry" and indicate your country of residence. We will respond within 30 days.
Data Breach Notification
In the event of a data breach that is likely to result in significant harm to affected individuals, or that affects 500 or more individuals, we will notify the PDPC and affected individuals as required under the PDPA within 3 business days of assessment.
Children
Our website and products are not directed at children under 18. We do not knowingly collect personal data from persons under 18. If you believe we have inadvertently collected such data, please contact us and we will delete it promptly.
Changes to This Policy
We may update this policy from time to time. Material changes will be notified on our website with an updated effective date. Continued use of our services after the updated policy is posted constitutes your acceptance of the changes.
Contact Us
For any questions, concerns, or requests relating to your personal data or this policy — including access, correction, or withdrawal of consent — please contact us directly:
- Email: [email protected] (Please use the subject line: "Data / Privacy Enquiry")
- Address: The Midnight Project Pte. Ltd., 32 Pekin St #05-01, Singapore 048762
We will respond within 30 days.