Privacy Policy

Effective date: 21 July 2026 · Last updated: 21 July 2026

1. Introduction

BeanPoint Pte. Ltd. (“BeanPoint,” “we,” “us,” or “our”) is a specialty coffee café registered in Singapore (UEN 202641872K) operating at 28 Blair Road, #01-02, Singapore 089928, and the website beanpoint.pro (the “Site”). We are committed to protecting your personal data in accordance with the Personal Data Protection Act 2012 of Singapore (“PDPA”) and applicable subsidiary legislation.

This Privacy Policy explains what personal data we collect, why we collect it, how we use and disclose it, how long we retain it, and what rights you have. By using our Site, submitting our contact form, visiting our café, or otherwise interacting with us, you acknowledge that you have read this Privacy Policy. Where we require consent under the PDPA, we will obtain it before collecting or using your personal data for the stated purpose.

2. Data controller

BeanPoint Pte. Ltd. is the organisation responsible for personal data described in this policy. For data protection enquiries, contact our Data Protection Officer at [email protected] or write to BeanPoint Pte. Ltd., 28 Blair Road, #01-02, Singapore 089928. General café enquiries may be directed to [email protected] or +65 6962 4187.

3. Personal data we collect

We collect personal data only where necessary for defined purposes. Categories include:

• Identity and contact data: name, email address, telephone number, company name (if provided), submitted via our contact form or email correspondence.
• Communication data: message content, subject selection, date and time of enquiry, and any attachments you send.
• Technical data: IP address, browser type, device information, referring URL, and pages visited on our Site — collected through server logs and optional analytics cookies where you consent.
• Cookie preference data: your cookie consent choices stored locally in your browser for up to six months.
• In-café data: if you join a loyalty list, book catering, or register for a cupping, we may collect name, email, phone, dietary notes, and billing details for corporate orders.
• CCTV: our premises may use closed-circuit cameras for security. Signage is displayed at entry.

We do not intentionally collect sensitive personal data (such as NRIC numbers, financial account numbers, or health records) through the Site. Please do not submit sensitive data via the contact form. If you inform us of allergies in person, we treat that information solely to serve you safely and do not retain it beyond the immediate transaction unless you request otherwise.

4. How we collect personal data

Personal data is collected through:

• Voluntary submission of our contact form (processed by send.php and emailed to our designated mailbox).
• Direct email, telephone, or in-person communication.
• Automatic collection via server logs when you browse the Site.
• Cookies and similar technologies, subject to your consent for non-essential cookies — see our Cookie Policy.
• Third-party payment processors when you purchase retail beans or catering — we receive confirmation of payment, not full card numbers.

5. Purposes of collection, use, and disclosure

We collect and use personal data for purposes including:

• Responding to enquiries submitted through the Site or email.
• Processing catering bookings and brew guidance appointments.
• Fulfilling retail orders and delivery arrangements.
• Operating, maintaining, and improving the Site.
• Complying with legal obligations, including food safety and accounting requirements.
• Protecting our staff, guests, and premises through CCTV where permitted.
• Sending service-related communications (order confirmations, appointment reminders) — not marketing unless you opt in.
• Analytics to understand Site usage patterns, only with consent for analytics cookies.

We may disclose personal data to:

• Service providers who assist with email delivery, hosting, payment processing, and IT support — bound by confidentiality and data protection obligations.
• Professional advisers (lawyers, accountants) where necessary.
• Regulatory or law enforcement authorities when required by Singapore law.

We do not sell your personal data. We do not transfer personal data outside Singapore unless necessary for hosting or email services, in which case we ensure comparable protection through contractual safeguards or your consent.

6. Legal basis and consent

Under the PDPA, we rely on:

• Consent: for contact form submissions (consent_pdpa checkbox), marketing communications, and non-essential cookies.
• Legitimate interests: for Site security, fraud prevention, and internal analytics aggregated without identifying individuals — balanced against your rights.
• Legal obligation: for tax records, employment law, and responses to lawful requests.
• Contractual necessity: for fulfilling orders and bookings you request.

You may withdraw consent at any time by emailing [email protected]. Withdrawal does not affect the lawfulness of processing before withdrawal. We may continue processing where another legal basis applies.

7. Retention

We retain personal data only as long as necessary for the purposes collected:

Data type	Retention period
Contact form submissions	24 months from last correspondence, unless longer retention required for disputes
Catering and corporate orders	7 years for financial records (statutory requirement)
Server logs	90 days
Cookie consent records	6 months (browser local storage)
CCTV footage	30 days rolling, unless incident investigation requires longer
Marketing opt-in lists	Until you unsubscribe or 24 months of inactivity

When data is no longer needed, we delete or anonymise it securely.

8. Your rights under the PDPA

Subject to exceptions in the PDPA, you have the right to:

• Access personal data we hold about you and information about how it has been used or disclosed in the past year.
• Correction of inaccurate or incomplete personal data.
• Withdraw consent for processing that relies on consent.
• Data portability where technically feasible and applicable.

To exercise these rights, email [email protected] with sufficient detail to identify you and your request. We respond within thirty days unless an extension is permitted. A reasonable fee may apply for manifestly unfounded or excessive access requests as allowed under the PDPA.

When you request access, we will confirm your identity using information already held or by requesting additional verification where necessary to protect against unauthorised disclosure. Correction requests should specify the inaccurate field and the correct information. We will update our records and, where personal data was disclosed to third parties in the preceding year, notify them of the correction where required by law.

If you withdraw consent for marketing communications, we will stop sending promotional messages within fourteen days. Withdrawal of consent for essential processing related to an active order may prevent us from completing that order. We will explain the consequences before processing your withdrawal request where applicable.

If you believe we have not handled your personal data properly, you may contact the Personal Data Protection Commission (PDPC) of Singapore after first giving us an opportunity to resolve your concern.

9. Data breach notification

In the event of a data breach that is likely to result in significant harm or affect a significant number of individuals, we will notify the PDPC and affected individuals as required under the PDPA. Our internal breach response procedure includes containment, assessment, documentation, and remediation. Staff are trained to escalate suspected breaches to the Data Protection Officer immediately. If you suspect unauthorised access to your personal data held by BeanPoint, contact [email protected] without delay.

10. Security

We implement appropriate administrative, technical, and physical safeguards including HTTPS on the Site, access controls on email and booking systems, staff training on data handling, and secure disposal of paper records. No transmission over the internet is completely secure; we encourage strong passwords for any accounts we provide and prompt reporting of suspected breaches to [email protected].

Physical records at the café are stored in locked cabinets accessible only to authorised managers. Laptops used for catering administration are encrypted and password-protected. Third-party processors are assessed for security practices before engagement and reviewed periodically.

11. Third-party links

The Site may link to external sites (roasters, maps, social platforms). We are not responsible for their privacy practices. Review their policies before submitting personal data.

12. Children

The Site is not directed at children under thirteen. We do not knowingly collect personal data from children. Contact us to delete such data if discovered.

13. Changes to this policy

We may update this Privacy Policy to reflect legal, operational, or Site changes. Material updates will be posted here with a revised “Last updated” date. Continued use after changes constitutes acknowledgment. Significant changes affecting consent-based processing may require renewed consent.

14. Contact

BeanPoint Pte. Ltd.
28 Blair Road, #01-02, Singapore 089928
Email: [email protected]
Phone: +65 6962 4187
UEN: 202641872K