Privacy Policy & Data Protection Statement

1. INTERPRETATION AND DEFINITIONS

1.1 Interpretation. Words with initial capital letters have defined meanings herein. These definitions apply consistently regardless of whether terms appear in singular, plural, capitalized, or lowercase formats.

1.2 Definitions. For the purposes of this Privacy Policy:

• "Account" means a unique personal or business profile registered to access our Service or specific features thereof.
• "Affiliate" means any corporate entity that controls, is controlled by, or is under common control with the Company, where "control" denotes ownership of 50% or more of voting equity or managerial control.
• "Company" (referred to as either "the Company", "We", "Us", or "Our" in this Policy) refers to ArchWizard Entertainment Pte. Ltd. (UEN: 202441579M), situated at Pemimpin Industrial Building, 63 Jalan Pemimpin, #03-10, Singapore 577219.
• "Cookies" means small data files placed on Your Device by a website, storing interaction history, preferences, and technical state data.
• "Data Protection Legislation" means the Singapore Personal Data Protection Act 2012 (PDPA), as amended from time to time, and any applicable regional data privacy laws including the EU General Data Protection Regulation (GDPR) where cross-border reach applies.
• "Device" means any hardware instrument capable of accessing the Service, including desktop computers, mobile phones, tablet computers, and smart devices.
• "Personal Data" means any data or information, whether true or not, about an individual who can be identified from that data, or from that data and other information to which the Company has or is likely to have access.
• "Service" refers to the e-commerce storefront, digital platforms, and online services hosted at https://shop.archwizard.tech and associated subdomains.
• "Service Provider" means any third-party natural or legal person processing data on behalf of the Company, including payment gateways, logistics partners, cloud hosting providers, and technical analysts.
• "Usage Data" refers to telemetry and automated technical data generated through interaction with the Service infrastructure (e.g., page duration, request logs, diagnostic metrics).
• "You" or "Your" means the individual accessing or using the Service, or the company or legal entity on whose behalf such individual accesses or uses the Service.

2. CATEGORIES AND METHODS OF DATA COLLECTION

2.1 Voluntarily Provided Personal Data. In the course of utilizing Our Service, registering an Account, or executing transactions, We collect personally identifiable information directly supplied by You, including but not limited to:

• First and last name;
• Contact telephone number(s);
• Electronic mail address;
• Billing address, shipping address, postal code, and country of residence;
• Government-issued identification or corporate metadata strictly where required for tax invoicing, customs compliance, or anti-fraud verification; and
• Transaction history, order preferences, communications records, and service inquiry correspondence.

2.2 Automated Usage Data & Technical Telemetry. Upon accessing the Service, system infrastructure automatically captures diagnostic information sent by Your browser or Device, including:

• Internet Protocol (IP) addresses, network routing metrics, and geographical geolocation indicators;
• Browser software version, operating system release, system language settings, and display configurations;
• Referral URLs, timestamps, page navigation paths, time spent on discrete pages, clickstream data, and error logs; and
• Unique Device Identifiers (e.g., UUID, IDFA, GAID) and hardware telemetry when accessed via mobile hardware.

2.3 Payment Data Exclusions (PCI-DSS Handling). Payment transactions (credit card processing, digital wallets, bank transfers) are handled directly by certified, PCI-DSS compliant third-party payment gateways. The Company does not store or process raw credit card numbers, CVVs, or bank security credentials on its local servers.

3. TRACKING TECHNOLOGIES AND COOKIE GOVERNANCE

3.1 Utilization of Tracking Technologies. We deploy Cookies, web beacons, pixel tags, and scripts to track user sessions, maintain shopping cart integrity, analyze usage trends, and enforce secure account authentication.

3.2 Types of Cookies Deployed:

• Strictly Necessary / Essential Cookies (Session): Essential for web application routing, user account session holding, and fraud prevention. Disabling these via browser overrides will prevent checkout functionality.
• Preferences & Functionality Cookies (Persistent): Stores customized settings, localized currency preferences, language selections, and past authentication state.
• Analytical & Performance Cookies (Persistent / Third-Party): Aggregates anonymized traffic metrics, system responsiveness logs, and user flows to optimize operational performance.
• Targeting & Marketing Cookies (Persistent / Third-Party): Enables personalized promotional communications and evaluates marketing campaign conversion metrics.

3.3 User Preference Controls. You maintain absolute discretion to reject or configure Cookies through Your software browser settings. However, opting out of essential Cookies will cause functional disruptions to Account access and checkout operations on the Service.

4. LEGAL BASES & SPECIFIC PURPOSES OF PROCESSING

4.1 Statutory Basis for Processing. We process Personal Data strictly under lawful parameters recognized by Data Protection Legislation, including contractual necessity, explicit user consent, statutory legal obligations, and legitimate operational interests.

4.2 Core Operational Purposes. Collected Personal Data is processed exclusively to:

• Execute e-commerce purchase transactions, fulfill orders, handle logistics dispatch, and render warranty support;
• Administer, maintain, and secure user Accounts;
• Communicate critical order updates, security alerts, operational policy revisions, and service notices;
• Detect, prevent, and mitigate fraudulent activities, unauthorized Account access, bot traffic, and illegal transactions;
• Enforce our Terms of Service, Master Warranty Policy, and associated legal instruments;
• Comply with accounting standards, tax reporting liabilities (e.g., Singapore IRAS obligations), and statutory law enforcement notices; and
• Evaluate system performance, analyze aggregated commercial trends, and optimize user experience.

5. DISCLOSURE & THIRD-PARTY SHARING EXCLUSIONS

5.1 Controlled Data Disclosures. The Company does not sell, rent, or lease Personal Data to third parties for independent commercial exploitation. Disclosures are strictly limited to the following operational contexts:

• Authorized Service Providers: Vetted third parties performing hosting, payment processing, courier logistics, analytics, and IT support bound by strict non-disclosure obligations;
• Corporate Affiliates & Restructuring: Related corporate entities under common ownership, or successor entities in the event of a merger, acquisition, asset sale, or corporate reorganization;
• Statutory Authorities & Law Enforcement: Government, judicial, regulatory, or tax authorities within or outside Singapore where compelled by subpoena, search warrant, court order, or applicable law; and
• Legal Defense & Asset Protection: Third parties where disclosure is necessary to defend legal claims, enforce contractual rights, or safeguard the physical or intellectual property of the Company, staff, or public.

5.2 Anonymized & Aggregated Data. We reserve the right to share de-identified, non-personally identifiable, aggregated statistical datasets with research or commercial partners for industry analysis without restriction.

6. CROSS-BORDER DATA TRANSFERS & INTERNATIONAL STORAGE

6.1 Global Data Infrastructure. Personal Data collected by the Company may be stored, processed, or transferred across cloud servers located outside Singapore (including, without limitation, regions within the United States, European Union, and Asia-Pacific hub regions).

6.2 Transfer Safeguards. When transferring Personal Data outside Singapore, the Company ensures that receiving overseas entities provide a standard of protection comparable to the protection under the Singapore Personal Data Protection Act (PDPA), enforced via binding corporate rules, standard contractual clauses, or robust vendor security frameworks.

7. RETENTION PERIODS, DATA SECURITY, AND DELETION

7.1 Data Retention Policy. Personal Data is retained only for as long as needed to fulfill original collection purposes, satisfy warranty or dispute operational lifetimes, and maintain statutory legal, accounting, and tax compliance (typically up to seven (7) years following account termination under Singapore law).

7.2 Security Infrastructure & Disclaimers. We implement industry-standard physical, administrative, and technical controls (including SSL/TLS encryption for data in transit and restricted database access). However, as no electronic transmission or cloud platform is 100% immune to unauthorized interception or technical breaches, the Company cannot guarantee absolute, unbreachable data security.

7.3 Data Purging & Destruction. Upon expiration of retention necessity or upon receipt of a valid statutory erasure request, Personal Data is permanently deleted, overwritten, or irreversibly anonymized.

8. YOUR STATUTORY PRIVACY RIGHTS (PDPA / GDPR)

8.1 Scope of Rights. Subject to statutory exceptions under Data Protection Legislation, You retain the following rights regarding Your Personal Data held by Us:

• Right of Access: Request a copy of Your Personal Data in our possession or control, along with information regarding how such data has been used or disclosed within the preceding calendar year;
• Right to Correction: Request the correction, amendment, or updating of incomplete or inaccurate Personal Data;
• Right to Withdraw Consent / Opt-Out: Withdraw consent for data processing or direct marketing communications at any time (subject to contractual or legal operational consequences); and
• Right to Erasure / Deletion: Request the deletion of Your Personal Data, provided no statutory, tax, or legal defense exceptions require retention under Clause 7.1.

8.2 Executing Requests. To exercise statutory rights, submit a written request to our Data Protection Officer at privacy@archwizard.tech. We reserve the right to verify your identity and charge a reasonable administrative processing fee for complex data retrieval requests as permitted by law.

9. MINORS AND CHILDREN'S PRIVACY PROTECTION

9.1 Age Restriction. Our Service is not directed at or structured for individuals under thirteen (13) years of age (or under sixteen (16) years in jurisdictions governed by applicable GDPR provisions). We do not knowingly solicit or collect Personal Data from minors without verified parental or legal guardian consent.

9.2 Remediation of Unauthorized Collection. If We discover that Personal Data from a minor has been submitted without verifiable parental authorization, We will immediately purge such information from our records. Guardians discovering minor data submission may contact privacy@archwizard.tech for immediate deletion.

10. AMENDMENTS, EXTERNAL LINKS, AND CONTACT DETAILS

10.1 Third-Party Hyperlinks. Our Service may contain links to external third-party websites or integrated applications not operated by Us. The Company exercises no control over, and assumes no legal responsibility for, the content, privacy practices, or security policies of third-party platforms.

10.2 Policy Amendments. We reserve the right to revise this Privacy Policy at our sole discretion. Any updates will be published on this URL with an updated "Last Updated" date. Continued access or usage of the Service following published amendments constitutes binding acceptance of the revised terms.

10.3 Data Protection Contact. For inquiries, privacy complaints, or data access requests, direct communications to our designated Data Protection Officer (DPO):