Who this policy covers

PM Marketplace (“we”, “us”, “our”) is a Singapore-based precious metals business. This policy explains how we collect, use, disclose and protect personal data when you visit our website, register, buy or sell products, arrange payment or delivery, or communicate with us. It covers our website, customer accounts and related services.

We handle personal data in accordance with Singapore’s Personal Data Protection Act 2012 (PDPA) and other applicable laws. This notice does not replace any more specific notice given when particular information is collected.

Personal data we collect

Depending on your interaction with us, the information may include:

Name, mobile number, email address, delivery or residential address and contact preferences.
Identity and customer-verification information: date of birth, nationality, residential status, NRIC/FIN or passport details, pass type/status, identification evidence, and information needed for applicable customer due diligence and anti-money-laundering checks.
Orders, purchases, sales, invoices, account credits, payment references, balances and loyalty tier information.
Marketplace usernames and order references, courier and tracking information, and photographs supplied for identity verification, dispatch or proof of receipt.
Enquiries, messages and information you choose to share with our staff or automated assistant.
Technical information such as IP address, browser/device details, session and security logs, cookies, cart contents and saved form drafts.

Where information comes from

We obtain information directly from you, from your use of our services, and where applicable from authorized identity, marketplace, payment and delivery providers. If you choose Singpass/Myinfo, we receive the attributes you authorize the provider to share for registration and verification.

Please provide accurate information and tell us when it changes. If you submit someone else’s personal data, ensure you have authority to do so and inform them of the relevant purposes.

Why we use personal data

We collect, use and disclose personal data for reasonable purposes notified to you, including:

Registering and verifying customers, authenticating accounts and securing access, including OTP and PIN functions.
Processing purchases, buybacks, quotations, payments, customer-account entries, delivery and collection.
Maintaining transaction and accounting records, administering loyalty benefits and resolving enquiries or disputes.
Providing customer support, including automated replies and staff follow-up.
Preventing fraud, investigating security incidents and meeting applicable legal, regulatory and reporting duties.
Sending service updates; sending promotional messages only where permitted under applicable consent and Do Not Call requirements.

Consent and your choices

We rely on your consent, deemed consent where the PDPA permits it, or another applicable legal permission or requirement. We do not require consent to unrelated purposes as a condition of providing a product or service. For a new purpose, we will notify you and obtain consent where required.

You may withdraw consent with reasonable notice through our data protection contact. We will explain the likely consequences and cease the affected collection, use or disclosure unless continued handling is permitted or required by law. Withdrawal may prevent us from providing an account, transaction or delivery service that needs that information.

You can ask to stop promotional messages without withdrawing from necessary service communications. Withdrawal does not automatically erase records we must retain by law.

Who may receive information

We disclose information relevant to the service to authorized staff and service providers such as hosting and storage providers, identity-verification services, payment processors, marketplaces, couriers, communications providers, professional advisers and customer-support technology providers. Authorities may receive information where the law requires or permits it.

Where an automated assistant is used, relevant message content and service context may be processed by an AI service provider to prepare a reply. You may ask for staff assistance.

If staff enable Google Contacts synchronization, limited registered-client contact and loyalty information may be copied to the authorized Google account for customer-contact management. Identity documents and financial transaction records are not part of that contact synchronization.

Third-party services have their own privacy practices. We remain responsible for the obligations that apply to our handling of personal data and require appropriate safeguards from providers processing it on our behalf.

Overseas transfers

Some providers may process or store information outside Singapore. Where we transfer personal data overseas, we take steps required by the PDPA to ensure a standard of protection comparable to that under the PDPA, for example through appropriate contractual or other legally recognized safeguards, unless an applicable exception applies.

Security and retention

We use reasonable safeguards appropriate to the information and risk, including restricted staff access, authentication, encryption for sensitive records and private storage for protected documents. No system is completely secure. Do not send passwords, PINs, OTPs or full payment-card credentials in ordinary enquiries.

We retain information only while needed for a business or legal purpose, including accounting, tax, customer due diligence and dispute obligations. When it is no longer needed, we delete, anonymize or otherwise dispose of it appropriately.

Registration identity-image uploads are temporary verification evidence and are subject to review and expiry deletion controls. Dispatch and invoice photos have separate retention controls. Deleting source photos does not necessarily remove information already included in a retained finalized transaction document.

Cookies and browser storage

Our website uses cookies and browser storage for functions such as login sessions, inactivity locking, shopping carts, preferences and registration drafts. Technical logs help us operate and protect the service.

You can control cookies and clear stored information through your browser. Disabling necessary cookies or storage may prevent login, checkout or draft recovery. On a shared device, sign out and remove any saved personal information.

Access, correction and complaints

Subject to the PDPA’s exceptions, you may request access to personal data in our possession or control and information about how it was used or disclosed in the year before your request. You may also request correction of an error or omission.

We may verify your identity and clarify the request without collecting unnecessary information. We respond as soon as reasonably possible. If we cannot respond within 30 days, we will inform you in writing within that period when we expect to respond. If an access fee applies, we will notify you in advance.

Where required, we correct information and notify relevant recipients of the correction. If a statutory exception prevents access or correction, we explain the outcome to the extent permitted. You may raise a privacy complaint through our data protection contact and, where appropriate, with Singapore’s Personal Data Protection Commission (PDPC).

Personal data breaches

We assess suspected personal data breaches and take appropriate containment and remedial steps. Where notification is required under the PDPA, we notify the PDPC as soon as practicable and no later than three calendar days after determining that the breach is notifiable. We notify affected individuals as required, as soon as practicable.

Policy updates

We may update this policy to reflect changes in our services or legal requirements. The last-updated date identifies this version. Where required, we provide a separate notice or seek consent for a material change in how we handle your personal data.

Privacy Policy