Privacy policy.

01Who we are

• This policy explains how Creative Factory Painting Pte. Ltd. (UEN 202324314C) ("Creativist Singapore", "we") collects, uses and protects your personal data, in line with Singapore's Personal Data Protection Act 2012 (PDPA).
• Questions or requests: contact our Data Protection Officer at creativefactorypainting.sg@gmail.com.

02What we collect

• Contact and order details: name, phone / WhatsApp number, email, delivery address and order history.
• Photos you send us for your painting, and the details you tell us about your concept.
• Payment details: payment reference, amount and payment screenshots. Card payments are handled by our licensed payment provider. We do not see or store your full card details.
• Website data: basic technical data such as device, browser and pages visited, which helps us improve the site.

03How we use it

• To quote, make, deliver and support your painting.
• To process payments and prevent fraud.
• To contact you about your order on WhatsApp, phone or email.
• To send you offers, only if you agree. You can opt out at any time.
• To meet our legal, tax and accounting duties.

04Who we share it with

• Our artists and staff, only as needed to make your painting.
• Delivery partners, to deliver your painting.
• Payment providers and banks (for example our online checkout provider, Atome and OCBC), to process payments.
• Service providers who host our website, messages and records.
• Authorities, where the law requires it.
• We do not sell your personal data.
• Some of our team and service providers are outside Singapore, including in Malaysia. When data is sent overseas, we make sure it is protected to a standard comparable to the PDPA.

05Your photos

• We use your photos only to make your painting.
• We may share photos of the finished painting on our website and social media. Tell us if you want it kept private, and we will respect that.
• We do not publish the original photos you send us without your permission.

06How long we keep it and how we protect it

• We keep your data only as long as needed for your order, support and our legal duties (usually up to 5 years for accounting records), then delete or anonymise it.
• We use reasonable security measures, such as access controls and secure, password-protected systems.

07Your rights

• You can ask to access or correct your personal data, or withdraw your consent for us to use it.
• If you withdraw consent, we may not be able to complete your order.
• Send requests to our Data Protection Officer by email. We reply within 30 days.

08Changes

• We may update this policy. The latest version is always on this page.