How Kuruvy handles your personal data

Who we are

Kuruvy is operated by INFOTECHRA PTE. LTD. (UEN 202413690M), Singapore, which sells gift packs online and delivers them in Singapore. INFOTECHRA PTE. LTD. is the organisation responsible for the personal data described here. You can reach our Data Protection Officer on WhatsApp at +65 8294 4262 or by email at ops@kuruvy.com.

What we collect

• Account details: your name, mobile number or email address, and a password we store only as a one-way hash. If you sign in with Google, we receive your name, email address and profile picture from Google.
• Order details: what you bought, the delivery address or dormitory, the recipient's name if the pack is for someone else, your gift note, payment method and, for PayNow, the payment screenshot you upload.
• Marketing consent: whether you have agreed to receive offers, and when.
• Technical data: a session cookie that keeps you signed in, and Google Analytics, which sets cookies to count visits, pages viewed and orders placed so we can see what is working. Google Analytics does not receive your name, phone number or address from us. We do not use advertising cookies.

We never ask for your NRIC, FIN, passport number or bank details.

Why we use it

• To take, pack and deliver your order, and to contact you about it by call, SMS or WhatsApp.
• To verify PayNow payments against your order.
• To show you your order history in your account.
• To send you offers and news about new packs, only if you ticked the marketing box. You can untick it in your account at any time and we will stop.
• To meet legal obligations, such as keeping transaction records.

Who we share it with

Only the people needed to get your pack to you: our delivery riders and courier partners receive the recipient's name, address, phone number and the delivery window. Our hosting and storage providers process data on our behalf under contract. We do not sell personal data and we do not share it with advertisers.

Marketing messages and the Do Not Call Registry

We send marketing by SMS, WhatsApp or email only to people who have opted in through our website. Opting in on Kuruvy counts as clear and unambiguous consent for the purposes of the Do Not Call provisions. Every message tells you how to stop, and you can also switch marketing off in your account.

How long we keep it

Order records are kept for 5 years to meet accounting requirements. Payment screenshots are deleted 90 days after the payment is verified. If you close your account, we remove your name, contact details and address from it within 30 days, and keep only what the law requires us to keep.

Your rights

You can ask us for a copy of the personal data we hold about you, ask us to correct it, or withdraw consent for its use. Contact us by WhatsApp or email and we will respond within 30 days. Withdrawing consent for order-related use means we can no longer deliver to you, and we will tell you so before acting on your request.

How we protect it

Data is stored on servers with encrypted connections, access is limited to staff who need it to run orders, and passwords are never stored in readable form. If a data breach is likely to cause you significant harm, we will notify you and the Personal Data Protection Commission as the law requires.

Changes

If we change this notice, the date at the top changes with it. For anything that affects how we use your data, we will tell you by the contact details on your account.