Privacy Policy

ELUMÉ^™ ("we", "us", "our") is committed to protecting your personal data in accordance with Singapore's Personal Data Protection Act 2012 ("PDPA"). This Privacy Policy explains what we collect, why we collect it, how we use and protect it, and the choices you have.

1. Personal Data We Collect

• Account & order data: name, email address, delivery and billing address, contact number, and order history.
• Payment data: processed securely by our payment providers. We do not store full card numbers on our servers.
• Health-related data: if you report an adverse reaction or make a product-safety claim, we may collect a description of the reaction and a photograph of the affected skin area that you choose to send us.
• Technical data: device, browser, and usage information collected through cookies and similar technologies.

2. How We Use Your Data

• To process, fulfil, and deliver your orders, and to handle returns and refunds.
• To respond to enquiries and provide customer support.
• To meet our regulatory obligations, including maintaining post-market cosmetic safety (cosmetovigilance) records required by the Health Sciences Authority (HSA).
• To send you transactional messages and, where you have consented, marketing communications.
• To improve our website, products, and services.

3. Sensitive Data & Skin Photographs

Photographs of an affected skin area, and any reaction details you provide, are collected and used only to assess your claim and to maintain the safety records required by the HSA. This information is accessed strictly on a need-to-know basis, is retained only as long as necessary for those purposes or as required by law, and is never used for marketing. You may decline to provide a photograph, although this may limit our ability to assess certain claims.

4. Disclosure to Third Parties

We share personal data only with parties who help us operate our business — such as payment processors, delivery and logistics partners, IT and hosting providers, and, where required, regulatory authorities. These parties are permitted to use your data only for the purposes we specify and must protect it to a standard consistent with the PDPA.

5. Data Protection & Retention

We make reasonable security arrangements to protect personal data against unauthorised access, use, or disclosure. We retain personal data only for as long as it is needed for the purposes set out above or to meet legal and regulatory requirements, after which it is securely deleted or anonymised.

6. Your Rights Under the PDPA

• Access & correction: you may request access to, or correction of, the personal data we hold about you.
• Withdrawal of consent: you may withdraw consent to our use of your data (including marketing) at any time; this may affect our ability to provide certain services.

To exercise any of these rights, email info@elume.sg.

7. Cookies

We use cookies and similar technologies to keep your cart, remember preferences, and understand site usage. You can control cookies through your browser settings, though disabling them may affect site functionality.

8. Bot Protection (Cloudflare Turnstile)

We use Cloudflare Turnstile on our login, sign-up, and password-reset forms to protect them from automated abuse (bots and credential-stuffing attacks). Turnstile operates invisibly — it does not present a visual CAPTCHA puzzle to real users. To determine whether a visitor is human, Cloudflare may collect browser and device signals, including your IP address, user-agent string, and interaction patterns. This data is processed by Cloudflare, Inc. solely for security purposes and is not used for advertising. For full details, see Cloudflare's Privacy Policy and the Cloudflare Turnstile Privacy Addendum.

9. Data Protection Officer & Contact

For any questions, requests, or complaints regarding your personal data or this policy, contact our Data Protection Officer at info@elume.sg. We respond within 2 business days and aim to resolve PDPA requests within the timeframes set by law.

This policy is governed by the laws of Singapore, including the Personal Data Protection Act 2012.