Privacy Policy
Your trust is the foundation of the vault. Here's exactly how we handle your data.
1. Information We Collect
Account data: name, email, password hash, billing/shipping addresses, phone number.
Transaction data: order history, payment method metadata (no raw card numbers — handled by our PCI-DSS Level 1 processor), authentication certificates issued.
Behavioural data: pages visited, items viewed, search queries, used to improve discovery — never sold to third parties.
Optional data you submit: consignment photos, ID for high-value transactions, marketing preferences.
2. How We Use Your Information
Fulfilling orders, processing payments, and shipping collectibles.
Authenticating consignments and maintaining chain-of-custody records.
Sending order updates, security notifications, and (only with consent) marketing.
Fraud prevention, accounting, and legal compliance under Singapore PDPA and applicable laws.
3. Data Sharing
Payment processors (Stripe), shipping carriers (DHL, FedEx, SingPost), and our authentication lab — strictly to fulfil your order.
We never sell personal data to advertisers or data brokers.
Law enforcement only when required by a valid legal order or to protect rights and safety.
4. Data Retention
Order and authentication records: kept for 7 years for legal and provenance purposes.
Account data: retained while your account is active and 24 months after closure.
Marketing preferences: respected until you opt out, then deletion within 30 days.
5. Your Rights
Access, correct, or download a copy of your personal data at any time.
Request deletion of your account (subject to retention obligations for past orders).
Withdraw marketing consent in any email or in your account settings.
Contact our DPO at privacy@bricko.toys for any data request — response within 30 days.
6. Security
SOC 2-aligned controls, full TLS in transit, AES-256 at rest, principle-of-least-privilege access for staff.
Annual penetration testing and continuous monitoring.
7. Cookies
Strictly necessary cookies for cart, login, and session security — always on.
Analytics and preference cookies — optional, configurable in your browser settings.
8. Changes to this Policy
Material changes will be notified by email and posted at the top of this page at least 14 days before taking effect.