On this page
Who is responsible for your data
CPL Services Pte. Ltd. (UEN 202137739Z) operates Warebid at warebid.com. This policy explains our collection, use, disclosure and care of personal data in connection with the storefront, orders, enquiries and customer communications, with reference to Singapore’s Personal Data Protection Act 2012 (“PDPA”).
For privacy enquiries, access or correction requests, withdrawal of consent or a data-protection complaint, email our data-protection contact at [email protected]. You may also write to Data Protection, CPL Services Pte. Ltd., 23 Gul Avenue, Singapore 629663. Order and product enquiries go to [email protected].
Information we collect
- Contact and identity details: your name, email, phone number, billing or delivery address, and company name and authorised contact where you buy for a company.
- Transactions: items and quantities, quotations, offers, rentals, order reference, pickup date, delivery instructions, payment and refund amounts, payment status and transaction references, and collection or delivery records.
- Communications and preferences: enquiries, chat messages and photographs you choose to send, support correspondence, alert interests, chosen channels and consent or unsubscribe records.
- Technical and security information: IP address, browser or device information, request and security logs, verification results and information needed to prevent automated abuse or investigate fraud. Public-page analytics may include language, screen dimensions, page paths, referral source and limited campaign labels.
We receive information directly from you, from an authorised person placing or collecting an order, and from payment, delivery and communications providers as needed to provide the service. Do not send full card details, account passwords, unnecessary identity documents or other sensitive information through chat or enquiry forms.
Why we use it
We use relevant information to:
- Answer enquiries, prepare quotations, process orders, verify payment, issue records and arrange pickup, delivery, returns or refunds.
- Provide customer support, show order status after identity and bot checks, and send service messages about a transaction you requested.
- Provide alerts you choose, manage your preferences and record consent or withdrawal.
- Keep the service reliable, prevent misuse, authenticate requests, resolve disputes and improve the public shopping experience.
- Maintain necessary accounting and business records and comply with legal, regulatory and lawful investigation requirements.
We rely on consent, including consent that may be deemed under the PDPA, or another basis the PDPA permits in the circumstances. We do not treat a purchase, enquiry, acceptance of our terms or acknowledgement of this policy as blanket consent to unrelated marketing. If a new purpose requires consent or further notice, we will obtain it or notify you as required.
Payments and order tracking
Online payment credentials are entered through Stripe’s payment service. We receive the transaction reference, amount, status and relevant payment-method information needed to reconcile your order, handle fraud checks and process refunds. We do not ask you to enter a full card number or security code into Warebid chat or enquiry forms. Stripe also handles information under its Privacy Policy (opens in a new tab).
For cash, bank transfer or direct PayNow, staff use payment references and records needed to verify receipt. Share only what is necessary; redact unrelated bank transactions from any evidence you provide.
Order tracking uses an order reference and the checkout email, together with Cloudflare Turnstile and other request safeguards. Keep these details and payment links private, especially on a shared device. Technical safeguards reduce risk but do not make an order reference a substitute for keeping your email and device secure.
Processing outside Singapore
Some providers and their infrastructure may process information outside Singapore. Where personal data is transferred overseas, the PDPA requires an appropriate standard of protection comparable to that under the PDPA, unless a permitted exception applies. We use applicable safeguards, such as enforceable provider obligations, for these transfers. Contact our data-protection contact with questions about relevant overseas processing.
Cookies, browser storage and analytics
Cookies and similar browser storage support language and currency preferences, cart contents, chat continuity and security. Some temporary storage helps continue a payment or checkout flow. Cloudflare and Stripe may use their own technologies for security, fraud prevention and payment functionality.
When enabled, Umami helps us see which public pages people visit and where shoppers stop in checkout. We record anonymous milestones such as reaching shipping, placing an order or seeing a confirmed Stripe payment. We may record broad categories such as pickup or delivery. The reports exclude private checkout, payment and order-tracking URLs, buyer contact details, order references and search text. Technical records used to run and protect the service are handled separately.
You can clear or restrict cookies and browser storage and use browser privacy controls. This may reset your cart and preferences or affect chat, security verification or payment functionality. Optional analytics blocking does not change your order rights. We will provide any additional notice or choice required before introducing materially different tracking.
Alerts, service messages and your choices
Marketing alerts follow the interests and channels you select. You can use an unsubscribe or preference-management link where provided, leave a broadcast channel, or email us to withdraw consent. We will act on withdrawal in accordance with the PDPA and applicable messaging requirements, including Singapore’s Do Not Call rules where relevant.
Order confirmations, payment notices, collection arrangements and replies to your own enquiry are service communications. Opting out of marketing does not stop messages reasonably needed for an existing transaction or a legal obligation. We may retain a limited suppression record to respect an opt-out.
Retention and protection
We retain personal data only while reasonably needed for the purpose collected or a legal or business need, such as fulfilment, payment reconciliation, disputes or accounting. Financial records may need to be retained for at least five years under applicable Singapore tax requirements; the relevant statutory period determines when that period begins. Other records should not be kept indefinitely merely because storage is available.
We use reasonable administrative and technical safeguards appropriate to the information and risk, including access controls and security checks. No internet service or communication method is completely risk-free. Report a suspected data exposure to [email protected]. We assess suspected breaches and notify the PDPC and affected individuals where required by the PDPA.
When retention is no longer justified, we delete the data or remove its association with identifiable individuals, subject to lawful preservation requirements. A deletion request does not override records we must lawfully retain.
Access, correction and withdrawal
Email [email protected] with your request and enough information to identify the relevant interaction. You may request access to personal data in our possession or control and relevant use or disclosure information, request a correction, or withdraw consent on reasonable notice, subject to the PDPA’s conditions and exceptions. We may verify your identity proportionately before disclosing or changing information. Do not send a full identity document unless we explain why it is necessary.
We respond as soon as reasonably possible. If we cannot complete an access or correction request within 30 days, we will tell you in writing within that period when to expect a response. If a reasonable access fee is permitted and applicable, we will explain it in advance. We will explain a refusal where the law permits.
Withdrawal may affect services that need the information; we will explain the likely consequences. It does not affect earlier lawful processing or prevent processing permitted or required without consent. If a privacy concern remains unresolved, you may contact the Personal Data Protection Commission (opens in a new tab).
Other people, external services and updates
If you provide another person’s contact details, ensure you are authorised to do so and direct them to this policy. Our purchases are intended for adults; a parent or guardian who believes a child has provided unnecessary personal data should contact us.
External websites, channel platforms and payment providers have their own privacy practices. We may update this policy as services or legal requirements change. The effective date appears above; where a change requires further notification or consent, we will provide it. Our Terms & Conditions address purchases and use of the storefront.
WhatsApp channel 
Telegram channel