Privacy Policy

Orri Sleep Pte Ltd. takes the protection of your personal data seriously. Please read this Privacy Policy carefully. It explains what personal data we collect, why we collect it, how we use and protect it, and what rights you have under Singapore's Personal Data Protection Act 2012 (No. 26 of 2012), as amended by the Personal Data Protection (Amendment) Act 2020. Our online store is operated via Shopify.

This Policy applies to:

  • All visitors to our website at orrisleep.com and its sub-domains
  • Individuals who subscribe to our mailing list
  • Individuals who register a customer account with us
  • Individuals who place orders through our store

Personal Data

We collect personal data in the following circumstances:

From all website visitors — When you browse our site, we may automatically collect technical data such as your IP address, browser type, device information, pages visited, and time spent on each page. This is done through cookies and similar tracking technologies. Some of this information is aggregated and cannot be used to identify you individually.

From email subscribers — When you submit your email address to us, we collect that email address for the purpose of sending you marketing communications. By submitting your email, you consent to its use as described in this Policy.

From registered account holders — When you create a customer account, we collect your name, email address, phone number, billing and shipping addresses, and account login credentials (stored in hashed form).

From customers placing orders — We collect your identity and contact details, order and transaction history, and payment method information. Full payment card details are never stored by us — they are processed directly by our PCI-DSS certified payment processor (Shopify Payments or equivalent).

We use your personal data only for the following purposes:

  • Processing and fulfilling your orders, including arranging delivery and issuing receipts
  • Managing your customer account
  • Sending transactional communications such as order confirmations and shipping notifications
  • Sending weekly newsletters, product updates, and promotional offers — only where you have given consent
  • Responding to customer service queries and complaints
  • Improving our website and understanding how visitors use it
  • Detecting and preventing fraud and ensuring the security of our store
  • Complying with applicable Singapore legal obligations, including tax record-keeping under the GST Act and Income Tax Act
  • In the event of a business sale or transfer (see Section 8 below)

We will not use your personal data for any new or materially different purpose without informing you and, where required, obtaining your fresh consent.

Consent and Your Right to Opt Out 

Where we rely on your consent to send marketing communications, you may withdraw that consent at any time by clicking the "Unsubscribe" link in any marketing email.

Withdrawal of consent does not affect the lawfulness of any processing carried out before withdrawal. It also does not affect our ability to process your data for non-marketing purposes, such as fulfilling an existing order.

Cookies

Cookies are small text files placed on your device when you visit our website. We use them to operate our store, remember your preferences, and — with your consent — to analyse site usage and deliver targeted advertising.

We use the following types of cookies:

  • Strictly necessary — Required for the store to function (e.g., shopping cart, checkout session). These cannot be disabled.
  • Functional — Remember your preferences and recently viewed items. Optional.
  • Analytics — Help us understand how visitors use our site (e.g., Google Analytics, Shopify Analytics). Optional.
  • Marketing — Used for retargeting and ad measurement (e.g., Meta Pixel, Google Ads). Optional and consent-based.

On your first visit, a cookie consent banner will allow you to accept or decline non-essential cookies. You may also manage cookie preferences through your browser settings, though disabling certain cookies may affect store functionality.

Disclosure to Third Parties

We do not sell, rent, or trade your personal data to any unaffiliated third party for their own commercial purposes.

We may share your data with trusted third-party service providers who assist us in operating our store and delivering services to you. These include:

  • Shopify Inc. — our ecommerce platform provider
  • Payment processors — such as Shopify Payments or Stripe (PCI-DSS certified)
  • Courier and logistics partners — for order delivery
  • Email and marketing platforms — for newsletters and transactional emails
  • Analytics and advertising providers — such as Google and Meta (where consent is given)
  • Customer service tools — for managing support queries

All third parties are contractually required to keep your data confidential and to process it only for the purposes we specify. They are not permitted to use your data for their own independent purposes.

We may also disclose your data where required by law, court order, or to protect the rights, property, or safety of our business or others.

Cross-Border Data Transfers

Some of our service providers, including Shopify, operate servers and entities outside Singapore — including in the United States and Canada. Where your personal data is transferred outside Singapore, we ensure that the transfer complies with Section 26 of the PDPA by requiring that the recipient provides a comparable standard of protection, through binding contractual arrangements or other permitted mechanisms.

Sale or Transfer of Business

If [Store Name]'s business or any part of it is sold, merged, or integrated with another business, your personal data may be disclosed to our legal and financial advisers in connection with that transaction, and subsequently transferred to the new owners. We will inform you of any such transfer that materially affects how your data is used.

Retention of Your Personal Data

We retain your personal data only for as long as necessary. The duration for which we retain your personal information depends on different factors - such as whether we need the information to maintain your account, to provide you with Services, comply with legal obligations, resolve disputes or enforce other applicable contracts and policies. When data is no longer needed, we securely delete or anonymise it.

Your Rights & Choices

You have the following rights in relation to your personal data:

  • Right of access — Request a copy of the personal data we hold about you 
  • Right of correction — Request that inaccurate or outdated data be corrected 
  • Right to withdraw consent — Withdraw consent to marketing or other processing at any time
  • Right to data portability — Request your data in a portable format where applicable
  • Managing Communication Preferences. We may send you promotional emails, and you may opt out of receiving these at any time by using the unsubscribe option displayed in our emails to you. If you opt out, we may still send you non-promotional emails, such as those about your account or orders that you have made.

To exercise any of these rights, email us at [Your Email]. We will respond within 30 calendar days. We will not discriminate against you for exercising any of these rights. We may need to verify your identity before we can process your requests, as permitted or required under applicable law. In accordance with applicable laws, you may designate an authorized agent to make requests on your behalf to exercise your rights. Before accepting such a request from an agent, we will require that the agent provide proof you have authorized them to act on your behalf, and we may need you to verify your identity directly with us. We will respond to your request in a timely manner as required under applicable law.

Security

We implement appropriate technical and organisational measures to protect your personal data, including HTTPS encryption, PCI-DSS compliant payment processing, access controls, and Shopify's platform-level security. In the event of a notifiable data breach, we will inform affected individuals and the PDPC within 3 calendar days of confirmation, as required by the PDPA.

Changes to This Policy

We review this Policy regularly. When material changes are made, we will update the effective date on this page and notify registered customers by email. Your continued use of our store after any changes constitutes acknowledgment of the updated Policy. Previous versions are available on request.

This policy was last updated on 1 June 2026.

Contact

Should you have any questions about our privacy practices or this Privacy Policy, or if you would like to exercise any of the rights available to you, please email us at team@orrisleep.com