Privacy Policy

About this policy

GRAIL Skin Pte Ltd (GRAIL Skin, we, us or our) is responsible for the personal data described in this policy. This policy explains how we collect, use, disclose and protect personal data when you visit www.grailskin.com, purchase from us, create an account, subscribe to our emails, submit a review or contact us.

Personal data means information about an individual who can be identified from that information or other information to which we have or are likely to have access.

For privacy enquiries, requests or complaints, email hello@grailskin.com and mark your message for the attention of the Data Protection Officer.

Personal data we collect

We collect information you provide when placing an order, creating an account, subscribing to our newsletter, submitting a product review or contacting us. Depending on your interaction, this includes your name, email address, telephone number, billing and delivery addresses, account information, order details, correspondence and marketing preferences.

Payments are handled through payment service providers. We use relevant transaction information, such as payment status and payment references, to administer orders and refunds.

Product reviews are text-only. The review text and the display name you choose are intended for public display on our website. Please do not include private information about yourself or anyone else in a review.

Technical information may be generated when you use the website, such as IP addresses, browser information and security logs, to operate and protect the website.

If you provide another person’s details, for example for a gift delivery, please ensure that you are authorised to do so and that the person has been informed of the relevant purposes. We remain responsible for meeting our own obligations under applicable law.

How and why we use personal data

We use relevant personal data to process payments, fulfil and deliver orders, administer accounts, manage cancellations and returns, respond to enquiries and complaints, publish product reviews and maintain necessary transaction records.

We also use relevant information to operate and protect the website, investigate suspected fraud or misuse, meet legal obligations and address product safety concerns. Where you choose to subscribe, we use your email address to send product news, promotional offers and other GRAIL marketing emails.

We collect, use or disclose personal data with your consent, including where consent is deemed under the Personal Data Protection Act 2012 (PDPA), or where applicable law otherwise permits or requires it. We will notify you of relevant purposes and obtain any consent required before using your personal data for a new purpose. We do not require consent beyond what is reasonably necessary to provide the requested product or service.

Marketing and your choices

Marketing is optional and is sent by email only. You can opt in when creating an account, through our newsletter sign-up form, or at checkout when making your first purchase. The marketing checkboxes at account registration and checkout are optional and unticked by default. Making a purchase or creating an account does not automatically subscribe you to marketing emails.

Every marketing email includes an unsubscribe link. You can also withdraw your marketing consent by emailing hello@grailskin.com. Opting out does not prevent necessary communications about orders, deliveries, product safety or privacy requests.

We do not use your purchase history to personalise marketing emails or share your personal data with other brands for their own marketing.

Disclosure of personal data

We disclose relevant personal data to providers that support website hosting and e-commerce operations, payment processing, delivery and email communications, where needed for the purposes described in this policy and permitted by law.

Providers acting on our behalf must handle personal data for authorised purposes and with appropriate protection. Payment providers and other providers acting independently may also explain their processing in their own privacy notices.

We may disclose information to authorities where legally required, and to professional advisers where necessary for legal or regulatory matters and permitted by law. We do not sell your personal data.

Cookies and similar technologies

Our website may use cookies and similar technologies to support functions such as customer accounts, shopping baskets and checkout. You can manage cookies through your browser settings; disabling some cookies may affect website functionality.

If we introduce analytics or advertising technologies, we will provide relevant information and obtain consent where required before using personal data for those purposes.

Transfers outside Singapore

If personal data is transferred outside Singapore, we will take steps required by the PDPA to ensure a standard of protection comparable to that under the PDPA, unless a lawful exemption applies.

Accuracy security and retention

We take reasonable steps to ensure personal data is accurate and complete where it is likely to be used to make a decision affecting you or disclosed to another organisation. Please let us know if your details change.

We make reasonable security arrangements to protect personal data against unauthorised access, collection, use, disclosure, copying, modification, disposal and similar risks. No system is completely secure.

We cease retaining personal data, or remove the means by which it can be associated with you, when its purpose is no longer served and retention is no longer necessary for legal or business purposes. Relevant considerations include transaction records, disputes, legal obligations and marketing suppression records.

Access correction and withdrawal of consent

You may request access to personal data in our possession or control and information about how it was used or disclosed in the preceding year, and request correction of errors or omissions, subject to applicable law and exceptions. Contact our Data Protection Officer with sufficient details to identify your request. We may reasonably verify your identity to protect your information.

We will respond to access requests as soon as reasonably possible. If we cannot respond within 30 days after receiving an access request, we will inform you in writing within that period of when we expect to respond. Any permitted access fee will be explained in advance. Corrections will be handled in accordance with the PDPA.

You may withdraw consent by giving us reasonable notice through our Data Protection Officer. We will explain the likely consequences and stop the relevant collection, use or disclosure unless it is required or permitted without consent by law. Withdrawal may prevent us from providing a service that needs the information; it does not automatically require deletion of records that we lawfully need to retain.

You may ask us to delete personal data. We will assess the request against our retention obligations and applicable law. The PDPA does not provide an unrestricted right to immediate deletion of all personal data.

Data incidents and complaints

We will assess suspected personal data breaches and notify the Personal Data Protection Commission and affected individuals where required by the PDPA.

Please contact our Data Protection Officer if you have a privacy concern. You may also contact the Personal Data Protection Commission through www.pdpc.gov.sg.

Updates to this policy

We may update this policy to reflect changes in our practices or applicable law. We will publish the revised policy on our website and provide further notice or obtain consent where required. Publishing a revised policy does not by itself authorise a new use of personal data that requires your consent.