Effective date: 1 September 2026
Son&Bear Pte Ltd (“Son&Bear”, “we”, “us” or “our”) operates the website https://sonandbear.com and the Son&Bear showrooms. This Privacy Policy explains how we collect, use, disclose and safeguard your personal data when you visit our website, place an order with us, visit one of our showrooms, or contact us.
We handle personal data in accordance with the Singapore Personal Data Protection Act (PDPA).
Please read this policy carefully. If you do not agree with it, please do not use the website or our services.
Personal data we collect
Depending on how you interact with us, we may collect:
- Identity and contact data — your name, email address and phone number.
- Delivery data — your delivery address, including unit number and postal code, and any delivery instructions you choose to give us.
- Order data — the items you order, the options you select, the order value, your expected delivery window, and any notes recorded against your order.
- Marketing preference — whether you have agreed to receive marketing from us, and when that preference was recorded.
- Enquiry data — what you tell us when you contact us by email, by phone, by WhatsApp, or in person at a showroom.
- Technical data — your IP address and standard web server information, recorded by our hosting provider as part of serving the website.
There are no customer accounts on this website, and we do not build a customer profile. You order as a guest. There is no login, no password, no saved account, and no browsing or wishlist history kept against you. What we hold is the order record itself, with the contact and delivery details you gave us for that order.
When you order through this website, we never receive or store your card details. Payment is taken by Stripe on its own secure checkout. Your card information is entered directly with Stripe, never passes through our systems and is never stored by us — we receive only a payment reference and whether the payment succeeded.
If you buy from us in person at a showroom, payment is taken there at the time of purchase. Card payments are handled on a payment terminal; as with online orders, we do not store your card number.
We do not collect NRIC, FIN or passport numbers, identity documents, income or employment information, or bank account details through the website.
How we collect your data
- Directly from you — when you place an order at checkout, contact us, or give us your details at a showroom.
- Automatically — a necessary cookie holds a reference to your shopping basket so its contents are still there when you return, and analytics and advertising cookies and pixels (Google and Meta) help us understand how the site is used and measure our advertising, as described under Analytics and advertising below. Our hosting provider also records standard server logs.
Analytics and advertising. We use Google Analytics and the Meta (Facebook and Instagram) pixel to understand how our website is used and to measure our advertising, along with Google Ads conversion tracking. When you make a purchase, we send a record of it to Meta and Google to measure our advertising — using a hashed (irreversibly scrambled) form of your email and phone number, your IP address, and the identifier from any advertisement you arrived through. Your email and phone number are never shared in a readable form, and your IP address is used only to match the purchase to the advertisement and is then deleted from that record. When you fill in a form on our website, such as checkout or a trade enquiry, Meta’s pixel may also send Meta a hashed form of the email and phone number you enter, so that our advertising can be measured. You can manage cookies through your browser settings, and opt out of personalised advertising through Google’s and Meta’s own settings. Our marketing emails stay separate and are only sent if you tick the marketing box at checkout.
How we use your information
- Fulfilling your order — taking payment, confirming your purchase, arranging manufacture or allocation, scheduling delivery and keeping you informed of its progress.
- After-sales support — answering questions, handling warranty claims, and arranging cancellations, refunds or exchanges under our published policies.
- Our records — maintaining order and accounting records as required for tax and business purposes.
- Security — investigating and acting on suspected fraudulent or unlawful activity.
- Marketing, where you have given us clear consent. You can withdraw that consent at any time and we will stop.
How we disclose personal data
We share personal data with service providers who process it on our behalf, under contract and only for the purposes we specify:
- Payment processing — Stripe, to take and reconcile payments.
- Website hosting and databases — the providers that host the website and store the order records behind it.
- Email delivery — the service that sends your order confirmations and our replies.
- Error monitoring — Sentry, a service of Functional Software, Inc., which receives a technical report when part of our website fails, so that we can find and fix the fault quickly. A report contains technical error data: what went wrong, the page it happened on, and your browser and device type. Before a report leaves our website, we remove order-tracking links, payment session references and email addresses from it, and we do not send your IP address.
- Accounting — our accounting system, for invoicing and financial records.
- Delivery and installation — our delivery partners, who receive the name, address, phone number and delivery instructions needed to complete your delivery.
We may also disclose personal data where we are required to by law, or to establish, exercise or defend a legal claim.
We do not sell or rent your personal data. The only information we share for advertising is the hashed, measurement-only data described under Analytics and advertising above; we do not share your readable personal data with advertising partners.
Where your data is held. We use two databases, both provided by Supabase. Our product and catalogue records are held in Singapore. Your order records — including your name, email address, phone number and delivery address — are held in a database hosted in Tokyo, Japan. Technical error reports sent to Sentry are stored in the United States. Your personal data is therefore stored and processed outside Singapore.
Under the PDPA, personal data may only be transferred overseas where it will be protected to a standard comparable to that required in Singapore. We rely on the Data Processing Addendum of our database provider, Supabase (Supabase Pte. Ltd., a Singapore company), which is in force as part of its terms and requires Supabase to protect your data using Standard Contractual Clauses, encryption in storage and in transit, and independently audited security (SOC 2 Type 2 and ISO 27001).
Third-party websites and links
Our website may link to sites operated by other people. If you follow such a link you should read that site’s own privacy policy and terms — we do not control those sites and are not responsible for their privacy or security practices.
Children’s data
Our services are not intended for children and we do not knowingly collect personal data about them. If you are the parent or guardian of a child who has given us their personal data, please contact us and we will delete it.
Security and retention
We apply technical and organisational measures appropriate to the sensitivity of the data we hold, including restricted access to our systems and encrypted connections to our website. No system is completely secure, and information sent to us over the internet is never entirely without risk.
We keep your personal data for as long as is necessary for the purpose it was collected. Order, payment and accounting records are kept for the period required by Singapore tax and business record-keeping law. Where you withdraw marketing consent we stop using your data for marketing, though we will still hold the order records we are required to keep.
Your rights under the PDPA
You have the right to:
- Access — ask for a copy of the personal data we hold about you, and information about how it has been used or disclosed in the past year.
- Correction — ask us to correct data that is inaccurate or out of date.
- Deletion — ask us to delete the personal data we hold about you. We cannot delete the order, payment and accounting records that Singapore law requires us to keep. We will tell you which records those are, and everything outside them will be deleted.
- Withdraw consent — withdraw your consent to our use of your data, including marketing, at any time. Where withdrawal would prevent us from fulfilling an order you have already placed, we will tell you what the consequences are before acting on it.
- Stop receiving marketing — every marketing email carries an unsubscribe link, and using it stops promotional messages. We will still send you messages about orders you have placed.
We may need to verify your identity before responding, and we will respond within a reasonable time. We will not treat you differently for exercising any of these rights.
Complaints
If you are unhappy with how we have handled your personal data, please contact us first using the details below. If you are not satisfied with our response, you may lodge a complaint with the Personal Data Protection Commission of Singapore.
Contact us about your data
To exercise any of the rights above, or to ask a question about how we handle your personal data, contact our Data Protection Officer:
sales@sonandbear.com
Son&Bear Pte Ltd
8 Ubi Road 2, Zervex #01-07/08, Singapore 408538
+65 9821 2252
Changes to this policy
We may update this policy from time to time. The current version is always on this page, and the effective date at the top tells you when it last changed.