Effective date: 13 October 2026
Son&Bear Pte Ltd (“Son&Bear”, “we”, “us” or “our”) operates the website https://sonandbear.com and the Son&Bear showrooms. This Privacy Policy explains how we collect, use, disclose and safeguard your personal data when you visit our website, place an order with us, visit one of our showrooms, or contact us.
We handle personal data in accordance with the Singapore Personal Data Protection Act (PDPA).
Please read this policy carefully. If you do not agree with it, please do not use the website or our services.
Personal data we collect
Depending on how you interact with us, we may collect:
- Identity and contact data — your name, email address and phone number.
- Delivery data — your delivery address, including unit number and postal code, and any delivery instructions you choose to give us.
- Order data — the items you order, the options you select, the order value, your expected delivery window, any notes recorded against your order, and how you reached our website, such as the advertisement or link you followed and the page you first arrived on.
- Marketing preference — whether you have agreed to receive marketing from us, and when that preference was recorded.
- Enquiry data — what you tell us when you contact us by email, by phone, by WhatsApp, or in person at a showroom.
- Technical data — your IP address and standard web server information, recorded by our hosting provider as part of serving the website. When you check out, your IP address and your browser and device details are also kept briefly with your order, as described under Analytics and advertising below.
- Website activity — the pages you visit and the actions you take on our website, such as adding an item to your basket, recorded by the analytics and advertising cookies and pixels described under Analytics and advertising below.
There are no customer accounts on this website, and we do not build a profile of your browsing or interests in our own systems. You order as a guest. There is no login, no password, no saved account, and no browsing or wishlist history kept against you. What we hold is the order record itself, with the contact and delivery details you gave us for that order. If you order with us more than once using the same email address, we keep your name, contact details and marketing preference in one customer record linked to those orders. Separately, the Google and Meta cookies and pixels on our website record visits for analytics and advertising, and Google and Meta use them to build advertising audiences for us, as described under Analytics and advertising below.
When you order through this website, we never receive or store your card details. Payment is taken by Stripe on its own secure checkout. Your card information is entered directly with Stripe, never passes through our systems and is never stored by us — we receive only a payment reference and whether the payment succeeded.
If you buy from us in person at a showroom, payment is taken there at the time of purchase. Card payments are handled on a payment terminal; as with online orders, we do not store your card number.
We do not collect NRIC, FIN or passport numbers, identity documents, income or employment information, or bank account details through the website.
How we collect your data
- Directly from you — when you place an order at checkout, sign up to our newsletter, contact us, or give us your details at a showroom.
- Automatically — a necessary cookie holds a reference to your shopping basket so its contents are still there when you return, our own advertising cookie remembers, for up to 90 days, the advertisement or link that brought you to our website, so that an order can record it, and analytics and advertising cookies and pixels (Google, Meta and PostHog) help us understand how the site is used, measure our advertising and show our advertisements to people who have visited our website, as described under Analytics and advertising below. Our hosting provider also records standard server logs. We use the country your internet connection comes from, as worked out by our hosting provider, to suggest our Singapore or Malaysia website and, on your first visit to our home page, to take you to the website for that country; we do not record it. A cookie remembers, for up to 180 days, that we have done so or which website you chose, so we do not ask or move you again.
Analytics and advertising. We use Google Analytics, Google Ads and the Meta (Facebook and Instagram) pixel on our website. They use cookies and similar technologies to record the pages you visit and the actions you take, such as adding an item to your basket. We use this to understand how our website is used, to measure our advertising, and for remarketing. Other companies (third-party vendors), including Google and Meta, use cookies to show our advertisements to you on their own services, such as Google, YouTube, Facebook and Instagram, and on other websites and apps across the internet, based on your past visits to our website and to other websites.
We also use PostHog, run for us by PostHog, Inc. in the United States, to understand how our website is used: which pages and parts of a page are viewed, where visitors click and how far they scroll, and recordings that replay a visit on screen. In those recordings, anything typed into a form is hidden, and so are your details on our checkout and order pages. PostHog does not identify you or build a profile of you, and handles this information only on our behalf. PostHog uses your IP address only to work out your country and city, and does not keep it.
When you complete a purchase, our website tells Google and Meta about it, so that we can see which advertisements lead to orders. Our server also sends Meta a record of the purchase, with a hashed (coded) form of your email address and phone number, your IP address, your browser and device details, Meta’s cookie identifier, and the identifier from any Facebook or Instagram link you arrived through. Meta uses these to match the purchase to its own users; your email address and phone number are never sent to Meta in a readable form. We keep your IP address, browser and device details and Meta’s cookie identifier with your order only until that record has been sent, or until an unfinished checkout lapses. Copies in our database’s daily backups are deleted within seven days.
When you fill in a form on our website, such as checkout, a trade enquiry or our newsletter sign-up, Google’s advertising and analytics tags and Meta’s pixel may also automatically detect the contact details you enter, such as your name, email address, phone number and address, and send them to Google and Meta in a hashed (coded) form, which they handle under their own terms.
The events our Meta pixel records on our website are also sent through a server run for us by Stape, Inc., a service provider based in the United States, on Google Cloud. The server passes them to Meta on our behalf, so that fewer of them are lost on the way. It carries the same information the pixel collects, including any hashed contact details, together with the identifiers in Google’s and Meta’s cookies on our website, and Stape handles it only on our behalf.
Your choices. Our analytics and advertising cookies are not needed for the website to work. You can block or delete them in your browser settings, and limit ad tracking in your phone’s settings. To turn off personalised advertising, including remarketing, use Google’s My Ad Center (myadcenter.google.com) and the ad preferences in your Facebook or Instagram settings. You can also opt out with many advertising companies at once through the Digital Advertising Alliance (aboutads.info/choices), and stop Google Analytics recording your visits with Google’s browser add-on (tools.google.com/dlpage/gaoptout). Our marketing emails stay separate, and are only sent if you ask for them, by ticking the marketing box at checkout or signing up to our newsletter.
How we use your information
- Fulfilling your order — taking payment, confirming your purchase, arranging manufacture or allocation, scheduling delivery and keeping you informed of its progress.
- After-sales support — answering questions, handling warranty claims, and arranging cancellations, refunds or exchanges under our published policies.
- Our records — maintaining order and accounting records as required for tax and business purposes.
- Security — investigating and acting on suspected fraudulent or unlawful activity.
- Analytics and advertising — understanding how our website is used, measuring our advertising, and showing our advertisements to people who have visited our website, as described under Analytics and advertising above.
- Marketing emails and messages, where you have given us clear consent. You can withdraw that consent at any time and we will stop.
How we disclose personal data
We share personal data with service providers who process it on our behalf, under contract and only for the purposes we specify:
- Payment processing — Stripe, to take and reconcile payments.
- Website hosting and databases — the providers that host the website and store the order records behind it.
- Email delivery — the service that sends your order confirmations and our replies.
- Error monitoring — Sentry, a service of Functional Software, Inc., which receives a technical report when part of our website fails, so that we can find and fix the fault quickly. A report contains technical error data: what went wrong, the page it happened on, and your browser and device type. Before a report leaves our website, we remove order-tracking links, payment session references and email addresses from it, and we do not send your IP address.
- Advertising delivery — Stape, Inc., which runs the server that passes our Meta pixel’s events to Meta, as described under Analytics and advertising above.
- Accounting — our accounting system, for invoicing and financial records.
- Delivery and installation — our delivery partners, who receive the name, address, phone number and delivery instructions needed to complete your delivery.
We also share information with Google (Google Analytics and Google Ads) and Meta (Facebook and Instagram) for analytics and advertising, as described under Analytics and advertising above. Google and Meta use it under their own terms and privacy policies, including to show advertisements.
We may also disclose personal data where we are required to by law, or to establish, exercise or defend a legal claim.
We do not sell or rent your personal data. What we share for advertising is set out under Analytics and advertising above: the activity our cookies and pixels record on our website, the purchase record, and hashed contact details. Your email address and phone number are never sent to advertising partners in a readable form.
Where your data is held. We use two databases, both provided by Supabase. Our product and catalogue records, and the order records we use to fulfil and support your order, are held in Singapore. The website’s copy of your order records — including your name, email address, phone number and delivery address — is held in a database hosted in Tokyo, Japan. Technical error reports sent to Sentry are stored in the United States. Information collected by Google’s and Meta’s cookies and pixels, including the events that pass through Stape’s server, is processed by those companies on their own systems, including in the United States. Your personal data is therefore stored and processed outside Singapore.
Under the PDPA, personal data may only be transferred overseas where it will be protected to a standard comparable to that required in Singapore. We rely on the Data Processing Addendum of our database provider, Supabase (Supabase Pte. Ltd., a Singapore company), which is in force as part of its terms and requires Supabase to protect your data using Standard Contractual Clauses, encryption in storage and in transit, and independently audited security (SOC 2 Type 2 and ISO 27001). Google, Meta and Stape handle the information their tags and server collect under their own terms.
Third-party websites and links
Our website may link to sites operated by other people. If you follow such a link you should read that site’s own privacy policy and terms — we do not control those sites and are not responsible for their privacy or security practices.
Children’s data
Our services are not intended for children and we do not knowingly collect personal data about them. If you are the parent or guardian of a child who has given us their personal data, please contact us and we will delete it.
Security and retention
We apply technical and organisational measures appropriate to the sensitivity of the data we hold, including restricted access to our systems and encrypted connections to our website. No system is completely secure, and information sent to us over the internet is never entirely without risk.
We keep your personal data for as long as is necessary for the purpose it was collected. Order, payment and accounting records are kept for the period required by Singapore tax and business record-keeping law. Where you withdraw marketing consent we stop using your data for marketing, though we will still hold the order records we are required to keep.
Your rights under the PDPA
You have the right to:
- Access — ask for a copy of the personal data we hold about you, and information about how it has been used or disclosed in the past year.
- Correction — ask us to correct data that is inaccurate or out of date.
- Deletion — ask us to delete the personal data we hold about you. We cannot delete the order, payment and accounting records that Singapore law requires us to keep. We will tell you which records those are, and everything outside them will be deleted.
- Withdraw consent — withdraw your consent to our use of your data, including marketing, at any time. Where withdrawal would prevent us from fulfilling an order you have already placed, we will tell you what the consequences are before acting on it.
- Stop receiving marketing — every marketing email carries an unsubscribe link, and using it stops promotional messages. We will still send you messages about orders you have placed.
Information that Google and Meta hold under their own terms is managed through the settings described under Your choices above, and through Google’s and Meta’s own privacy tools.
We may need to verify your identity before responding, and we will respond within a reasonable time. We will not treat you differently for exercising any of these rights.
Complaints
If you are unhappy with how we have handled your personal data, please contact us first using the details below. If you are not satisfied with our response, you may lodge a complaint with the Personal Data Protection Commission of Singapore.
Contact us about your data
To exercise any of the rights above, or to ask a question about how we handle your personal data, contact our Data Protection Officer:
sales@sonandbear.com
Son&Bear Pte Ltd
8 Ubi Road 2, Zervex #01-07/08, Singapore 408538
+65 9821 2252
Changes to this policy
We may update this policy from time to time. The current version is always on this page, and the effective date at the top tells you when it last changed.