Privacy Policy

This Privacy Policy governs how CLITE (“we”, “us”, “our”, UEN: 53512225W) collects, uses, processes, discloses, stores, and protects your personal data when you use our website, web platform, official social media channels, and all other official communication channels (collectively the “Service”).

This Policy applies to both individual retail customers and business / wholesale customers, and is drafted in compliance with the Personal Data Protection Act 2012 (PDPA) of Singapore and its subsidiary legislation.

We reserve the right to modify, update, or revise this Policy at any time at our sole discretion. Material changes will be notified via the Service at least 30 days prior to taking effect. Your continued use of the Service after the effective date of the revised Policy constitutes acceptance of the updated terms.

This Policy does not apply to external third-party websites or services that may be linked from the Service. Those third parties have their own privacy policies, and we encourage you to review them separately.

Our Terms of Use form an integral part of your relationship with CLITE and should be read together with this Policy.

We collect the following categories of personal data when you use the Service:

• Identity & Contact Data: Full name, email address, phone number, account password (encrypted), and for wholesale customers: business name, UEN, and contact person details.
• Delivery Data: Delivery address, postal code, delivery instructions, and access information provided by you.
• Transaction Data: Order history, items purchased, order status, payment records (processed via secure third-party gateways), wallet and points balances, and invoice history.
• Profile & Preference Data: Dietary preferences, allergy information you voluntarily provide, date of birth (for loyalty rewards), referral codes, taste preferences, and marketing opt-in status.
• Communications Data: Messages, feedback, reviews, support requests, and correspondence exchanged through any official channel.
• User-Generated Content: Photos, screenshots, posts, or other content you submit for loyalty verification, reviews, or promotional activities.
• Technical & Usage Data: IP address, browser type, device information, operating system, pages visited, access timestamps, referring URLs, cookie data, and usage statistics.
• Location Data: General location derived from IP address or delivery area, used for service optimisation and delivery zone verification.

Under the PDPA and applicable data protection laws, we rely on the following legal bases for processing your personal data:

• Consent: Where you have explicitly provided consent for specific purposes such as marketing communications or customised dietary accommodation. You may withdraw consent at any time.
• Contractual Necessity: Processing necessary to perform our contract with you, including order processing, delivery arrangement, account management, and loyalty programme benefits.
• Legal Obligation: Processing necessary to comply with applicable laws, regulations, court orders, or requests from competent regulatory authorities, including tax and accounting record-keeping requirements.
• Legitimate Interests: Processing based on our legitimate business interests, provided these do not override your fundamental rights and freedoms. This includes improving products and services, analysing usage patterns, preventing fraud, ensuring website security, and conducting reasonable marketing to existing customers.

We use your personal data for the following purposes:

• Processing, fulfilling, and delivering retail and wholesale orders.
• Managing your account, loyalty points, credits, tier status, and referral rewards.
• Processing payments securely and preventing fraudulent transactions.
• Sending order confirmations, delivery updates, and service-related notifications.
• Responding to your enquiries, feedback, complaints, and customer support requests.
• Sending marketing communications about new menu items, special promotions, loyalty rewards, events, exclusive offers, and product updates.
• Personalising your experience and recommending products based on your preferences and order history.
• Conducting market research, statistical analysis, and business improvement to enhance our menu and services.
• Verifying your identity and ensuring the security of your account and our systems.
• Complying with legal obligations, assisting law enforcement, and enforcing our Terms of Use.
• Administering referral programmes, contests, and promotional campaigns.
• Generating anonymous, aggregated analytics reports to understand customer trends and improve website performance.
• For wholesale customers: managing credit terms, invoicing, account management, and B2B communications.

We do not sell your personal data to any third party. We may disclose your data to the following categories of recipients, strictly for the purposes outlined in this Policy:

• Service Providers: Trusted third parties that perform services on our behalf, including payment processors, delivery partners, cloud hosting providers, email and messaging service providers, analytics providers, customer support platforms, and accounting / audit service providers.
• Professional Advisors: Lawyers, accountants, auditors, insurers, and business consultants bound by confidentiality obligations.
• Regulatory & Law Enforcement: Government agencies, regulators, tax authorities, or law enforcement bodies where required by law, court order, legal process, or to protect our legal rights and the safety of our customers and staff.
• Business Transferees: In the event of a merger, acquisition, asset sale, business restructuring, or financing, your data may be transferred to the relevant entity, subject to appropriate confidentiality protections and PDPA compliance.
• With Your Explicit Consent: Any other third party where you have provided specific, informed consent.

All third-party service providers are contractually required to protect your personal data in accordance with standards comparable to the PDPA, and are only permitted to process your data in accordance with our documented instructions.

Our website and web platform use cookies, local storage, and similar tracking technologies to enhance your browsing experience, remember your preferences, maintain your login session, and analyse site traffic and performance.

• Essential Cookies: Required for core functionality including login authentication, shopping cart, session management, and security. These cannot be disabled as the Service will not function properly without them.
• Functional Cookies: Remember your preferences such as language settings, saved delivery addresses, and display preferences to provide a more personalised experience.
• Analytical Cookies: Help us understand how visitors interact with the Service, including pages visited, time spent, and navigation paths, to improve performance and content.

You can control or delete cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of features such as ordering, account login, and the loyalty programme. By continuing to use the Service without changing your cookie settings, you consent to our use of cookies as described herein.

Your personal data is primarily stored and processed in Singapore. However, some of our third-party service providers may operate servers or have operations located outside Singapore.

Where personal data is transferred outside Singapore, we will take reasonable steps to ensure that your data receives a standard of protection comparable to that required under the PDPA. This includes entering into contractual agreements with recipients that impose equivalent data protection obligations, or verifying that recipients are certified under recognised data protection frameworks.

By using the Service and providing your personal data to us, you consent to such international transfers as described in this Policy, subject to the protections outlined above.

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable laws and regulations.

• Transaction & Accounting Records: Retained for up to seven (7) years in accordance with Singapore tax and accounting record-keeping requirements under the Income Tax Act.
• Account Data: Retained while your account is active, and for up to 30 days after an account deletion request, except where longer retention is required for legal purposes or dispute resolution.
• Marketing Data: Retained until you opt out of marketing communications or withdraw your consent. Upon opt-out, we will add your details to our suppression list to ensure you do not receive further marketing messages.
• Loyalty Verification Content: Screenshots, photos, or posts submitted for loyalty task verification are permanently deleted within seven (7) days after admin approval or rejection.
• Customer Support Communications: Support tickets and correspondence retained for up to twelve (12) months for quality assurance, dispute resolution, and follow-up purposes.
• Technical & Analytics Data: Anonymised or aggregated analytics data may be retained indefinitely for business improvement purposes. Identifiable technical logs are retained for up to twelve (12) months.
• Wholesale Customer Records: Business contact information and transaction history retained for the duration of the business relationship plus seven (7) years for accounting and legal purposes.

When personal data is no longer required for the purposes for which it was collected, or upon expiry of the applicable retention period, we will securely delete, anonymise, or destroy the data in accordance with our data retention policies.

We take reasonable technical, administrative, and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, destruction, or accidental loss. These measures include:

• SSL/TLS encryption for all data transmitted between your device and the Service.
• Encrypted storage of passwords and sensitive data using industry-standard hashing algorithms.
• Restricted access controls — personal data is only accessible to authorised personnel on a need-to-know basis.
• Regular security reviews, vulnerability scanning, and system updates.
• Staff training on data protection and confidentiality obligations.
• Secure backup procedures and disaster recovery planning.

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your personal data using commercially reasonable measures, we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and for any activity conducted under your account.

In the event of a data breach that is likely to result in significant harm to you, we will notify you and the Personal Data Protection Commission (PDPC) as required under the PDPA, without undue delay.

Under the Singapore Personal Data Protection Act 2012, you have the following rights in relation to your personal data:

• Right of Access: You may request access to the personal data we hold about you, and information about how we have used or disclosed your data.
• Right of Correction: You may request correction of inaccurate, incomplete, or out-of-date personal data that we hold about you.
• Right to Withdraw Consent: You may withdraw your consent for the collection, use, or disclosure of your personal data at any time. Please note that withdrawing consent may affect our ability to provide certain services to you, including order processing, delivery, and loyalty benefits. We will notify you of the likely consequences before processing your withdrawal.
• Right to Opt Out of Marketing: You may opt out of marketing communications at any time by clicking the unsubscribe link in marketing emails, adjusting your account notification preferences, or contacting us directly.
• Right to Data Portability: Where technically feasible, you may request a machine-readable copy of the personal data you have provided to us.

To exercise any of these rights, please contact our Data Protection Officer using the details below. We will respond to your request within thirty (30) days as required under the PDPA. We may request reasonable verification of your identity before processing your request to protect your privacy and security.

We reserve the right to charge a reasonable administrative fee for repeated, excessive, or manifestly unfounded access requests, as permitted under the PDPA.

Please note that even after you withdraw consent or request deletion, we may retain certain personal data as required by law or for legitimate business purposes to the extent permitted by law.

With your consent where required, we may send you marketing communications about new menu items, special promotions, loyalty rewards, events, exclusive offers, and product updates via email or other official communication channels.

We will only send marketing messages to you if you have opted in, or if you are an existing customer and the messages relate to similar products and services you have previously purchased from us (the “soft opt-in” exception under the PDPA).

You may opt out of marketing communications at any time by:

• Clicking the “unsubscribe” link in any marketing email.
• Adjusting your notification preferences in your account settings.
• Contacting us directly at hello@clite.com.sg with the subject line “Unsubscribe”.

Even after opting out of marketing, you will continue to receive essential service-related communications such as order confirmations, delivery updates, payment receipts, account security alerts, and responses to your support enquiries.

The Service is not directed at individuals under the age of 18. We do not knowingly collect personal data from children under 18 years of age. Account registration and order placement require users to be at least 18 years old.

If you are a parent or guardian and believe that your child has provided us with personal data without your consent, please contact us immediately. We will take steps to promptly delete such information from our records upon verification.

We do not knowingly process sensitive personal data of any individual without explicit consent, regardless of age.

Information about food allergies, dietary restrictions, and health conditions that you voluntarily provide to us may constitute sensitive personal data under the PDPA. We collect this information only for the purpose of accommodating your dietary needs and customising your orders where possible.

Allergy and dietary information is used solely for order preparation purposes and is not used for marketing or profiling. This information is retained only for as long as necessary to fulfil your orders and is not shared with third parties except as necessary to prepare your food.

If you have any questions, concerns, complaints, or requests regarding this Privacy Policy, our data handling practices, or if you wish to exercise your rights under the PDPA, please contact our Data Protection Officer: