Privacy policy.
How Reeluxs Bag Spa collects, uses and protects the information you share with us.
Last updated: 12 June 2026
This Privacy Policy explains how Reeluxs Pte. Ltd. (“Reeluxs”, “we”, “our”, or “us”) collects, uses, discloses, and protects your personal data when you interact with us — including when you visit reeluxsbagspa.com, submit a quote request, send us photos via WhatsApp, walk into our Tanjong Pagar outlet, or otherwise engage with our services.
We are committed to safeguarding your personal data in accordance with the Personal Data Protection Act 2012 of Singapore (“PDPA”).
1. Who we are
Reeluxs Pte. Ltd. is a company registered in Singapore. We operate a luxury bag spa outlet at:
11 Kee Seng Street, #01-06 Onze Tanjong Pagar
Singapore 089218
Our contact details:
- Email: reeluxs.sg@gmail.com
- Phone / WhatsApp: +65 9888 8487
- Website: https://reeluxsbagspa.com
For matters related to your personal data, please refer to Section 13 (“Data Protection Officer”).
2. Personal data we collect
We collect personal data only when it is necessary for our services or when you choose to provide it. Categories include:
(a) Identification and contact details
- Name
- Phone number
- Email address
- WhatsApp number (where you choose to engage via WhatsApp)
(b) Service request information
- Brand, model, and material of the bag you wish to send to our outlet
- Age and condition of the bag
- Photographs of the bag (typically sent via WhatsApp; we do not require photo uploads through the website)
- Services requested and any free-text description you provide
- Estimated value range communicated during the quote process
(c) Transactional records
- Quote reference number and date
- Service history (which services were performed on which bags)
- Payment-method indicator (we do not store full card numbers; payment processors handle card data)
- Receipts, invoices, and warranty records
(d) Communications
- Email correspondence
- WhatsApp message history relating to your quote or service
- Records of in-person visits where you provide your contact details for pickup notifications
(e) Technical and analytics data
When you visit reeluxsbagspa.com, we collect:
- IP address (truncated for analytics purposes)
- Browser type, operating system, and device identifiers
- Pages visited, time spent, and referring URL
- Cookies and similar tracking technologies (see Section 10)
We collect technical data through:
- Google Site Kit (Google Analytics, Google Search Console)
- Meta Pixel (Facebook Pixel, for advertising performance measurement)
(f) Marketing preferences
- Subscription status to any newsletter or promotional list
- Withdrawal-of-consent records
We do not knowingly collect personal data from children under the age of 13. See Section 12.
3. How we use your data
We use your personal data for the following purposes:
| Purpose | Examples |
|---|---|
| Service fulfilment | Preparing your quote, communicating about your bag’s condition, arranging pickup/drop-off, performing the service, sending updates during restoration, notifying you when ready for collection |
| Customer support | Answering questions, resolving complaints, providing warranty service |
| Operational records | Maintaining accurate quotation and service-history records, issuing receipts, fulfilling our warranty obligations |
| Legal & tax compliance | Producing records for tax authorities; responding to lawful requests from regulators or courts |
| Site improvement | Understanding which pages and services interest visitors, measuring page performance, debugging |
| Marketing (only with consent) | Sending promotional updates about new services, offers, or outlet events |
| Security | Detecting and preventing fraud, abuse, or unauthorised access |
4. Lawful basis under the PDPA
Under the PDPA, we rely on the following grounds for processing your personal data:
- Consent — for marketing communications and for non-essential cookies (you may withdraw consent at any time; see Section 9).
- Necessary for a contract or service — quote handling, service performance, and warranty enforcement. We cannot deliver our services without processing the personal data described in Section 2(a)–(d).
- Legitimate interests — site analytics, security, fraud prevention, and improvement of our services, balanced against your privacy interests.
- Legal obligation — tax records, regulatory disclosures, and compliance with lawful requests.
5. Sharing your personal data
We do not sell your personal data. We share it only when necessary and only with the following categories of recipients:
(a) Service providers acting on our behalf
- Hostinger International Ltd. — website hosting and email infrastructure
- Google LLC — analytics (Site Kit / Google Analytics), Search Console, and Workspace tools
- Meta Platforms, Inc. — advertising measurement (Meta Pixel)
- Imagify (WP Media) — image optimisation processing for media uploaded to the website
- WP-Rocket (WP Media) — caching infrastructure (does not transfer personal data offsite)
- Setmore (Setmore Inc.) — appointment-booking platform, where used
- Wordfence (Defiant Inc.) — website security
- Payment processors (only at the moment of payment; we do not retain card data)
We require service providers to handle your personal data only for the purposes we specify, and to maintain appropriate security.
(b) Professional advisors
- Auditors, accountants, and legal counsel where reasonably required
(c) Authorities
- Where required by Singapore law, court order, or governmental request
(d) In the event of a corporate transaction
- If the business is restructured, merged, or its assets are transferred, personal data may form part of the assets transferred — subject to the same protections set out here.
(e) Sister-brand activities
- Reeluxs Bag Spa Specialist Malaysia operates reeluxsbagspa.my under common ownership but as a separate legal entity. We do not routinely share customer data between the two entities. Where you specifically request cross-border service (e.g., dropping a bag at our Singapore outlet for restoration coordinated with the Malaysia outlet), we share only the minimum data needed to fulfil that request, with your consent.
6. Cross-border data transfers
Some of the service providers listed in Section 5 are located outside Singapore. For example, Google and Meta may process data on servers located in the United States, Ireland, or elsewhere.
Where we transfer personal data outside Singapore, we ensure that the receiving party is bound by PDPA-equivalent protections, either through:
- Standard contractual clauses with the recipient
- The recipient’s own PDPA-compliant data-protection commitments
- Your explicit consent for the specific transfer
You may request more information about specific transfers by contacting our Data Protection Officer (Section 13).
7. Data retention
We retain personal data only as long as necessary for the purposes for which it was collected, and in accordance with legal requirements:
| Category | Retention period |
|---|---|
| Quote requests (unfulfilled) | 12 months from request, then deleted |
| Service records (completed) | 7 years from completion (Singapore tax and accounting requirements) |
| Customer communications | 3 years from last contact |
| Marketing consent records | Until consent is withdrawn, then 3 years for record-keeping |
| Technical / analytics data | 26 months (Google Analytics default) for aggregated session data; raw IP truncated |
| Website cookies | Per Section 10 |
After the retention period, personal data is securely deleted or anonymised so it can no longer be associated with you.
8. Your rights under the PDPA
You have the following rights with respect to your personal data:
- Access: Request a copy of the personal data we hold about you.
- Correction: Request correction of inaccurate or incomplete data.
- Withdrawal of consent: Withdraw consent for any processing based on consent (such as marketing). Withdrawal will not affect the lawfulness of processing before withdrawal. Note: withdrawing consent for service-essential processing may mean we can no longer provide our services.
- Complain: Lodge a complaint with us (Section 14) or with the Personal Data Protection Commission (PDPC) of Singapore.
To exercise any of these rights, contact our Data Protection Officer (Section 13). We respond to verified requests within 30 days as required by the PDPA. We may charge a reasonable fee for access requests where permitted by law.
9. Marketing communications
If you have consented to receive marketing communications from us, you may withdraw consent at any time by:
- Clicking the “unsubscribe” link in any marketing email we send you
- Replying “STOP” to any marketing WhatsApp message
- Contacting us at reeluxs.sg@gmail.com
We process unsubscribe requests within 10 business days.
10. Cookies and tracking technologies
Our website uses cookies and similar technologies. These fall into three categories:
(a) Strictly necessary cookies
Required for the website to function (e.g., session cookies, security tokens). These cannot be disabled.
(b) Analytics cookies
Help us understand how visitors use the site. We use:
_ga,_ga_*(Google Analytics) — visitor recognition, session tracking_gat_*(Google Analytics) — request-rate throttling
(c) Marketing cookies
Used to deliver and measure advertising. We use:
_fbp(Meta Pixel) — Facebook advertising attribution
You can control cookies through your browser settings. Disabling cookies may affect site functionality. We honour the Global Privacy Control (GPC) signal where applicable.
11. Data security
We protect your personal data using technical and organisational measures, including:
- HTTPS / TLS encryption for all website traffic
- Restricted access to customer-data systems on a need-to-know basis
- Periodic backups and disaster-recovery procedures
- Vulnerability monitoring via Wordfence
- Strong administrator authentication and access logging
No system is ever 100% secure. If we become aware of a data breach that is likely to result in significant harm to you, we will notify you and the PDPC in accordance with PDPA requirements.
12. Children’s data
Our services are not directed at children under 13 years of age, and we do not knowingly collect personal data from them. If you are a parent or guardian and believe we have collected data from your child, please contact us and we will delete it.
13. Data Protection Officer (DPO)
As required by the PDPA, we have appointed a Data Protection Officer:
The Data Protection Officer
Reeluxs Pte. Ltd.
11 Kee Seng Street, #01-06 Onze Tanjong Pagar, Singapore 089218
DPO email: reeluxs.sg@gmail.com (subject line: “Attention: DPO”)
All access, correction, withdrawal-of-consent, and complaint requests should be directed to the DPO.
14. Complaints and dispute resolution
If you believe we have not handled your personal data in accordance with this Policy or the PDPA, please first contact our Data Protection Officer (Section 13). We aim to resolve complaints within 30 days.
If you remain dissatisfied, you may escalate to:
Personal Data Protection Commission (PDPC) of Singapore
https://www.pdpc.gov.sg
Complaint form: https://www.pdpc.gov.sg/Complaints-and-Reviews
15. Updates to this Policy
We may update this Privacy Policy from time to time, for example to reflect new services, changes in technology, or changes in the law. The “Last updated” date at the top will reflect the most recent revision. Where changes are material, we will notify you through prominent notice on the website or by direct communication.
16. Governing law
This Privacy Policy is governed by the laws of the Republic of Singapore.