Privacy Policy

1. Introduction

This Website Privacy Policy ("Policy") explains how NearU Pte. Ltd. (UEN: 202550492M) ("NearU", "we", "us" or "our") collects, uses, discloses, stores and protects personal data when individuals visit www.nearu.community, submit an enquiry or merchant-interest form, begin merchant registration, upload supporting documents, or access the Merchant Portal through www.nearu.community/merchant (collectively, the "Website Services").

This Policy is intended to comply with the Personal Data Protection Act 2012 of Singapore ("PDPA") and should be read together with NearU's Website Terms of Use, Cookie Policy, Merchant & Seller Agreement and any specific privacy notice presented at the point of collection.

Where a separate agreement or notice applies to a particular service, that document will supplement this Policy and will prevail to the extent of any inconsistency.

2. Scope and Categories of Individuals

This Policy applies to personal data relating to:

• Website visitors and individuals who contact NearU;
• Prospective merchants and their owners, directors, employees and authorised representatives;
• Registered merchants who access the Merchant Portal;
• Individuals whose information is provided for merchant verification, account administration, support or compliance purposes; and
• Other individuals who interact with NearU through the Website Services.

3. Personal Data We Collect

3.1 Information You Provide Directly

Depending on how you interact with NearU, we may collect:

• Name, email address, telephone number, job title and communication preferences;
• Business legal name, trading name, UEN, registered address, store address, business category and contact details;
• Information contained in merchant enquiries, registration forms, support requests, feedback and correspondence;
• Owner, director, beneficial owner or authorised representative information reasonably required for identity, authority, fraud-prevention or compliance checks;
• Copies of identification documents where reasonably required for verification;
• ACRA Business Profiles and other corporate records;
• Corporate bank account details and a recent bank statement or equivalent bank-issued document showing the account holder name, address and account number. Merchants should redact transaction details, balances and unrelated financial information unless specifically required;
• Applicable licences, permits and certifications, including food, liquor, halal, healthcare, pharmacy or other category-specific approvals;
• Merchant Portal login, authentication and account-administration information;
• Subscription plan, billing, payment-status and invoice information. Payment-card information may be processed by an authorised payment provider and is not intended to be stored in full by NearU; and
• Any documents, images or other information voluntarily uploaded during merchant registration or onboarding.

3.2 Information Collected Automatically

When you use the Website Services, NearU and its service providers may collect:

• IP address, browser type, device type, operating system and language settings;
• Pages viewed, links selected, referring pages, time and date of access, session duration and interaction logs;
• Cookie identifiers, local-storage information and consent preferences;
• Login records, authentication events, audit trails and security logs;
• Approximate location inferred from IP address where used for security, localisation or service availability; and
• Diagnostic, performance, error and fraud-detection information.

3.3 Information From Other Sources

NearU may receive information from ACRA and other public registers, payment and verification providers, professional advisers, technology vendors, merchants, regulators or other lawful sources for verification, fraud prevention, compliance and service administration.

4. Purposes for Collection, Use and Disclosure

NearU may collect, use or disclose personal data for purposes including:

• Responding to enquiries and merchant-interest submissions;
• Arranging demonstrations and following up on requests relating to NearU services;
• Processing merchant registrations, conducting verification and assessing eligibility;
• Creating, securing and administering Merchant Portal accounts;
• Verifying business identity, ownership, authority, bank details, licences and regulatory eligibility;
• Managing subscription plans, invoices, payments, promotions and account status;
• Providing support, resolving complaints and communicating service or account information;
• Operating, maintaining, securing, testing and improving the Website Services;
• Detecting and preventing fraud, misuse, unauthorised access, security incidents and other unlawful activity;
• Conducting analytics, service planning and business improvement;
• Maintaining records, enforcing agreements and managing disputes or legal claims;
• Complying with legal, regulatory, tax, accounting, audit and law-enforcement requirements; and
• Sending communications reasonably connected with an enquiry, merchant-interest submission or onboarding request. NearU will not use such a submission as unlimited consent for unrelated promotional marketing.

5. Consent and Other Permitted Processing

NearU processes personal data with consent or deemed consent where applicable, and may also process personal data without consent where permitted or required by the PDPA or other applicable law. This may include processing necessary to respond to a request, enter into or perform an agreement, protect legitimate interests, prevent fraud, improve services, comply with legal obligations or establish, exercise or defend legal claims.

Where NearU relies on a statutory exception, it will take the steps required by applicable law, including conducting and documenting any assessment required for reliance on the legitimate-interests exception.

6. Disclosure of Personal Data

NearU does not sell personal data. We may disclose personal data, only where reasonably necessary, to:

• Cloud-hosting, software, website, CRM, customer-support, analytics, email and notification service providers;
• Payment, billing, identity-verification, fraud-prevention and merchant-onboarding providers;
• Technology developers, administrators, contractors and support personnel who require access to perform services for NearU;
• Professional advisers, auditors, insurers and financial institutions;
• Government agencies, regulators, law-enforcement bodies, courts or other persons where required or permitted by law;
• A purchaser, investor, financing party or successor in connection with a proposed or completed corporate transaction, subject to appropriate confidentiality and data-protection safeguards; and
• Other parties with the individual's consent or as otherwise permitted by law.

7. Service Providers and Data Intermediaries

NearU uses service providers and data intermediaries to operate the Website Services. Where such parties process personal data on NearU's behalf, NearU will use reasonable contractual and organisational measures to require them to protect the personal data, use it only for authorised purposes and notify NearU of relevant security incidents.

8. Cross-Border Transfers

Some service providers, systems, development teams or support personnel may be located outside Singapore or may access personal data from another country. Where NearU transfers personal data outside Singapore, it will take reasonable steps to ensure that the recipient is bound by legally enforceable obligations providing a standard of protection comparable to the PDPA, or that another permitted transfer mechanism applies.

9. Retention

NearU retains personal data only for as long as it remains reasonably necessary for the business or legal purpose for which it was collected, or as required or permitted by law. Retention periods may differ depending on the nature of the information and the relationship with NearU.

As a general guide:

• General enquiries and related correspondence may be retained for up to 24 months after the enquiry is closed;
• Unsuccessful or incomplete merchant applications may be retained for up to 24 months, unless a longer period is reasonably required for fraud prevention, dispute management or legal compliance;
• Merchant registration, verification, subscription, billing and contractual records may be retained during the merchant relationship and for up to 7 years thereafter, or for another period required by law;
• Consent, withdrawal, complaint and suppression records may be retained for as long as necessary to demonstrate compliance; and
• Security, audit and system logs may be retained according to operational risk and security requirements.

When personal data is no longer required, NearU will take reasonable steps to delete, anonymise or otherwise dispose of it securely, subject to technical backup cycles and legal holds.

10. Security

NearU maintains reasonable administrative, technical and organisational safeguards appropriate to the nature of the personal data and the risks involved. These may include encryption in transit, access controls, authentication controls, logging, backups, staff access restrictions, vendor safeguards and incident-response procedures.

No method of transmission or storage is completely secure. NearU does not guarantee absolute security, but will take reasonable steps to protect personal data in its possession or under its control. Individuals should protect their passwords and promptly report suspected unauthorised access to support@nearu.community.

11. Data Breach Management

NearU will assess suspected personal-data breaches, take reasonable containment and remediation steps, and notify the Personal Data Protection Commission and affected individuals where required by the PDPA, including where a breach is assessed to result in, or be likely to result in, significant harm or is of significant scale.

12. Access, Correction and Withdrawal of Consent

12.1 Access and Correction

Subject to the PDPA and applicable exceptions, an individual may request access to personal data held by NearU and information about how it has been used or disclosed, or request correction of inaccurate or incomplete personal data. NearU may verify identity and may charge a reasonable fee where permitted by law. If additional time is required, NearU will provide the response or notice required under applicable law.

12.2 Withdrawal of Consent

An individual may withdraw consent by giving reasonable notice to privacy@nearu.community. NearU will explain the likely consequences where appropriate. Withdrawal may affect NearU's ability to provide services, process an application or maintain an account. Withdrawal does not affect processing already carried out and does not prevent NearU from retaining or processing personal data where permitted or required by law.

13. Communications and Marketing

Where an individual submits an enquiry or merchant-interest form, NearU may contact that individual to respond, arrange a demonstration, provide requested information, or follow up on merchant registration and onboarding. NearU does not currently operate a general newsletter subscription through the Website.

Where NearU later sends promotional communications, it will comply with applicable consent, unsubscribe, Spam Control Act and Do Not Call requirements. Service, security, billing and account communications are not promotional messages and may be sent where reasonably necessary to administer a request or relationship.

14. Cookies and Similar Technologies

NearU uses cookies and similar technologies for essential website functions, security, preferences and, where enabled, analytics. Non-essential cookies will be managed through the cookie-consent mechanism where required. Further information is available in the Cookie Policy (NEARU-SG-WEB-CP-001), including how users may manage their preferences.

15. Third-Party Websites and Services

The Website Services may contain links to or integrations with third-party websites and services. Those parties process personal data under their own terms and privacy notices. NearU is not responsible for the privacy practices of independent third parties, although NearU remains responsible for personal data in its possession or under its control as required by law.

16. Business Contact Information

Some information supplied in a business capacity may constitute business contact information under the PDPA. However, personal mobile numbers, identity documents, bank information and other information collected for verification or account administration may remain personal data protected under the PDPA. NearU will handle such information according to its nature and the applicable law.

17. Changes to this Policy

NearU may update this Policy to reflect changes in law, technology, operations or services. The updated version will be posted on the Website with a revised effective date. Where changes are material, NearU will take reasonable steps to provide additional notice. Changes do not reduce rights that cannot lawfully be limited.

18. Data Protection Officer and Contact