Privacy Policy - JIHECANG

1. Controller and contact details

For Singapore PDPA purposes, the organisation responsible for the public JIHECANG service is JIHECANG 集合仓, operated from Singapore. For privacy questions, access or correction requests, withdrawal of consent, complaints, or enquiries for our data-protection contact, email shop@digialc.sg or use our contact page. We will maintain a responsible data-protection contact in accordance with applicable PDPA requirements.

2. Personal data we may collect

Depending on how you use the service, we may process account and Telegram authorisation details, name or username, Telegram user identifier, email address, telephone number, delivery and billing details, order and payment status, product and redemption records, customer-support messages, language preference, device and security information, and information you choose to enter into community, check-in or drinking-record features.

Payment card details are handled by the relevant payment provider rather than stored by JIHECANG unless the provider explicitly returns limited transaction metadata. Please do not submit unnecessary special-category data, identity documents or health information through free-text fields.

3. Purposes and legal bases

We use personal data only for defined purposes and apply the legal basis that fits the activity. Where processing is based on consent, you may withdraw it at any time without affecting earlier lawful processing.

• To create and secure an account, authenticate a Telegram login, process orders, arrange payment and delivery, and provide customer support — performance of a contract or steps requested before a contract.
• To comply with age, tax, accounting, fraud-prevention, legal-request and other statutory duties — legal obligation.
• To protect the service, prevent abuse, troubleshoot failures, keep records of transactions and defend or exercise legal claims — legitimate interests, balanced against your rights and expectations.
• To send optional marketing or use optional analytics and similar technologies — consent where required. Optional analytics is disabled until you actively accept it.

4. Sharing and recipients

We may disclose the minimum information needed to payment providers, delivery and logistics partners, hosting and infrastructure providers, customer-support tools, Telegram authentication or communication services, professional advisers, and public authorities where required by law. Providers are required to process data only for authorised purposes and to apply appropriate safeguards. We do not sell personal data.

5. International transfers

Some service providers may process information outside Singapore or the European Economic Area. For transfers from Singapore, we will take steps required by the PDPA to ensure the recipient provides a standard of protection comparable to the PDPA, through appropriate contractual, organisational or other safeguards. Where GDPR applies, we use an adequacy decision or appropriate safeguards such as standard contractual clauses where required, and we can provide information about the relevant safeguard on request.

6. Retention

We keep account and transaction data for as long as needed to provide the service, meet legal and accounting obligations, resolve disputes, enforce agreements and protect the service. Under the PDPA retention limitation obligation, we stop retaining personal data, or remove the means by which it can be associated with you, when retention is no longer necessary for a legal or business purpose. Support messages and security records are retained only for as long as reasonably necessary.

7. Your GDPR rights

Subject to applicable law and exceptions, you may request access to your personal data, rectification of inaccurate data, erasure, restriction of processing, data portability, or object to processing based on legitimate interests. You may withdraw consent at any time where consent is the legal basis. You also have the right to complain to the supervisory authority in your habitual residence, place of work or the place of an alleged infringement.

Singapore PDPA notice

For individuals in Singapore, we comply with the PDPA obligations that apply to our activities, including accountability, notification of purposes, consent and withdrawal of consent, reasonable protection, retention limitation, access and correction, accuracy, and limits on transfers outside Singapore. We collect, use and disclose personal data only for purposes that a reasonable person would consider appropriate in the circumstances, or as otherwise permitted or required by law.

You may ask us to provide access to your personal data and information about how it has been used or disclosed, or to correct an error or omission. We may need to verify your identity and may apply lawful exceptions or administrative fees where permitted. We will respond within the period required by applicable law and explain any refusal or limitation.

If you withdraw consent, we will explain the likely consequences and stop or limit the relevant processing where we are not otherwise permitted or required to continue. Withdrawal does not affect processing already carried out lawfully before withdrawal.

8. Security, breach response and automated decisions

We use reasonable technical and organisational measures such as access controls, secure transport, limited staff access and service-provider controls. If we determine that a data breach is notifiable under the PDPA, we will notify the PDPC as soon as practicable and no later than three calendar days after making that determination, and notify affected individuals where required. No transmission or storage system can be guaranteed to be completely secure; please contact us promptly if you suspect an account or data incident. We do not make decisions producing legal or similarly significant effects based solely on automated processing or profiling.

Complaints and regulatory contact

Please contact us first at shop@digialc.sg so that we can investigate and address your concern. If you are not satisfied with our response, you may contact the Personal Data Protection Commission of Singapore (PDPC) through its official website at https://www.pdpc.gov.sg/ or seek other remedies available under applicable law.

9. Children and alcohol-related services

The online sale of alcohol is intended for adults aged 18 or above. We do not knowingly collect personal data from children for this service. If you believe a child has provided personal data, please contact us so we can investigate and delete it where appropriate.

10. Changes to this policy

We may update this policy when the service, vendors or legal requirements change. The latest version will be published on this page with an updated date. If a change materially affects your rights, we will provide additional notice where required.