Privacy Policy

TOFU G Singapore (‘TOFU G’, ‘we’, ‘us’, or ‘our’) is committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, and protect your information when you use the TOFU G mobile application (‘App’) available on iOS and Android.

This Policy complies with the Singapore Personal Data Protection Act 2012 (PDPA) as amended by the Personal Data Protection (Amendment) Act 2020, the Personal Data Protection (Notification of Data Breaches) Regulations 2021, the PDPC Advisory Guidelines on Children’s Personal Data (March 2024), and the requirements of the Apple App Store and Google Play Store.

1. Information We Collect

1.1 Information You Provide Directly

Account information: name, email address, mobile number, and password when you registerOrder information: items ordered, special requests, and payment detailsCommunications: messages or feedback you send to usPromotions: information you provide when participating in contests or loyalty programmes.

1.2 Information Collected Automatically

Device information: device type, operating system, and unique device identifiersUsage data: pages viewed, features used, time spent in the App, and crash reportsLocation data: precise or approximate location (only if you grant explicit in-App permission), used solely to show nearby TOFU G outlets and, where applicable, enable delivery features. You may withdraw location permission at any time via your device settings without affecting other App functionality.Transaction history: your past orders and loyalty points balance.

1.3 Information from Third Parties

Payment processors: transaction confirmation and fraud-prevention data. We do not store, log, or have access to full card numbers or CVV codes at any time.Social login providers: if you choose to log in via Google or Apple, we receive only your name and email address. We do not receive passwords or other account data.

2. How We Use Your Information

We process personal data only for the specific, limited purposes described below. We will not use your data for any new purpose not listed here without first obtaining your consent or updating this Policy.

Order Fulfilment

Process and confirm your orders
Send order status notifications and receipts

Account Management

Create and maintain your TOFU G account
Authenticate your identity and protect your account security, including fraud detection

App Functionality & Personalisation

Display relevant outlet locations and available menu items
Provide a personalised in-App experience based on your preferences and order history
Administer loyalty rewards and promotions

Marketing & Communications

Send you promotional offers, new flavour announcements, and App updates — only with your prior express consent
We check the Singapore Do-Not-Call (DNC) Registry before sending any marketing messages via SMS or telephone call, in compliance with Part IX of the PDPA
You may opt out of all marketing communications at any time by: (a) adjusting notification settings in the App, (b) clicking ‘Unsubscribe’ in any marketing email, or (c) emailing hello@tofug.sg

Analytics & Improvement

Understand how users interact with the App to improve performance and features
Monitor and diagnose technical issues
Analytics data is aggregated and anonymised wherever possible

Legal & Safety

Comply with applicable laws and regulations in Singapore
Detect, prevent, and respond to fraud or security incidents

3. Collection, Use and Disclosure of Personal Data

TOFU G collects, uses and discloses your personal data in accordance with the Singapore Personal Data Protection Act 2012 ("PDPA").

We collect, use and disclose your personal data for the following purposes:

create, manage and secure your TOFU G account;
provide our products and services, including processing and fulfilling your orders and payments;
administer and operate the TOFU G Loyalty Programme, including earning and redeeming points, issuing rewards and vouchers, managing membership benefits, and tracking eligible transactions;
personalise your experience within the App, including recommending products, rewards and promotions based on your membership activity, purchase history and preferences;
communicate with you regarding your orders, membership, rewards, customer service enquiries, service updates and other operational matters;
respond to your enquiries, feedback, requests and complaints;administer promotions, campaigns, contests, giveaways and special offers that you choose to participate in;
send you marketing communications, promotional offers and updates where you have provided your consent or where otherwise permitted under the PDPA;
improve our products, services, App functionality and customer experience through analytics, research, quality assurance and service improvement initiatives;
support our internal business operations, including administration, planning, reporting, product development, quality assurance, auditing and record-keeping;
detect, investigate and prevent fraud, unauthorised access, security incidents and other unlawful activities;administer agreements, memberships and services provided by TOFU G;
comply with applicable laws, regulations, court orders or lawful requests from regulatory or government authorities;
carry out any other purpose that has been notified to you at the time of collection, or for which you have provided your consent, or which is otherwise permitted or required under the PDPA.

TOFU G may disclose your personal data to third parties engaged by us to support our business operations or provide services on our behalf where such disclosure is necessary for the purposes described in this Privacy Policy. We require these third parties to protect your personal data in accordance with the PDPA and to use it only for the purposes for which it was disclosed.

We do not sell, rent or trade your personal data to third parties for their own marketing purposes. Your personal data will not be disclosed except as described in this Privacy Policy, with your consent where required, or where permitted or required by applicable law.

Where required under the PDPA, we will obtain your consent before collecting, using or disclosing your personal data. In certain circumstances, the PDPA permits us to collect, use or disclose personal data without consent, including where such collection, use or disclosure is required or authorised by law or falls within an exception under the PDPA.

You may withdraw your consent for the collection, use or disclosure of your personal data at any time by contacting our Data Protection Officer or through the App where such functionality is available. Please note that withdrawing your consent may affect our ability to provide certain products, services or features of the App.

We will notify you of the purposes for collecting, using or disclosing your personal data at or before the time of collection, unless otherwise permitted or required under the PDPA.

4. Children's Privacy

The TOFU G App is intended for a general audience. We recognise that children and young persons may use our App and are committed to protecting their personal data in accordance with the Personal Data Protection Act 2012 ("PDPA") and the Personal Data Protection Commission's ("PDPC") Advisory Guidelines on Children's Personal Data in the Digital Environment.

4.1 Collection of Children's Personal Data

Where we know or have reason to believe that a user is a child or young person who may not have sufficient understanding to provide meaningful consent, we may require the consent of a parent or legal guardian before collecting, using or disclosing that individual's personal data.

If we become aware that personal data has been collected without the appropriate consent where required, we will take reasonable steps to delete or anonymise the information unless we are required or permitted by law to retain it.

4.2 Additional Protection

We apply additional safeguards when handling the personal data of children and young persons. These safeguards may include:

limiting the collection of personal data to what is reasonably necessary for the operation of the App and the TOFU G Loyalty Programme;
Presenting privacy information in clear and age-appropriate language where applicable;
Limiting access to personal data to authorised personnel on a need-to-know basis; and
Implementing appropriate technical and organisational security measures to protect such personal data.

4.3 Marketing to Children

TOFU G does not knowingly send direct marketing communications to children where parental or guardian consent is required under applicable law. Where marketing communications are sent to young persons who are capable of providing meaningful consent, we will do so in accordance with the PDPA and provide appropriate options to withdraw consent at any time.

Parents or legal guardians who have questions regarding the collection or use of a child's personal data may contact our Data Protection Officer using the contact details set out in Section 14.

5. How We Share Your Information

We do not sell, rent, or trade your personal data to any third party.

5.1 Service Providers (Data Processors)We may share your data with trusted service providers who act as data processors on our behalf:

Payment processors (e.g. Stripe, PayNow partners): to securely handle transactions
Cloud hosting and storage providers: to store App data on our behalf
Analytics providers: to help us understand App usage on an anonymised basis
Delivery partners: where applicable, to fulfil your order

All third-party service providers are bound by written data processing agreements requiring them to: (a) protect your data using security standards at least equivalent to ours; (b) process data only for the purposes we specify; and (c) delete or return data upon termination of the agreement.

5.2 Legal Disclosures

We may disclose your data if required by law, court order, or direction from a Singapore government authority
In the event of a business restructuring, merger, acquisition, or sale, your data may be transferred to the successor entity, subject to equivalent privacy protections being maintained

6. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by law:

Account data: retained while your account is active and for up to 3 years after account closure
Transaction records: retained for 7 years to comply with Singapore financial and tax regulations
Marketing preferences and consent records: retained for the duration of our relationship plus 2 years
Security logs: retained for 1 year for fraud and security incident investigation

Once the applicable retention period expires, personal data is securely deleted or anonymised. You may also request earlier deletion of your data (see Section 9).

7. Protection of Personal Data

TOFU G is committed to protecting your personal data and has implemented reasonable administrative, physical and technical security arrangements to safeguard it against unauthorised access, collection, use, disclosure, copying, modification, disposal or similar risks, in accordance with the Personal Data Protection Act 2012 ("PDPA").

Our security measures may include, where appropriate:

encryption of personal data during transmission and storage;
secure storage and protection of systems containing personal data;
access controls to ensure that only authorised personnel with a legitimate business need can access personal data;
authentication and identity verification measures for authorised users;
monitoring and logging of system activities to detect and respond to security incidents;
regular security reviews, vulnerability assessments and maintenance of our systems;
employee training and awareness programmes on data protection and information security; and
secure disposal or anonymisation of personal data when it is no longer required.

While we take reasonable steps to protect your personal data, no method of electronic transmission or storage is completely secure. Accordingly, we cannot guarantee the absolute security of your personal data.

If we determine that a data breach involving your personal data is notifiable under the PDPA, we will take appropriate steps to contain and assess the breach and, where required, notify the Personal Data Protection Commission ("PDPC") and affected individuals as soon as practicable and in accordance with the requirements of the PDPA.

If you become aware of any suspected unauthorised access to your TOFU G account or believe your personal data has been compromised, please notify us immediately using the contact details provided in Section 14.

8. Cookies and Tracking Technologies

The App may use cookies, software development kits (SDKs), and similar technologies to:
Keep you logged in and remember your preferences
Analyse App usage and performance on an aggregated basis
Support push notification functionality

We do not use tracking technologies for cross-app behavioural advertising without your separate, explicit consent. You can manage notification and tracking permissions through your device’s system settings (iOS: Settings > Privacy & Security; Android: Settings > Apps) at any time.

9. Your Rights

Subject to the Personal Data Protection Act 2012 ("PDPA"), you have the following rights in relation to your personal data:

9.1 Access to Personal Data

You may request access to the personal data that TOFU G holds about you, as well as information about how your personal data has been used or disclosed within the period prescribed under the PDPA, subject to any applicable exceptions under the PDPA.

9.2 Correction of Personal Data

If you believe that any personal data we hold about you is inaccurate or incomplete, you may request that we correct or update the information. We may request reasonable supporting information to verify the accuracy of the requested correction.

9.3 Withdrawal of Consent

Where we rely on your consent to collect, use or disclose your personal data, you may withdraw your consent at any time by contacting our Data Protection Officer or through the App where such functionality is available.

Please note that withdrawing your consent may affect our ability to continue providing certain products, services or features of the App.

9.4 Deletion and Retention of Personal Data

You may request that we delete or anonymise your personal data where it is no longer required for the purposes for which it was collected, subject to our legal, regulatory and legitimate business obligations to retain certain records.

Where we are required or permitted by law to retain personal data, we may retain such information for the applicable retention period before securely deleting or anonymising it.

9.5 Exercising Your Rights

To exercise any of the rights described above, please contact our Data Protection Officer using the contact details provided in Section 14.

We may request sufficient information to verify your identity before processing your request.

We will respond to your request within a reasonable timeframe in accordance with the requirements of the PDPA.

If you have any concerns regarding how we have handled your personal data, you may contact our Data Protection Officer. If the matter cannot be resolved, you may lodge a complaint with the Personal Data Protection Commission (PDPC) in Singapore.

10. International Data Transfers

TOFU G is based in Singapore. Where any service provider processes your data outside Singapore, we ensure that appropriate contractual safeguards are in place — including the use of ASEAN Model Contractual Clauses or equivalent protections — to protect your personal data to a standard at least equivalent to the PDPA. We will inform you of any material changes to the countries in which your data is processed via an update to this Policy.

11. Third-Party Links and Services

The App may contain links to third-party websites or services. This Privacy Policy does not apply to those third parties. We are not responsible for the privacy practices of any third-party service. We encourage you to review the privacy policies of any external services before providing them with your personal data.

12. Data Protection Impact Assessment (DPIA)

TOFU G conducts a Data Protection Impact Assessment before introducing any new processing activity, technology, or third-party integration that may pose heightened privacy risks. This applies in particular to:

New data collection fields or categories
Introduction of AI, profiling, or automated decision-making features
New third-party integrations with access to personal data
Significant changes to the App’s functionality

Records of DPIAs are maintained by our Data Protection Officer and are available for PDPC review upon request.

13. Changes to This Privacy Policy

TOFU G may update this Privacy Policy from time to time to reflect changes in our business operations, products or services, technology, or applicable laws and regulatory requirements.

Where there are material changes to this Privacy Policy, we will notify you through the App, by email, or through other appropriate communication channels where reasonably practicable.

The revised Privacy Policy will take effect on the date stated at the top of this document. By continuing to use the App after the updated Privacy Policy takes effect, you acknowledge that you have read and understood the revised Privacy Policy.

Where required under the Personal Data Protection Act 2012 ("PDPA"), we will obtain your consent before collecting, using or disclosing your personal data for any new purpose that has not previously been notified to you.

14. Contact Us & Data Protection Officer

For all questions, concerns, data access requests, correction requests, deletion requests, or complaints relating to this Privacy Policy or your personal data, please contact our Data Protection Officer:

ChatGPT Image Jul 29, 2026, 07_18_40 PM.png