Privacy Policy

We collect the following personal data in order to process your orders, payments, and delivery.

• When you order or pay: name, email address, mobile number, delivery address, and order details. Payments are processed by PayPal; we do not store payment-method details such as card numbers on our servers.
• When you create an account: name, email address, and (if provided) mobile number, date of birth, and gender.
• Collected automatically: access logs, cookies, device and browser information, and service usage records (for fraud prevention, statistics, and analytics).

How we collect it: entered directly by you during account creation, ordering, or payment, or received from our payment processor (PayPal).

• Processing and fulfilling your orders, payments, and delivery, and verifying your identity
• Responding to enquiries and providing customer support, and handling refunds, exchanges, returns, and disputes
• Preventing fraudulent or unauthorised use of the service and maintaining its security
• Complying with applicable laws, regulations, and lawful requests by public authorities
• (With your separate consent) sending you marketing and promotional information such as new products and events

We collect, use, and disclose your personal data only for the purposes set out above, with your consent (which may be express or deemed under the PDPA) or as otherwise permitted or required by law.

You may withdraw your consent to the collection, use, or disclosure of your personal data at any time by contacting our Data Protection Officer (see section 11). Please note that withdrawing consent may mean we are unable to continue providing certain services to you, such as processing your orders. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

For marketing messages, you may opt out at any time using the unsubscribe link in the message or by contacting us.

We do not sell your personal data. We disclose personal data to third parties only as follows.

• To our delivery partner, to fulfil delivery: recipient name, delivery address, and contact number (carrier: 【carrier name】)
• To service providers who process personal data on our behalf (see section 5)
• Where required or permitted by law, or in response to a lawful request by a public or regulatory authority

To provide the service, we engage the following service providers, some of which store or process personal data outside Singapore. Where we transfer personal data overseas, we take steps to ensure a standard of protection comparable to the PDPA, including through contractual arrangements with these providers (in line with the Transfer Limitation Obligation under the PDPA).

If you do not consent to this overseas transfer, your use of the service (ordering and payment) may be restricted, as these providers are essential to operating the service.

We retain your personal data only for as long as it is necessary to fulfil the purposes for which it was collected, or as required to meet our legal, accounting, tax, or reporting obligations, or to resolve disputes. When personal data is no longer needed, we will cease to retain it, or remove the means by which it can be associated with you, as soon as it is reasonable to do so.

Under the PDPA, you may request access to the personal data we hold about you and information about how it has been used or disclosed, and you may request that we correct any inaccurate or incomplete personal data. Please submit your request to our Data Protection Officer (see section 11). We will respond as soon as reasonably possible. A reasonable fee may apply for an access request, and we will inform you of the fee in advance.

We take reasonable measures to keep your personal data accurate and to protect it, including:

• Encryption of data in transit (HTTPS/TLS) and access controls on our databases
• Authentication for administrative access and minimisation of access privileges
• Not storing payment-method details (such as card numbers); payments are handled by PayPal

While we take reasonable steps to protect your personal data, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

We may use cookies and analytics tools (for example, Google Analytics, Meta Pixel) to improve the service and for statistics and marketing. You may refuse or disable cookies through your browser settings, in which case some features may not function properly.

In the event of a data breach that is likely to result in significant harm to affected individuals, or that is of a significant scale, we will notify the Personal Data Protection Commission (PDPC) and affected individuals in accordance with the PDPA.

• Company name: Penicillin Co., Ltd. / Brand: Spicules
• Data Protection Officer: 【DPO name】
• Contact for privacy enquiries and to exercise your rights: hello@spicules.kr
• Registered address: 3F Room 106, 8 Seojeon-ro, Busanjin-gu, Busan, Republic of Korea
• Business registration number: 132-86-38087
• Singapore local representative / Responsible Person (cosmetics): 【SG representative name and address】

If you have any concerns or complaints about how we handle your personal data, please contact our Data Protection Officer first at hello@spicules.kr, and we will do our best to resolve the matter. If you are not satisfied with our response, you may lodge a complaint with the Personal Data Protection Commission (PDPC), Singapore, at pdpc.gov.sg.

We may update this policy from time to time. Any changes will be posted on this page, and where appropriate we will notify you. Please review this page periodically. Current effective date: 2026-07-05