Your privacy,
handled with care.

Introduction

Roses & More Pte Ltd ("we", "us", "our") is committed to protecting your personal data in accordance with Singapore's Personal Data Protection Act 2012 ("PDPA"). We collect only what we need, use it only for the purposes we describe, and never sell it to anyone.

This Privacy Policy explains how we collect, use, disclose, and protect your personal data when you use our services, visit our premises at 64B Peck Seah Street, or interact with us online — including through our website, WhatsApp, and booking platforms.

What personal data
we collect.

We collect only what is necessary to deliver our services safely and well. Depending on how you interact with us, this may include:

Identity & Contact

• Name, date of birth, and gender
• Phone number, email address, and mailing address
• Identification documents where required for legal compliance

Health & Treatment

• Skin concerns, medical history, and known allergies
• Treatment records, consultation notes, and progress documentation
• Before-and-after photographs (taken only with your explicit consent)
• Contraindication information required for safe treatment delivery

Transaction & Booking

• Booking history and appointment records via Fresha
• Payment transaction records via HitPay
• Credit balances and treatment package details

Technical

• IP address, browser type, and device information
• Website usage data and cookies (see Section 9)

Communications & Preferences

• Messages sent to us via WhatsApp, email, or contact forms
• Marketing preferences and communication opt-in status
• Feedback, reviews, and survey responses

How we use your
personal data.

We use your personal data only for legitimate purposes directly related to delivering our services to you and operating our business responsibly.

Treatment & Service Delivery

• Providing skin treatments, body wellness sessions, and consultations
• Composing treatment protocols based on your skin goals and contraindications
• Documenting treatment progress and maintaining continuity of care
• Ensuring your safety and managing any clinical contraindications
• Providing aftercare guidance and between-session support

Booking & Administration

• Processing appointments and managing our schedule
• Sending appointment reminders, confirmations, and follow-ups
• Managing cancellations, rescheduling, and waitlist requests
• Processing payments and issuing receipts
• Managing credit balances and treatment packages

Communication & Client Education

• Responding to enquiries and support requests
• Sending promotional offers and updates — only with your consent
• Sharing educational content, treatment guidance, and skin care information
• Conducting satisfaction surveys and collecting feedback

Legal & Compliance

• Complying with applicable laws, regulations, and legal obligations
• Maintaining accurate business and financial records
• Resolving disputes and enforcing our terms of service
• Protecting against fraud, misuse, and security threats

How long we keep
your data.

We retain your personal data only for as long as is necessary to fulfil the purposes for which it was collected — or as required by applicable law.

• Treatment and health records are retained for a minimum of 5 years from your last visit, as required for safe clinical continuity and legal compliance
• Financial and transaction records are retained for 7 years in accordance with Singapore accounting and tax requirements
• Marketing and communication data is retained until you withdraw consent or unsubscribe, whichever is sooner
• Website technical data is typically retained for 12–26 months depending on the analytics tool used

When data is no longer required, it is securely deleted or anonymised so it can no longer be associated with you.

When we share your
personal data.

We share your personal data only where necessary to operate our services — with trusted service providers bound by their own privacy obligations, and with legal authorities where required by law.

Service Providers

• Fresha — our booking and appointment management platform
• HitPay — our payment processing and transaction management platform
• Google Workspace — for secure storage of client records, forms, and communications
• Email and messaging providers — for appointment reminders, confirmations, and communications

Legal & Regulatory Authorities

• When required by law, regulation, or valid court order
• To protect the rights, property, or safety of Roses & More, our clients, or the public
• To cooperate with lawful regulatory investigations

How we protect
your data.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction.

• Secure, password-protected digital systems for all client records
• Encrypted communications for sensitive data transmission
• Physical access controls at our studio premises
• Staff trained in data protection, confidentiality, and PDPA obligations
• Access to client data restricted to authorised personnel only
• Regular review of our data handling practices and security measures

While we take every reasonable precaution, no digital system or transmission is entirely without risk. In the event of a data breach that poses a significant risk of harm to you, we will notify you and the Personal Data Protection Commission (PDPC) as required under the PDPA's mandatory breach notification obligations.

Third-party links
& external services.

Our website and communications may contain links to external platforms — including our booking partner Fresha, our payment partner HitPay, and our social media channels. Once you leave our website or interact with these external platforms, their own privacy policies govern the handling of your data.

We are not responsible for the privacy practices of third-party websites or services. We encourage you to review the privacy policies of any external service before providing your personal data.

Third-party analytics tools such as Google Analytics may be used to understand how visitors interact with our website. These tools collect anonymised usage data and operate under their own privacy terms.

Your rights
under the PDPA.

Under Singapore's Personal Data Protection Act 2012, you have the following rights in relation to the personal data we hold about you.

Right to Access

You may request a copy of the personal data we hold about you and information about how it has been or may be used.

Right to Correction

If you believe that any personal data we hold is inaccurate, incomplete, or misleading, you may request that we correct it.

Right to Withdraw Consent

Where our processing is based on your consent — such as marketing communications — you may withdraw that consent at any time. Withdrawal does not affect processing already carried out on the basis of your prior consent.

Right to Data Portability

You may request that we provide your personal data in a structured, commonly used, machine-readable format where technically feasible.

Right to Deletion

You may request deletion of your personal data. Please note that certain data may be subject to legal retention requirements that override this right — we will inform you if this applies.

Cookies & tracking
technologies.

Our website may use cookies and similar technologies to improve your experience, understand how visitors use our site, and deliver relevant content.

How we use cookies

• To improve website functionality and navigation
• To analyse traffic, usage patterns, and page performance
• To remember your preferences and personalise your experience
• To support security and prevent fraudulent activity

Your cookie choices

You can control or disable cookies through your browser settings at any time. Disabling certain cookies may affect the functionality of parts of our website. Where required by law, we will request your consent before placing non-essential cookies.

We may use tools such as Google Analytics to understand website performance. These services operate under their own privacy policies and may collect data in accordance with them.

Children &
parental consent.

Some of our treatments are appropriate for clients under 18, and we warmly welcome clients of all ages at Roses & More. However, clients under 18 must attend with a parent or guardian, and the parent or guardian must provide explicit consent before any treatment is carried out or personal data is collected.

If you believe we have inadvertently collected personal data from a minor without appropriate parental consent, please contact us immediately at hello@rosesnmore.com and we will take prompt steps to address this.

Updates to this
Privacy Policy.

We may update this Privacy Policy from time to time — to reflect changes in our practices, the services we offer, or applicable legal requirements. When we do, the revised policy will be published on our website with an updated "Last Updated" date.

We encourage you to review this policy periodically. For material changes, we will make reasonable efforts to notify active clients directly. Your continued use of our services following any update constitutes your acceptance of the revised policy.

Questions &
how to reach us.

If you have any questions, concerns, or complaints about this Privacy Policy or how we handle your personal data, please reach out to us directly. We take every query seriously and aim to respond promptly.

If you are not satisfied with our response, you have the right to lodge a complaint with Singapore's Personal Data Protection Commission (PDPC):