Privacy Policy

1. Introduction

This Privacy Policy explains how VinCask Pte Ltd ("VinCask," "we," "us," or "our"), a company incorporated in Singapore, collects, uses, discloses, and protects personal data in accordance with the Personal Data Protection Act 2012 ("PDPA").

By using our website and related services (the "Platform"), you agree to this Privacy Policy. Our Terms and Conditions govern use of the Platform.

2. Personal data we collect

Depending on how you use the Platform, we may collect:

3. How we use personal data

We use personal data to:

• Provide, operate, and improve the Platform
• Send newsletters and updates you subscribe to
• Respond to contact and support requests
• Process NFT purchases, ownership checks, and whisky redemption
• Verify age eligibility and comply with alcohol-related laws
• Process payments and prevent fraud, abuse, or security incidents
• Meet legal, regulatory, tax, audit, and record-keeping obligations
• Analyse aggregated website usage to improve content

4. Consent

We collect, use, and disclose personal data with your consent, or as otherwise permitted or required under the PDPA or other applicable law. Consent may be given by submitting a form, subscribing, completing redemption steps, or continuing to use the Platform after notice of this Privacy Policy.

You may withdraw consent at any time by contacting us. Withdrawal does not affect processing already carried out. If the data is needed to provide a service (for example, redemption), withdrawing consent may mean we cannot complete that service.

5. Disclosure to third parties

We may disclose personal data to service providers who process it on our behalf, including:

• Hosting and database: Supabase (personal data stored in Singapore)
• Website hosting and analytics: Vercel
• Email delivery: Resend
• Payment processing: Crossmint (for eligible card and similar payments)
• Couriers, logistics partners, or licensed storage partners as needed for redemption, delivery, or custody

We may also disclose personal data where required by law, to protect our rights or users, or in connection with a merger, sale, or reorganisation.

Third parties process personal data under their own terms and privacy policies where applicable. We do not sell your personal data.

6. Cookies and similar technologies

We use an ageVerified cookie to remember that you confirmed you are 18 or older. This cookie typically lasts about 30 days.

We may also use analytics cookies or similar technologies to understand how the Platform is used. You can control cookies through your browser settings. Blocking some cookies may affect how the Platform works.

7. Storage, transfers, and security

Primary application data is stored in our Supabase database in Singapore. Some service providers (such as Vercel, Resend, or Crossmint) may process personal data outside Singapore.

Where personal data is transferred outside Singapore, we take steps required under the PDPA so that the data receives a standard of protection comparable to the PDPA, such as contractual safeguards with the recipient where appropriate.

We use reasonable security arrangements, including:

• Encrypted data transmission
• Access controls and authentication
• Secure hosting and database infrastructure
• Periodic security reviews

8. Retention

We retain personal data only as long as needed for the purposes notified in this Privacy Policy, or as required for legal or business purposes. Typical periods:

• Newsletter data: until you unsubscribe, then for a short period needed to process the request
• Contact enquiries: for as long as needed to respond and for a reasonable follow-up period
• Redemption and related records: generally up to 7 years after redemption, or longer if required by law
• Transaction and compliance records: for as long as needed for legal, tax, audit, or dispute purposes
• Age-verification cookie: about 30 days

When retention is no longer necessary, we delete or anonymise the personal data where reasonably practicable.

9. Your rights

Under the PDPA, you may:

• Request access to your personal data that we hold
• Request correction of your personal data
• Withdraw consent for collection, use, or disclosure

To make a request, email privacy@vincask.com. We aim to respond within 30 days. If we need more time, we will tell you.

Some requests may be limited where the PDPA or other law allows or requires us to retain or refuse disclosure of certain information.

10. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The "Last Updated" date shows when changes take effect. Continued use of the Platform after an update means you accept the revised Privacy Policy.