Last updated: 14th August 2026

This Privacy Policy explains how we collect, use, disclose and protect your personal data when you visit hellomellow.xyz (the "Site"), buy from us through any of our sales channels, or otherwise deal with us.

Please read it together with our Terms & Conditions and Shipping Policy.

 

1. Who we are

Mellow is a brand operated by December Holding Pte Ltd (UEN: 202006875G), a company incorporated in Singapore with its registered office at 23 New Industrial Road, #06-01, Singapore 536209.

In this policy, "we", "us" and "our" refer to that company. "You" refers to any individual whose personal data we hold.

We are committed to handling your personal data in accordance with the Personal Data Protection Act 2012 of Singapore (the "PDPA").

 

2. What personal data we collect

When you buy from us

• Name

• Email address

• Contact number

• Billing address and delivery address

• Order and purchase history

• Delivery instructions and any notes you provide

• Payment card type, the last four digits of the card, and the cardholder name

​​

We do not collect or store your full payment card number, expiry date or security code. Card payments on the Site are processed directly by Stripe, and your card details are transmitted from your device to Stripe without passing through our systems. See §5.

When you personalise a product Some of our products, such as personalised comforters, are made to order. To produce these we collect the name or initials you ask us to embroider or print, which may be the name of a child. You provide this information voluntarily and we use it only to make and deliver that item. See §8 on personal data about other people.

When you contact us Your name, email address, contact number (including WhatsApp number where you message us there), and the content of your enquiry, message or complaint.

When you subscribe to marketing Your email address, your name where you provide it, and your subscription preferences. Marketing subscription is optional and is never a condition of purchase.

When you join our loyalty or referral programmes Your name, email address, points balance and reward history. If you refer a friend, the name and email address you give us for that person. See §8.

When you buy from us in person At pop-up markets, events and stockist locations, we collect your name, contact details and purchase record in order to complete and support the sale. If you choose to join our mailing list at an event, we collect your email address for that purpose only.

When you enquire about wholesale or stocking our products Your name, business name, business contact details and the content of your enquiry.

When you visit the Site

• IP address, browser type, device type, operating system, time zone

• Pages viewed, products viewed, time spent, referring site and search terms

• Cookie and similar identifiers

When you tag us or submit content If you tag us on social media or submit content using our hashtags, we may see and, where you have given permission, re-share your username, images and the content you posted.

 

3. How we collect it

• Directly from you, when you place an order, create an account, subscribe, contact us, enter a

competition, or buy from us in person.

• Automatically, through cookies and similar technologies when you use the Site.

• From the marketplaces you buy through — Shopee, Lazada and TikTok Shop pass us the information we

need to fulfil your order.

• From third parties who provide it to us, such as someone referring you to us.

 

4. What we use it for, and on what basis

We use your personal data to:

​

​

​

​

​

​

​

​

​

​

​

​

​

​

​Where we rely on the Legitimate Interests Exception, we have assessed that the benefit of using your data for that purpose is not outweighed by any adverse effect on you. You may ask us about that assessment using the contact details in §14.

 

4A. Keeping your information accurate

We make reasonable effort to ensure the personal data we hold about you is accurate and complete, particularly where we use it to make a decision affecting you or pass it to someone else — for example, giving your delivery address to our courier. Please tell us if any of your details change, and see §12 on requesting a correction.

We will not use your personal data for any purpose that is materially different from those listed above without first notifying you and, where required, obtaining your consent.

 

5. Who we share it with

We share your personal data with service providers who help us run the business. They may only use it for the purposes we specify, and are required to protect it.

​

​

​

​

​

​

​

​

​

​

 

We may also disclose personal data where we are required or permitted to do so by law, to respond to a lawful request from an authority, to enforce our terms, or to protect our rights, property or safety, or those of our customers.

We do not sell your personal data.

 

6. Transfers outside Singapore

Some of our service providers store or process personal data outside Singapore. Where we transfer your personal data overseas, we take steps to ensure the recipient is bound to provide a standard of protection comparable to that required under the PDPA, ordinarily through the data processing terms in our contracts with them.

 

7. Marketing

We will only send you marketing emails if you have opted in. You can opt in at checkout, when you create an account, when you subscribe on the Site, or at one of our events.

Subscribing is never a condition of buying from us. If you do not opt in, we will still email you about the order you placed — order confirmations, dispatch notices and delivery updates are service messages, not marketing.

You can unsubscribe at any time using the link at the bottom of any marketing email, or by emailing us at the address in §12. We will action it promptly. Unsubscribing does not affect any order you have already placed.

Messages to your phone. We use WhatsApp to answer customer enquiries. If we ever send you marketing by SMS or WhatsApp, we will do so only where you have given us clear and unambiguous consent to receive marketing at that number, or where the message is otherwise permitted under Singapore's Do Not Call provisions. You can tell us to stop at any time and we will. Order updates, delivery notifications and replies to your own enquiries are service messages, not marketing.

Referrals. If you refer a friend to us, we use their details only to send the referral you asked us to send. We will not add them to our marketing list unless they choose to subscribe themselves.

 

8. Personal data about other people

If you give us personal data about someone else — for example, a delivery recipient, a gift recipient, the name of a child for a personalised item, or a friend you are referring — you confirm that you are permitted to give it to us and that they are aware it will be used for that purpose.

We use that data only for the purpose you gave it to us for.

 

9. Children

The Site is intended for adults. We do not knowingly collect personal data directly from children. Where we hold a child's name because a parent or guardian provided it for a personalised product, we use it only to make and deliver that item and we do not use it for marketing.

If you believe a child has given us personal data, please contact us and we will delete it.

 

10. Cookies and tracking

We use cookies, log files, tags and pixels to operate the Site, remember your cart and preferences, understand how the Site is used, and measure our advertising.

You can control cookies through your browser settings, though disabling them may affect how the Site works. You can also opt out of interest-based advertising directly:

• Google: https://adssettings.google.com

• Meta: https://www.facebook.com/settings/?tab=ads

• Google Analytics opt-out: https://tools.google.com/dlpage/gaoptout

• Digital Advertising Alliance: http://optout.aboutads.info

We do not change how we collect or use data in response to a "Do Not Track" browser signal.

 

11. How long we keep it

We keep your personal data only for as long as it is needed for the purposes set out in this policy, or for as long as we are required to keep it by law.

Information held within the systems we use to run our business — our website and order platform, the marketplaces we sell on, our payment processor, and our email and messaging accounts — is retained for as long as your relationship with us and our legal obligations require. Because many of our customers return to us over a period of years, we keep purchase history so that we can service your orders, honour warranties, handle returns and operate your loyalty account. We do not delete this information on a fixed schedule.

This includes any personalisation details you give us, such as a name for embroidery or a gift message, because they form part of the order record itself.

Information we hold outside those systems — copies of order data downloaded for analysis, working files and printed documents — is deleted on a defined schedule:

​

​

​

​

​

​

 

 

 

Marketing. We keep your email address, your name if you gave it, and your subscription history for as long as you remain subscribed. If you unsubscribe, we stop sending you marketing immediately and retain only enough to make sure we do not contact you again by mistake.

Website analytics data is retained according to the settings of the analytics provider concerned.

If you would like us to stop using your personal data, you may withdraw your consent at any time — see §12. We will action that request, and we will tell you plainly what we are required to retain and why.

 

12. Your rights under the PDPA

You may, at any time:

Request access — ask what personal data we hold about you, and how it has been used or disclosed in the twelve months before your request.

Request correction — ask us to correct personal data that is inaccurate or incomplete.

Withdraw consent — withdraw your consent to our collection, use or disclosure of your personal data for any purpose.

To make a request, email our Data Protection Officer at dpo.hello.mellow.sg@gmail.com

We may need to verify your identity before we can respond. We will acknowledge your request within five working days and respond within thirty days. If we need longer, we will tell you and give you an expected date.

If you withdraw consent, we will stop using your personal data for that purpose. Please note this may affect our ability to provide certain things to you — for example, we may not be able to process an outstanding order, handle a return or warranty claim, or keep you in our loyalty programme. We may also need to keep some data to meet our legal obligations, and we will tell you if that is the case.

 

13. How we protect your personal data

We maintain reasonable security arrangements to protect personal data in our possession or under our control against unauthorised access, collection, use, disclosure, copying, modification, disposal or loss. These include:

• Multi-factor authentication on the systems that hold customer data

• Restricting access to those who need it to do their work

• Encryption of the devices used to handle customer data

• Not storing full payment card details at any point

• Limiting how long we keep personal data, and securely deleting it afterwards

• Secure destruction of physical documents containing personal data

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. We have a documented procedure for assessing and responding to data breaches, and we will notify the Personal Data Protection Commission and affected individuals where the PDPA requires it.

 

14. Contact and complaints

Data Protection Officer Email: dpo.hello.mellow.sg@gmail.com

For general enquiries, contact us at hello.mellow.sg@gmail.com or on WhatsApp at 8903 9901 (Mon–Fri, 9am–5pm).

If you have a concern about how we have handled your personal data, please contact our Data Protection Officer first — we would like the chance to put it right. If you are not satisfied with our response, you may refer the matter to the Personal Data Protection Commission of Singapore at www.pdpc.gov.sg.

You may also ask us for information about our data protection policies and practices, and about how we handle complaints. We will provide it.

 

15. Changes to this policy

We may update this policy from time to time to reflect changes in our practices or for legal, regulatory or operational reasons. The current version will always be posted on this page, with the effective date shown at the top. Where a change materially affects how we use your personal data, we will take reasonable steps to notify you.