Privacy Policy
How Concept Grading collects, uses and protects personal data.
Concept Grading Pte. Ltd. ("Concept Grading", "we", "us" or "our") is committed to protecting your personal data in accordance with the Personal Data Protection Act 2012 of Singapore (the "PDPA"). This Privacy Policy explains how we collect, use, disclose and protect your personal data when you visit our website, visit our stores, or use our grading submission and related services.
1. Personal Data We Collect
We may collect:
- name, email address, telephone number, member code and account details;
- profile photographs and social-account information you provide;
- billing, delivery and Collection addresses and instructions;
- queue, appointment and store-visit information;
- purchases, invoices, payments, refunds and GEM transactions;
- Submitted Item descriptions, images, certification details, selected services, grading results, status and tracking information;
- enquiries, messages and feedback;
- information received through Google Sign-In;
- IP address, browser, operating-system, device, approximate region, session and website-use information; and
- cookies and identifiers used for sessions, preferences, security and measurement.
Payment credentials are processed through the applicable payment provider. Concept Grading records transaction details but does not store full payment-card numbers.
2. How We Use Personal Data
We may use personal data to:
- create, authenticate and manage accounts and sessions;
- operate our website, stores and queue;
- provide consultations and customer support;
- accept, process, track and return Submissions;
- manage purchases, payments, invoices, refunds and GEMs;
- send service, payment, submission, Collection and return communications;
- arrange delivery and logistics;
- provide address-search, regional and language features;
- protect security, prevent abuse and investigate suspected fraud;
- administer promotions, rewards and partner programmes;
- analyse and improve our services;
- send marketing communications where permitted by applicable law;
- maintain business, accounting and transaction records; and
- comply with legal obligations and establish or defend legal claims.
3. Consent & Choices
We collect, use and disclose personal data for the purposes notified in this Policy and as otherwise permitted by applicable law.
Where we rely on consent, you may withdraw it by contacting us. We will inform you of likely consequences and, subject to applicable exceptions, cease the affected processing after reasonable notice. Withdrawal may prevent us from providing services that require that data.
You may ask us to stop sending marketing communications using the contact details listed under Contact Support.
4. Website Data, Cookies & External Content
We use cookies and similar technologies to maintain sessions, remember preferences, support security, understand website use and measure website or marketing activity.
Our main website uses Google Tag Manager to manage website tags and Metricool to measure website use. Google Tag Manager is not loaded on the in-store kiosk.
Some pages load external resources or embedded content. Those providers may receive technical request information such as IP address, browser information, referring page and request time.
You may manage cookies through browser settings. Blocking functional cookies may affect website operation.
We do not alter collection practices solely because a browser sends a "Do Not Track" signal.
5. Disclosure & Service Providers
We disclose personal data only where reasonably required for the purposes described in this Policy. Recipients may include:
- the relevant Grading Company, where information is required to provide the selected grading service;
- payment providers, including Airwallex and HitPay;
- email and other communications providers used to send authorised messages;
- cloud hosting, infrastructure and operational-service providers that store or process application, session or operational data;
- authentication, security and abuse-prevention providers, including Google services used for Sign-In and reCAPTCHA;
- address-lookup and regional-information providers, including Google address-search services;
- analytics and website-measurement providers used on the pages you visit;
- couriers and logistics providers where delivery or return is requested;
- professional advisers, insurers or auditors where reasonably necessary; and
- authorities where disclosure is required or authorised by law.
Some recipients may act independently and apply their own privacy terms.
6. Overseas Transfers
Where personal data is transferred outside Singapore, we take reasonable steps to ensure comparable protection to that required by the PDPA.
7. Retention
We retain personal data only while needed for the notified purpose, legitimate business or operational needs, or legal, accounting, reporting and dispute-resolution obligations. When no longer required, we cease retaining it or remove the means by which it can be associated with an individual, where reasonably practicable.
8. Protection
We use reasonable administrative, technical and physical measures to protect personal data against unauthorised access, collection, use, disclosure, copying, modification, loss or disposal. No transmission or storage system is completely secure. You should safeguard your credentials and notify us of suspected compromise.
9. Access, Correction & Complaints
Subject to the PDPA and its exceptions, you may request:
- access to personal data under our possession or control and information about its use or disclosure;
- correction of inaccurate or incomplete data; or
- withdrawal of consent where processing relies on consent.
We may request information needed to verify your identity and understand the request.
10. Changes to This Policy
We may update this Policy to reflect changes in our services, practices or legal requirements. The "last updated" date at the top indicates when it was last revised.
11. Contact Us & Data Protection Officer
If you have any questions about this Privacy Policy, wish to exercise your rights, or would like to make a complaint, please contact our Data Protection Officer using the details listed under Contact Support, marked for the attention of the Data Protection Officer.
Privacy, access, correction and consent-withdrawal requests should be sent by email. WhatsApp and Telegram are general support channels and are not required for formal privacy requests.
Contact
Our contact details are listed under Contact Support. Where this Policy requires formal written notice, please use the email address listed there unless otherwise stated. WhatsApp and Telegram are general support channels and do not, by themselves, constitute formal contractual notice.