Redbrick Homes Privacy Policy

1. Personal data we collect

1.1 We collect personal data that is necessary to provide the Services. The categories of personal data we may collect include:

• Identity data. Full name, preferred name, date of birth, gender, nationality, and contact identifiers.
• Contact data. Residential address, billing address, email address, and mobile or telephone number.
• Account data. Username, password (stored in hashed form), Member ID, tier, Bricks balance, and other profile information you choose to provide.
• Transaction data. Purchase details, receipt images and data (including line items, Partner identity, transaction date, and amount), redemption history, referral activity, and associated timestamps.
• Property and preferences data. Property details you choose to share, renovation stage, budget indications, style preferences, and similar signals you provide for matching with Partners.
• Usage and device data. IP address, device type, operating system, browser type, referring URL, pages visited, time spent, clickstream data, and diagnostic information.
• Communications data. Messages, feedback, survey responses, complaints, and correspondence you send to us or through the Services.

1.2 Incidental identifiers in submitted images. We do not request, require, or rely on NRIC, FIN, or other government-issued identification numbers for the provision of the Services. Where you submit receipt images or other documents (including under the Bricks Programme), those images may incidentally contain such identifiers. By submitting them, you acknowledge and consent to:

• our retention, storage, processing, and use of the submitted image for any of the Purposes set out in clause 3, including (without limitation) enabling you to retrieve your records, validating Qualifying Transactions, fraud prevention and investigation, audit, dispute resolution, enforcement of our terms, and compliance with legal obligations;
• the fact that we do not, in the ordinary course of operating the Services, extract, index, or use any government-issued identifiers contained in those images for identification or verification purposes, but we reserve the right to access and use any such identifiers where reasonably necessary for fraud prevention, investigation of suspected breach of our terms, compliance with law, or response to a lawful request from a public authority; and
• your sole responsibility to redact or omit any identifiers you do not wish to submit, and our right (but not obligation) to redact, mask, or delete any such identifiers at our discretion.

1.3 Our Services are not directed at or intended for individuals under the age of eighteen (18), consistent with the eligibility requirements set out in the General Terms. We do not knowingly collect or accept personal data from individuals under 18. If you become aware that an individual under 18 has provided personal data to us, please notify us at media@redbrick.sg. We may, at our sole discretion, take such steps as we consider appropriate, including suspending or terminating the relevant Account and deleting the personal data.

1.4 We do not knowingly collect biometric data, health data, or special categories of data. If you submit any such data (for example, in an image or free-text field), you do so voluntarily and at your own risk, and we may delete it without notice.

2. How we collect personal data

2.1 We collect personal data:

• directly from you, when you create an account, submit receipts, redeem Rewards, contact us, respond to surveys, or otherwise interact with the Services;
• automatically, through cookies and similar technologies, when you use the Services;
• from Partners and other third parties with whom you have a relationship, for example when a Partner confirms a transaction or submits receipt information on your behalf;
• from third-party identity verification, fraud prevention, analytics, and service providers engaged by us; and
• from publicly available sources, where permitted by applicable law.

2.2 Where you provide us with personal data about another individual (for example, a referral, co-applicant, or household member), you represent and warrant that you have obtained the consent of that individual for their personal data to be collected, used, and disclosed by us in accordance with this Privacy Policy.

3. Purposes for which we use personal data

3.1 We collect, use, and disclose personal data for the following purposes (together, the "Purposes"):

• providing, operating, and maintaining the Services;
• creating and administering your Account, including authentication, password management, and account recovery;
• processing receipts and transactions, crediting and debiting Bricks, administering tiers, and fulfilling redemptions;
• matching you with Partners and surfacing Partner content, offers, and recommendations;
• facilitating communications between you and Partners and administering your engagements with Partners;
• processing payments, refunds, chargebacks, and other transaction-related matters;
• preventing, detecting, and investigating fraud, abuse, manipulation, and other breaches of our terms or of applicable law, including clawback and recovery;
• providing customer support and responding to queries, feedback, and complaints;
• sending service communications relating to the Services (including transactional notifications, expiry reminders, tier changes, policy updates, and security notices);
• conducting analytics, research, statistical analysis, product development, and improvement of the Services;
• personalising your experience of the Services, including content, offers, and recommendations;
• sending marketing and promotional communications, where you have given the requisite consent;
• complying with applicable laws, regulations, court orders, and lawful requests from public authorities;
• enforcing our terms, establishing, exercising, or defending legal claims, and protecting our rights, property, and interests (and those of our affiliates, Partners, employees, and users); and
• any other purpose reasonably related to or connected with any of the foregoing, or for which you have given separate consent.

3.2 Automated and algorithmic processing. Some of the Purposes described in clause 3.1 (including matching you with Partners, personalising your experience, fraud prevention, and analytics) involve automated and algorithmic processing of your personal data, drawing on information you provide, signals derived from your interaction with the Services, and aggregate patterns. Such processing is preference-based and operational in nature, does not produce legal or similarly significant effects on you, and is subject to the limitations and disclaimers in the General Terms.

4. Consent

4.1 We rely on the following bases for the collection, use, and disclosure of your personal data under the PDPA:

• Express consent. Consent you provide at signup (by ticking an unchecked box), at the point of collection for a specific purpose, or by responding affirmatively to a prompt in the Services.
• Deemed consent by contractual necessity. Where the collection, use, or disclosure of your personal data is reasonably necessary for the conclusion or performance of a contract between you and RBDM (including the Terms of Use and the Bricks Programme T&Cs).
• Deemed consent by notification. Where permitted under the PDPA, after we have given you reasonable notice of the purpose and a reasonable period to opt out, and you do not opt out.
• Legitimate interests. Where the collection, use, or disclosure is in our legitimate interests or those of another person, and the benefit outweighs any adverse effect on you, in accordance with the PDPA.
• Other exceptions in the PDPA. For example, compliance with law, response to emergencies, prevention of fraud, and other permitted bases set out in the First and Second Schedules to the PDPA.

4.2 You may withdraw your consent to the collection, use, or disclosure of your personal data for any Purpose at any time by giving us written notice at media@redbrick.sg, or through such other channels (including in-Dashboard toggles or self-service tools) as we make available from time to time. Your notice must provide sufficient information to enable us to identify you, locate the relevant personal data, and determine the scope of your withdrawal. You acknowledge that, by withdrawing your consent, the following consequences may follow (without limitation): the suspension, restriction, or termination of your Account and your access to the Services, the cancellation of any pending Rewards or redemptions, the forfeiture of any Bricks credited to your Account, the loss of any Tier status, and the inability of RBDM to continue providing the Services to you. We will use reasonable efforts to give effect to your withdrawal within ten (10) business days of our receipt of a complete and verified notice, subject to clause 4.3. You acknowledge that you are not entitled to any compensation, refund, or other remedy in respect of the consequences of withdrawing your consent. Without limiting the foregoing, we may, at our sole discretion: (a) require you to verify your identity before we process your withdrawal; (b) seek clarification from you where your notice is ambiguous or incomplete; (c) decline to process any withdrawal request that is frivolous, vexatious, or substantially repeats a prior request; and (d) treat any opt-out toggle, self-service control, or similar mechanism we make available through the Services as a valid means of withdrawing the relevant consent.

4.3 Withdrawal of consent does not affect the lawfulness of any collection, use, or disclosure that took place before withdrawal, and does not prevent us from continuing to process personal data to the extent required or permitted by law.

5. Disclosure of personal data

5.1 We may disclose your personal data to the following categories of recipients, for the Purposes:

• The Redbrick Group, for operational, administrative, and analytics purposes;
• Partners, to the extent necessary for you to be matched with them, for them to fulfil Rewards or services, to confirm transactions, and to administer the Bricks Programme;
• Service providers and processors, engaged by us to provide hosting, storage, analytics, customer support, receipt and data extraction, communications, marketing, payments, fraud prevention, identity verification, insurance, legal, audit, and similar services;
• Payment and financial services providers, for the processing of transactions, refunds, and chargebacks;
• Professional advisers, including lawyers, auditors, and accountants, under duties of confidentiality;
• Public authorities, regulators, and courts, where required or permitted by applicable law;
• Acquirers, investors, and successors, in connection with a proposed or actual sale, merger, reorganisation, or financing, subject to appropriate confidentiality protections; and
• other third parties where you have given consent or direction.

5.2 Where we engage service providers and processors, we require them to process personal data only in accordance with our instructions and to implement appropriate security measures.

6. Cross-border transfer

6.1 Your personal data may be transferred to, stored in, and processed in jurisdictions outside Singapore, including where our service providers, Partners, affiliates, or cloud infrastructure are located. These jurisdictions may include, without limitation, jurisdictions in the Asia-Pacific region, the European Economic Area, the United Kingdom, and the United States.

6.2 Where we transfer personal data outside Singapore, we will take reasonable steps to ensure that the recipient is bound by legally enforceable obligations to provide a standard of protection that is comparable to the protection under the PDPA, in accordance with the Personal Data Protection Regulations 2021. The mechanisms we may rely on include contractual clauses, intra-group arrangements, binding corporate rules, certifications recognised under the PDPA (such as APEC Cross-Border Privacy Rules or Privacy Recognition for Processors), and any other mechanism permitted by applicable law from time to time.

7. Cookies and similar technologies

7.1 We use cookies and similar technologies (such as pixels, tags, and local storage) on our websites and apps to provide, secure, and improve the Services. We categorise these as follows:

• Strictly necessary. Required for the Services to function (including authentication, session management, security, and load balancing). These cannot be disabled.
• Analytics. Help us understand how users interact with the Services so we can improve them.
• Preferences. Remember your settings and choices to provide a more personalised experience.
• Marketing. Help us measure the performance of our marketing and deliver relevant advertising, on our Services and on third-party platforms.

7.2 You may accept or decline non-essential cookie categories through our cookie consent banner, which is presented to you when you first use the Services and is accessible at any time through the cookie settings link on our websites. You may also control cookies through your browser settings. Disabling strictly necessary cookies may prevent the Services from functioning correctly.

8. Direct marketing

8.1 We may send you marketing and promotional communications (by email, SMS, voice call, in-app notification, push notification, and similar channels) about our Services, Partner offers, events, and promotions, in accordance with your consent (express or deemed) and applicable law, including the PDPA (including its Do Not Call provisions where applicable), the Spam Control Act 2007 of Singapore, and any other applicable law. We will not send you such communications by channels for which you have not given the requisite consent or where applicable law otherwise prohibits us from doing so.

8.2 You may withdraw your consent to marketing communications at any time, free of charge, by using the unsubscribe link in the relevant communication, by updating your preferences in your Account, by adjusting any opt-out toggle we make available, or by contacting us at media@redbrick.sg. We will use reasonable efforts to give effect to your withdrawal within thirty (30) days of receipt of a complete and verified request, in accordance with the Spam Control Act 2007 of Singapore where applicable, subject to clause 4.3. You acknowledge that messages already in transit at the time we process your withdrawal may still be delivered.

8.3 Even if you have unsubscribed from marketing, we may continue to send you non-marketing service communications (such as transactional notifications, security notices, and policy updates) relating to the Services.

9. Retention

9.1 We retain personal data for as long as reasonably necessary to fulfil the Purposes for which it was collected, to comply with our legal, regulatory, tax, accounting, and reporting obligations, to resolve disputes, and to enforce our agreements.

9.2 By way of guidance, and subject to our discretion and legal obligations:

• Account and profile data is retained while your Account is active and for up to seven (7) years after closure.
• Transaction, receipt, Bricks, and redemption records are retained for up to seven (7) years after the relevant transaction, consistent with tax and accounting requirements.
• Communications and customer support records are retained for up to five (5) years from the date of the last communication.
• Marketing preference records are retained while consent is in force and for up to five (5) years after withdrawal, for suppression and compliance purposes.
• Cookies and usage data are retained for the periods stated in the cookie banner or the underlying analytics service, as applicable.

9.3 Where personal data is no longer required for any legal or business purpose, we will cease to retain it, or remove the means by which it can be associated with you, in accordance with the PDPA.

10. Security

10.1 We implement reasonable technical, organisational, and physical security measures to protect personal data against unauthorised access, use, disclosure, alteration, loss, and destruction, including access controls, encryption in transit, logging, monitoring, and personnel training.

10.2 No method of transmission or storage is fully secure. You are responsible for maintaining the confidentiality of your Account credentials and for all activity under your Account. You should notify us immediately at media@redbrick.sg if you believe your Account has been compromised.

10.3 Data breach notification. Where a data breach involving personal data in our possession or under our control is a notifiable data breach within the meaning of the PDPA and the Personal Data Protection (Notification of Data Breaches) Regulations 2021, we will, within the prescribed period and subject to any applicable exemption or direction from a public authority, notify the Personal Data Protection Commission and (where required) affected individuals, providing such information as is prescribed under the PDPA. Any notification we provide is made solely to comply with our statutory obligations, is not an admission of liability or fault, and does not waive or limit any right, remedy, or defence available to us under this Privacy Policy, the Related Terms, or applicable law.

11. Your rights

11.1 Subject to the PDPA and other applicable law, you have the right to:

• request access to your personal data in our possession or under our control;
• request correction of personal data that is inaccurate, incomplete, or out of date; and
• withdraw consent to the collection, use, or disclosure of your personal data for any Purpose.

11.2 To exercise any of these rights, please contact us at media@redbrick.sg with the subject line "PERSONAL DATA" and sufficient detail to enable us to identify you and locate your data. We may require you to verify your identity before responding and may charge a reasonable fee for access requests, in accordance with the PDPA.

11.3 We may decline to act on a request where permitted or required by law, including where the request is frivolous or vexatious, where complying would prejudice an investigation, or where disclosure would reveal personal data about another individual.

12. Third-party sites and services

12.1 The Services may contain links to, or integrate with, third-party websites, applications, and services (including those of Partners). This Privacy Policy does not apply to those third-party websites, applications, and services, which are governed by their own privacy policies. We are not responsible for the practices of any third party, and we encourage you to review the privacy policies of any third party before providing them with personal data.

13. Changes to this Privacy Policy

13.1 We may update this Privacy Policy from time to time to reflect changes in our practices, the Services, or applicable law. The updated Privacy Policy will be posted on our website and will take effect on the date indicated at the top of this Privacy Policy. We may, but are not obliged to, give you specific notice of changes. Your continued use of the Services after the effective date constitutes acceptance of the updated Privacy Policy. It is your responsibility to review this Privacy Policy periodically.

14. Contact

For queries, complaints, or requests relating to personal data, please contact our Data Protection Officer:

Data Protection Officer

RB Digital Media Pte Ltd (UEN 201815793C)

1 Coleman Street #08-11 The Adelphi

Singapore 179803

Email: media@redbrick.sg

Subject line (preferred): PERSONAL DATA

Your communication should include sufficient information to enable us to identify you and the matter you are raising. We endeavour to acknowledge receipt of properly directed queries and complaints within a reasonable time and to respond substantively within thirty (30) days of receipt of a complete and verified request, or such longer period as may be required having regard to the nature and complexity of the matter, our verification processes, or any applicable legal or regulatory requirement.