1. About this Privacy Policy

1.1 This Privacy Policy applies to personal data handled by Nalan Restaurant Singapore in connection with nalan.com.sg and related ordering pages, restaurants, call enquiries, email enquiries reservations, dine-in services, takeaway, self-collection, delivery, online orders, catering and party bookings, private dining and event-space bookings, retail purchases including sweets, savouries, bento boxes and gift hampers, corporate services, membership and privilege programmes, promotions, feedback, careers, franchise enquiries and related activities.

1.2 “Personal data” means data, whether true or not, about an individual who can be identified from that data alone or together with other information to which the relevant Nalan entity has or is likely to have access.

1.3 This Policy is intended to support compliance with the Singapore Personal Data Protection Act 2012 (“PDPA”). Where an exception or other requirement under applicable law applies, Nalan may process personal data in accordance with that law.

1.4 This Policy is a notice describing Nalan’s data practices. It does not require an individual to consent to processing that is not reasonably necessary for the relevant service, and it does not limit any rights available under applicable law.

2. Nalan entities responsible for personal data

2.1 The responsible entity determines the purposes and means of handling personal data for the relevant transaction or interaction. The two entities may share necessary information with each other to operate the Nalan Singapore brand, coordinate services, respond to enquiries, prevent misuse and maintain consistent customer service, subject to appropriate safeguards.

3. Personal data Nalan may collect

3.1 The information collected depends on how an individual interacts with Nalan. Nalan may collect the following categories where reasonably necessary:

• Identity and contact information, such as name, telephone or WhatsApp number, email address, residential or delivery address, company, job title and authorised representative details.

• Reservation and dining information, such as outlet, booking date and time, party size, seating or accessibility requests, attendance, no-show information and special-occasion details.

• Order, catering, private-event and gift information, including items ordered, quantities, delivery or collection details, event date and venue, guest count, menu requirements, setup instructions, invoice details, recipient names, messages and delivery contacts.

• Membership, corporate-privilege and promotional information, including company eligibility, benefit use, membership status, birthday or date-of-birth information where required for a stated birthday benefit, and redemption records.

• Dietary, allergy, accessibility or other special-request information voluntarily provided for an order, reservation or event. Such information may reveal health-related or religious preferences, and individuals should provide only what is necessary for Nalan to assist with the request.

• Payment and transaction information, such as payment status, method, amount, transaction reference, invoice and refund details. Nalan does not directly store complete credit or debit card details; authorised third-party payment providers process online and payment-link transactions.

• Communications and content, including emails, telephone or WhatsApp communications, enquiries, feedback, complaints, survey responses, testimonials and content submitted directly to Nalan.

• Technical and usage information, such as IP address, browser and device information, operating system, referring page, pages viewed, approximate location, cookie identifiers, advertising identifiers and interaction data.

• CCTV images and incident information recorded at the City Hall and Little India outlets for safety, security, loss prevention and incident investigation.

• Career information, such as employment history, qualifications, work eligibility, references, portfolio, expected salary and information provided in a CV, application or interview.

• Franchise-enquiry information, such as identity and contact details, professional background, proposed territory, financial capability information voluntarily provided, and other information needed to assess the enquiry.

• Information from public sources, corporate partners, event organisers, delivery recipients, service providers or other persons where collection is authorised or otherwise permitted by law.

3.2 Nalan does not ordinarily require Singapore NRIC or passport numbers from customers. If identity verification is necessary for a specific lawful purpose, Nalan will request only information reasonably required and will handle it in accordance with applicable requirements.

3.3 Individuals should not provide excessive, irrelevant or confidential information through general enquiry, feedback, career or franchise forms. Nalan may delete information that is not reasonably needed for the stated purpose.

4. How Nalan collects personal data

4.1 Nalan may collect personal data directly from an individual when the individual:

visits an outlet, makes a reservation, places an order or requests delivery or self-collection;

requests a quotation, books catering or private dining, organises an event or purchases gifts;

contacts Nalan by website form, email, telephone, WhatsApp, social media or in person;

joins or uses a corporate membership, privilege, loyalty or promotional programme;

submits feedback, a complaint, a review, a testimonial, a photograph or other content;

applies for employment or submits a franchise enquiry; or

uses Nalan’s website, ordering pages, reservation tools, digital advertisements or electronic communications.

4.2 Nalan may also receive personal data from corporate clients, event organisers, family members, gift senders, delivery recipients, reservation and ordering platforms, delivery partners, payment providers, marketing and technology providers, recruitment sources, references, publicly available sources and other authorised parties.

4.3 A person who provides another individual’s personal data to Nalan must be authorised to do so, must provide accurate information, and should inform that individual of the relevant purposes and this Policy where appropriate.

5. Purposes for collecting, using and disclosing personal data

5.1 Nalan may collect, use and disclose personal data for purposes that a reasonable person would consider appropriate in the circumstances, including to:

• respond to enquiries, prepare quotations and communicate about requested services;

• create, confirm, change and manage reservations, orders, catering, private dining, events, gifts, delivery and self-collection;

• process payments, deposits, invoices, refunds, disputes and account reconciliation;

• verify corporate eligibility, administer privileges and provide birthday or other approved benefits;

• coordinate dietary, allergy, accessibility, venue, setup, delivery and recipient requirements;

• provide customer service, investigate complaints, recover outstanding amounts and manage service recovery;

• prevent fraud, misuse, unauthorised redemption, safety incidents and other unlawful or inappropriate activity;

• operate, secure, analyse and improve Nalan’s websites, systems, services, menus, campaigns and customer experience;

• measure advertising and communication performance, create suitable audiences and present relevant marketing where consent or another legal basis applies;

• maintain business, tax, accounting, legal, insurance, audit and operational records;

• assess job applications, verify information and references, conduct permitted recruitment checks and manage recruitment;

• assess franchise enquiries, conduct appropriate preliminary checks and communicate with applicants;

• protect the safety, security, property and legal rights of customers, staff, Nalan and others;

• comply with legal obligations, regulatory requests, court orders and lawful requests from public authorities; and

• carry out another purpose notified at the time of collection or otherwise permitted by law.

5.2 Nalan may rely on consent, deemed consent or an exception permitted under the PDPA and other applicable law. Where consent is required, Nalan will seek consent in a manner appropriate to the interaction and purpose.

5.3 Nalan will not use personal data for a materially different purpose without notifying the individual and obtaining consent where required, unless the new use is permitted by law.

6. Reservations, orders, delivery and third-party recipients

6.1 Reservation, ordering, delivery and payment services may be provided through Nalan’s own channels or third-party platforms. A third-party platform may collect and process personal data under its own privacy policy in addition to processing data for Nalan. Individuals should review the platform’s privacy information before using it.

6.2 For deliveries, catering, gifts and events, Nalan may use recipient or guest information only to fulfil and administer the relevant transaction, provide necessary service messages, manage safety or delivery issues and keep required records. Nalan will not use a gift recipient’s details for unrelated direct marketing unless consent or another permitted basis applies.

6.3 Transactional communications about an enquiry, booking, order, delivery, payment, safety matter or service issue are not marketing messages and may continue even if an individual opts out of promotional communications.

7. Cookies, analytics and similar technologies

7.1 Nalan’s website and electronic communications may use cookies, pixels, tags, software development kits and similar technologies to operate the website, remember choices, understand usage, measure campaigns, prevent misuse and provide or measure advertising.

7.2 The technologies currently used may include Google Analytics, Meta/Facebook Pixel, email-marketing software, WhatsApp Business and customer database or customer relationship management (“CRM”) tools. Google Tag Manager or similar tag-management technology may be used to deploy and manage website tags.

7.3 These technologies may collect device and usage information such as IP address, browser type, operating system, page views, referring pages, approximate location, cookie or advertising identifiers, message opens, link clicks and interactions with Nalan content.

7.4 Essential technologies may be necessary for website functions, security, ordering or preferences. Analytics and advertising technologies should be used in accordance with applicable consent and notification requirements. Where a cookie preference tool is provided, individuals may use it to manage nonessential technologies.

7.5 Individuals may also control cookies through browser or device settings. Blocking certain technologies may affect website functions. Third-party technology providers may process information under their own privacy policies and may combine it with information from other services where permitted.

8. Marketing communications and Do Not Call requirements

8.1 Where permitted, Nalan may send information about menus, promotions, festive offers, birthday offers, events, gifts, corporate services and related offers by email, telephone, SMS, WhatsApp, social media or other communication channels.

8.2 Nalan will obtain consent where required and will comply with applicable Do Not Call requirements for marketing messages sent to Singapore telephone numbers. Consent records, opt-outs and suppression preferences may be retained to ensure that marketing choices are respected.

8.3 An individual may unsubscribe using the method shown in a message or may email info@nalan.com.sg. Nalan will process the request within a reasonable period. Withdrawal from marketing does not affect service-related communications or processing already lawfully carried out.

9. CCTV, photography and recordings

9.1 CCTV operates at the City Hall and Little India outlets for safety, security, incident investigation, loss prevention, dispute handling and protection of persons and property. CCTV areas should be identified by appropriate notices.

9.2 Access to CCTV footage is restricted to authorised persons and relevant service providers. Footage may be disclosed to insurers, advisers, building management, law-enforcement agencies or other authorities where reasonably necessary or legally required.

9.3 Nalan may photograph or record general ambience, food, decorations or event setups. Nalan will not intentionally publish an identifiable customer image or recording for marketing without consent or another lawful basis. Customers who do not wish to appear should inform staff or the event organiser, and Nalan will take reasonable steps to respect the request.

10. Corporate membership and privilege programmes

10.1 Nalan may receive employee or authorised-representative information from an approved company to administer a corporate membership or privilege programme. Nalan may verify company eligibility, benefit validity, birthday entitlement and redemption compliance using the information reasonably required for the programme.

10.2 Corporate contacts must be authorised to provide employee or representative information and should not provide more information than Nalan requests. Where practicable, Nalan will use business contact details and limited verification information rather than staff identification documents.

10.3 Nalan may retain records of approvals, redemptions, misuse investigations and communications for programme administration, fraud prevention, accounting and dispute handling.

11. Careers and job applicants

11.1 Personal data submitted through a Careers page, recruitment platform, email or other application channel may be used to assess suitability, communicate with the applicant, verify qualifications or references, conduct checks permitted by law, prepare an employment offer and comply with legal obligations.

11.2 Nalan may disclose applicant information to relevant personnel, recruitment providers, referees, screening providers, professional advisers and authorities where appropriate. Nalan should inform referees before providing their details.

11.3 Information about an unsuccessful applicant will normally be retained for up to six months after the recruitment process. Nalan may retain it longer with consent for consideration for future suitable positions, or where necessary for legal, dispute or record-keeping purposes.

12. Franchise enquiries

12.1 Information submitted through a franchise enquiry may be used to assess the proposed opportunity, communicate with the applicant, conduct appropriate preliminary checks, protect Nalan’s legitimate business interests and prepare for discussions or agreements.

12.2 Applicants must provide accurate information and should not submit confidential or proprietary business information unless a separate written confidentiality arrangement is in place. Submission of an enquiry does not create a franchise, partnership or binding commitment.

12.3 Franchise-enquiry information will normally be retained for up to two years after the last substantive interaction, unless a longer period is required for continuing discussions, an agreement, legal compliance or dispute handling.

13. Disclosure of personal data

13.1 Nalan does not sell customers’ personal data. Nalan may disclose personal data, only as reasonably necessary for the relevant purpose, to:

• FAST TRACK PTE. LTD. and KITCHEN TABLE PTE. LTD. and their authorised personnel;

• reservation, online-ordering, delivery, logistics, catering, event and gift-fulfilment providers;

• banks, payment processors, payment-link providers, accounting and fraud-prevention providers;

• website hosting, cloud storage, email, WhatsApp Business, CRM, analytics, advertising and other technology providers;

• marketing, design, printing, survey and customer-service providers acting for Nalan;

• landlords, building management, security providers, insurers and event venues where relevant;

• auditors, accountants, lawyers, consultants and other professional advisers;

• a purchaser, investor or successor in connection with a proposed or completed corporate transaction, subject to appropriate confidentiality; and

• courts, regulators, law-enforcement agencies, public authorities or other persons where required or permitted by law.

13.2 Service providers that process personal data for Nalan are expected to use it only for authorised purposes, protect it appropriately, notify Nalan of relevant incidents and delete or return it when no longer required, subject to legal obligations.

14. Overseas transfers

14.1 Some technology, payment, communications, analytics, advertising, reservation, ordering or support providers may process or store personal data outside Singapore. Nalan will take reasonable steps to ensure that overseas transfers are made in accordance with the PDPA and that recipients provide a standard of protection comparable to that required under Singapore law, unless an exception applies.

14.2 Safeguards may include contractual obligations, due-diligence measures, access controls and the provider’s recognised security or data-protection commitments. The location of processing may change as service providers update their infrastructure.

15. Retention of personal data

15.1 Nalan retains personal data only for as long as it is reasonably needed for the purpose for which it was collected, a related business or legal purpose, or a period required by law. Nalan will then delete, anonymise or securely dispose of the data where practicable.

15.2 The periods above are operational guidelines, not absolute limits. A shorter or longer period may apply depending on the nature of the data, ongoing service, legal hold, dispute, investigation, limitation period, statutory requirement, security need or valid request.

16. Accuracy and data minimisation

16.1 Nalan takes reasonable steps to ensure that personal data used to make a decision affecting an individual, or disclosed to another organisation, is accurate and complete. Individuals should provide current information and promptly notify Nalan of relevant changes.

16.2 Nalan aims to collect only information reasonably necessary for the stated purpose. Date-of-birth information will be collected only where relevant, such as administering a membership or birthday privilege, and should be limited to the minimum detail required for that purpose where practicable.

17. Protection and data breaches

17.1 Nalan implements reasonable administrative, physical and technical safeguards designed to protect personal data against unauthorised access, collection, use, disclosure, copying, modification, loss, disposal or similar risks. Measures may include role-based access, authentication, staff guidance, secure disposal, vendor controls, system updates, backups and incident-response procedures.

17.2 No method of storage or transmission is completely secure. Individuals should protect their devices and accounts and should not send payment-card numbers, identity-document numbers, passwords or other unnecessary confidential data through ordinary email, WhatsApp or general website forms.

17.3 If a suspected data breach occurs, Nalan will take reasonable steps to contain and assess it. Nalan will notify the Personal Data Protection Commission and affected individuals where the breach meets the applicable notification requirements, and will do so within the periods required by law.

18. Access, correction and withdrawal of consent

18.1 Subject to the PDPA and applicable exceptions, an individual may request access to personal data in Nalan’s possession or control and information about how it was used or disclosed during the applicable preceding period. The individual may also request correction of an error or omission.

18.2 Nalan may need to verify the requester’s identity and authority before acting. A reasonable fee may be charged for an access request where permitted, and the requester will be informed of the estimated fee before the request is processed.

18.3 Nalan will respond as soon as reasonably practicable. If Nalan cannot provide the requested access or correction within 30 days, Nalan will inform the requester in writing of the time by which it expects to respond, unless a different rule applies.

18.4 An individual may withdraw consent to future collection, use or disclosure by giving reasonable notice. Nalan will explain the likely consequences where relevant and will cease the affected processing within a reasonable period unless continued processing is required or permitted by law. Withdrawal may prevent Nalan from providing a requested service or benefit.

18.5 A request should identify the individual, the relevant interaction or account, the information or consent concerned, and sufficient details for Nalan to locate the records. Requests may be sent to the DPO contact in Section 23.

9. Children’s personal data

19.1 Nalan’s general website and commercial services are not directed specifically at children. A parent, guardian, school, company or event organiser who provides a child’s personal data must be authorised to do so and should provide only information necessary for the reservation, order, event, dietary request or other stated purpose.

19.2 If Nalan becomes aware that a child’s personal data was provided without appropriate authority or is not needed, Nalan may delete it or request confirmation from a parent or guardian, subject to legal and operational requirements.

20. Third-party websites and social media

20.1 Nalan’s website and communications may contain links to reservation, ordering, delivery, payment, social-media or other third-party services. Nalan does not control the independent privacy practices of those third parties. Individuals should review the relevant third-party privacy policy before providing information.

20.2 Information posted publicly on social media, review platforms or other public services may be visible to others and is governed by the platform’s rules. This Policy does not automatically give Nalan permission to reuse independently posted content for marketing.

21. Changes to this Privacy Policy

21.1 Nalan may update this Policy to reflect changes in law, technology, vendors, services or business practices. The updated version will be published at https://www.nalan.com.sg/privacy-policy with a revised “Last updated” date.

21.2 Where a change materially affects how Nalan handles personal data, Nalan will provide additional notice or obtain consent where required. Continued use of a service does not by itself constitute consent to a new purpose where consent is legally required.

22. Complaints and questions

22.1 Questions, complaints or concerns about personal data should first be directed to Nalan’s Data Protection Officer. Nalan will review the matter, may request further information and will respond within a reasonable period.

22.2 If an individual remains concerned after Nalan’s response, the individual may contact the Singapore Personal Data Protection Commission through its official channels. Nothing in this Policy limits any right to approach a competent authority.

23. Data Protection Officer and contact details

23.1 For security, Nalan may request reasonable verification before disclosing, correcting or deleting personal data. Individuals should not send identity-document copies unless specifically requested through an appropriate channel.