Privacy Policy

We collect little, we do not sell any of it.

Last updated 22 September 2026Version 2026-09-22

In Short

  • We hold your email address if you subscribe, and your name, address and order if you buy something.
  • Our own analytics are anonymous and per-tab. The identifier they use is thrown away when you close the tab, so we cannot recognise a returning visitor.
  • We also use Google Analytics.
  • We never see your card details. Payment happens on Shopify’s systems, not ours.
  • We do not sell or rent personal data to anyone, for any purpose.

Who Is Responsible

EIEN TEA PTE. LTD. (UEN 202609314W), of 9 King Albert Park, #01-30, KAP, Singapore 598332, is the organisation responsible for the personal data described here, under Singapore’s Personal Data Protection Act 2012.

What We Collect

We collect personal data in three situations, and only what each one needs.

  • When you order. Your name, delivery and billing address, email address, and a phone number if you give one, together with what you bought. Our shop, cart and checkout run on Shopify, which holds this on our behalf. Your card number is handled by Shopify’s payment processing and never reaches this website.
  • When you contact or subscribe to us. Your email address, your message and anything you choose to attach to it, such as photographs supporting an order issue. We keep support correspondence so we can handle follow-ups.
  • When you browse. A small amount of anonymous usage data: which pages and products are looked at, what people search for, roughly what kind of device is being used, and where a visit came from. It is recorded on our own systems, it carries no name or email address, and it is not joined to your order.
  • Through Google Analytics, unless you have turned it off. This records a similar picture of your visit on Google’s systems rather than ours. Unlike the above it sets its own identifier, which persists between visits and lets us see returning visitors and where they came from. It collects your approximate location from your IP address, and your device and browser details. It also records which teas you looked at, added to your bag or removed from it, the value of your bag when you go through to pay, and what you bought if you complete an order, so we can see where people change their minds. We do not send it your name, email address or postal address. Turning it off changes nothing about the site. Whether we ask you first or rely on this notice depends on where you are — see Consent & Withdrawal below.

We use all of it to fulfil and support your orders, to send the emails you asked for, to keep the site secure and working, to understand and improve how the shop is used, and to meet our tax, accounting and food-safety obligations. We do not use it for anything else, and we do not sell or rent it.

Where we rely on your consent, principally for marketing email, you give it by subscribing and you can withdraw it at any time. Every marketing email carries an unsubscribe link, and we act on unsubscribes promptly and in any event within ten business days, as the Spam Control Act requires. You can also email our DPO and ask to be removed.

We keep a record of consent decisions: what was consented to, which published version of this policy was in force, and when. Withdrawing consent adds a new record rather than erasing the old one, so the history stays auditable.

Withdrawing marketing consent does not affect an order already placed. We will still send the transactional emails an order requires, such as confirmation and despatch, because those are part of the contract rather than marketing.

For our own usage data we rely on this notice together with the limited, anonymous nature of what is collected, rather than on a consent banner. That data sets no cookie, uses an identifier that dies with the tab, and never leaves our systems.

Google Analytics is different. It is a third-party tag that sets its own identifier and persists between visits, so it does not qualify for the treatment above. Which basis we rely on for it depends on where you are, and we would rather set that out plainly than leave it implied.

In the EEA, the United Kingdom and Switzerland we ask first. It does not load at all until you agree, and a banner appears on your first visit so you can decide. Declining leaves the shop working exactly as it did.

In Singapore and elsewhere we rely on this notice together with your ability to opt out at any time, which is the deemed-consent basis the PDPA provides. In practice that means it is on unless you turn it off, and no banner interrupts you. To turn them off, use Cookie Preferences at the foot of any page — the same panel, with the same switch, reachable wherever you are. We do not treat your location as a reason to give you less control, only as what decides whether we interrupt you to ask.

Whichever applies, withdrawing takes effect on your next page view: the tag simply stops loading. We keep a dated record of the decision and of the version of this policy that was in force when you made it. Working out which rules apply to you needs your approximate country, which we read from your network address and store for the visit only, as a two-letter code with nothing attached to it.

Overseas Transfers

Some of the service providers we rely on to run the shop store data outside Singapore. Under the PDPA’s transfer limitation obligation we take steps to ensure your data receives a standard of protection comparable to the Act’s, principally through the contractual terms we accept with each provider, which bind them to protect it and to use it only on our instructions.

If you accept analytics cookies, that includes a transfer to Google, whose analytics processing takes place on servers outside Singapore, under Google’s own data processing terms. This is the transfer you can decline: refuse analytics cookies and nothing about your visit is sent to Google.

Where an order is shipped, the recipient’s name and address are necessarily disclosed to the carrier, and for anything crossing a border to customs authorities in the destination country. That is a requirement of getting the parcel there.

Your Rights

Under the PDPA you may ask us to:

  • tell you what personal data we hold about you and how it has been used or disclosed in the past year;
  • correct anything inaccurate or incomplete;
  • withdraw your consent to any use of it, and we will tell you the likely consequences of doing so;
  • stop sending you marketing, which you can also do from any email we send.

To make any of these requests, use the contact form, choose General Enquiries as the reason, and tell us which of the above you would like us to do. We may need to verify who you are before disclosing anything, and a reasonable fee may apply to an access request, which we will tell you about before doing the work.

Our usage data cannot be searched by person. There is no name or email in it and the identifier is discarded when your tab closes, so we are unable to retrieve, correct or delete one visitor’s browsing history. That is a consequence of collecting it anonymously, not a refusal.

Data Breaches

If a data breach occurs, we assess it promptly. Where it is likely to result in significant harm to affected individuals, or is of a significant scale, we notify the Personal Data Protection Commission as soon as practicable and in any case within three calendar days of concluding that it is notifiable. We notify affected individuals where the law requires it.

Children

This site is not directed at children, and we do not knowingly collect personal data from anyone under 13. If you believe a child has given us personal data, tell us through the contact form and we will delete it.

Changes

We update this policy when what we do changes. The version and date at the top of this page tell you which is current, and the version is recorded against consent decisions, so it is always possible to establish what a person was shown.

Where a change materially affects how we use personal data you have already given us, we will tell you directly rather than relying on you noticing a new date here.

Contact & DPO

Allan Chris, Data Protection Officer
EIEN TEA PTE. LTD.
9 King Albert Park, #01-30, KAP, Singapore 598332
dpo@eientea.com

If you believe you have found a security vulnerability in this site, please report it to dpo@eientea.com before disclosing it publicly.