Legal

Privacy Notice

BuildAlreadyAnot (buildalreadyanot.com) · Effective date: [launch date] · Last updated: 13 October 2026 (draft)

DRAFT adapted from the SG Third Places privacy notice. Items in [brackets] are decisions for Kelvin and Joey. Have this reviewed by a Singapore lawyer before launch. It is not legal advice.

1. Who we are

BuildAlreadyAnot ("we", "us", "our") operates buildalreadyanot.com, a site for our custom brick builds and workshops.

  • Operators: Kelvin Seetoh and Joey Yeo
  • Contact email: hello@buildalreadyanot.com
  • Data Protection Officer (DPO): Kelvin Seetoh and Joey Yeo, hello@buildalreadyanot.com

This notice explains how we collect, use, disclose and protect personal data under the Personal Data Protection Act 2012 (PDPA) of Singapore.

2. Who this notice covers

  • Visitors who browse the Site.
  • People who book or enquire about a Workshop or Custom Build.
  • Participants, including children, who attend a Workshop.
  • Corporate clients and their contact persons.
  • People who join our Telegram community, the Brick List.
  • People who appear in photos or videos we take.

3. Personal data we collect

Category What it includes Where it comes from
Booking and enquiry details Name, email address, phone number, participant names, number of seats, message You, when you book or enquire
Corporate client details Contact person's name, job title, company, email, phone, billing details, brand assets you give us You or your company
Participant details Names and, for children, age and a parent or guardian's contact; health or access needs you choose to tell us You or a parent or guardian
Payment details Payment status, amount and reference. Card details are handled by our payment provider, not stored by us Your payment provider and you
Photos and videos Images or video of you or your child at Workshops, and of finished builds Us, at the Workshop
Brick List (Telegram) Your Telegram display name and username, and anything you post. We do not collect your email through the Brick List Telegram, and you
Technical data IP address, browser type, device type, pages visited, times of visit Automatically, when you use the Site
Local device storage Preferences kept in your browser only (see section 10) Your device

We do not knowingly collect personal data from children under 13 without a parent or guardian's consent. See section 12. We do not collect NRIC numbers or other government identification numbers unless the law requires it.

4. Why we collect and use personal data

We collect and use personal data only for these purposes:

  1. To handle bookings, enquiries and quotes, and to run Workshops and deliver Custom Builds.
  2. To take payment, issue receipts and invoices, and handle refunds.
  3. To send service messages, such as booking confirmations, reminders and changes.
  4. To keep participants safe, including acting on any allergy, medical or access information you share.
  5. To take photos and videos at Workshops and use them on the Site and in marketing, where you have not objected.
  6. To run the Brick List community.
  7. To respond to your questions, requests and complaints.
  8. To keep the Site secure, prevent fraud and misuse, and fix technical problems.
  9. To send marketing messages, but only where you have opted in (see section 9).
  10. To meet legal and regulatory obligations, keep accounting records, and defend or pursue legal claims.

5. Consent

  • We rely on your consent when you submit a booking or enquiry form, or choose to join the Brick List.
  • We may also rely on deemed consent (for example, where you voluntarily give your details to make a booking) and on the exceptions allowed by the PDPA.
  • For children, a parent or guardian gives consent on their behalf.
  • Photos and videos: we tell participants at Workshops that we take them. If you do not want to appear, tell us before the Workshop or afterwards, and we will stop using the content.

You can withdraw consent at any time (see section 11). Withdrawing consent may mean we can no longer provide some services to you.

6. Who we share personal data with

  • Service providers that help us run the Site and Workshops, under contracts that require them to protect your data:
    • Lovable (hosting, database and file storage)
    • Our payment processor (online payments)
    • Our email provider (confirmations and quote emails)
    • Telegram (Brick List), which also acts as an independent service with its own privacy policy
    • Google Fonts (Google), which delivers the typefaces used on the Site. When a page loads, your browser requests the font files from Google, which receives your IP address and browser details
  • Venues and event partners, where we need to share names or numbers to run a Workshop at a venue.
  • Authorities. Where required by law, a court order or a competent authority, or where we reasonably believe it is needed to investigate a crime or prevent serious harm.
  • Business transfers. If we sell or merge the business, personal data may transfer to the new owner under the same protections.

We do not sell personal data.

7. Transfers outside Singapore

Some of our service providers store or process data outside Singapore, including the United States. Where we transfer personal data overseas, we take steps required by the PDPA to make sure it receives a standard of protection comparable to the PDPA, for example through contracts with our providers.

8. How long we keep personal data

  • Enquiries and quotes: 12 months after the last contact, then deleted or anonymised.
  • Bookings and payment records: 5 years, to meet accounting and tax requirements.
  • Participant health or access notes: deleted [30 days] after the Workshop.
  • Photos and videos: kept while we use them, until you ask us to remove them.
  • Technical logs: 90 days.

When we no longer need personal data for any purpose, we stop keeping it or remove the means by which it can be linked to you.

9. Marketing messages

  • We send marketing messages only if you opt in. Joining the Brick List on Telegram is your choice, and you can leave at any time.
  • Every marketing email includes a clear way to unsubscribe, free of charge.
  • We will not send marketing messages to a Singapore telephone number unless we have checked the Do Not Call Registry or have clear consent, as required by the PDPA.

10. Cookies and local storage

  • We use essential cookies and similar technologies to keep the Site working.
  • The Site loads fonts from Google Fonts. This does not set cookies, but your browser connects to Google servers to fetch the font files.
  • Preferences stored in your browser stay on your device. We do not receive them, and clearing your browser data removes them.

You can control cookies through your browser settings. Blocking essential cookies may stop parts of the Site from working.

11. Your rights

Under the PDPA you may:

  • Request access to the personal data we hold about you, and how it has been used or disclosed in the past year.
  • Request correction of inaccurate or incomplete personal data.
  • Withdraw consent to our use or disclosure of your personal data, for any purpose.

To make a request, email hello@buildalreadyanot.com and include enough detail for us to verify your identity. We will respond within 30 days. If we cannot meet that timeline, we will tell you why and when we will respond. We may charge a reasonable fee for access requests, and we will tell you the fee before we process the request.

We may refuse a request where the PDPA allows it, and we will tell you the reason.

If you are not satisfied with our response, you may complain to the Personal Data Protection Commission (PDPC) of Singapore.

12. Children

Our Workshops may be attended by children, accompanied by a parent or guardian. The Site is not designed for children under 13. A parent or guardian should make any booking or enquiry. If we learn that we have collected personal data from a child without appropriate consent, we will delete it.

13. Security

We protect personal data with reasonable security arrangements, including:

  • Encrypted connections (HTTPS).
  • Access limited to the founders and to staff who need it.
  • Our providers' security controls, under contract.

No online service is completely secure.

14. Data breaches

If a data breach occurs that is likely to cause significant harm to affected individuals, or that involves 500 or more individuals, we will:

  • Notify the PDPC as soon as practicable, and within 3 calendar days after we assess the breach is notifiable.
  • Notify affected individuals as soon as practicable where required under the PDPA.

15. Links to other sites

The Site links to Telegram, social media and other third-party services. Those services have their own privacy policies. We are not responsible for them.

16. Changes to this notice

We may update this notice from time to time. We will post the new version on this page and change the "Last updated" date. For material changes, we will also tell you by email where we hold an address.

17. Contact us

For any privacy question, request or complaint, email hello@buildalreadyanot.com.

This notice is governed by the laws of the Republic of Singapore, including the PDPA.