Privacy Policy
Last updated: 10 October 2026
This policy explains what personal data BRIXIT PTE. LTD. (UEN 202411612Z), trading as DrBartha, collects when you use drbartha.com or place an order, why we collect it, who we share it with and what your rights are.
We are the controller of that data. We follow the Personal Data Protection Act 2012 of Singapore (PDPA). Where they apply, we also follow the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, and California privacy law including the California Consumer Privacy Act as amended (CCPA). Where one of those laws does not apply to us, we still handle the same kind of request in the same way, because it is the right way to treat your data.
What we collect
When you place an order:
- your name, email address and phone number
- your shipping address and billing address
- your order details: items, quantities, amounts paid, discounts, the partner link used if any, and the shipping cost
- the last four digits and card brand that Stripe reports back to us
Card numbers are entered on Stripe’s own checkout page and never reach our systems.
When you contact us, we keep the correspondence and anything you tell us in it.
When you use the site, our host records ordinary server and security logs, including IP address and the pages requested.
If you take part in our partner programme, we keep your name, the email address you sign in with, your links, the orders attributed to them and the payouts we have made.
If you use a school access key or the school materials, we keep the school name, the key and a record of which files were downloaded.
Why we use it, and on what legal basis
| What we do | Why | Legal basis under GDPR and UK GDPR |
|---|---|---|
| Take and fulfil your order, send receipts, answer support | To perform the contract you entered | Contract |
| Ship the order and pass your details to the carrier | To perform the contract | Contract |
| Handle cancellations, returns, refunds and warranty | To perform the contract and meet consumer law | Contract, legal obligation |
| Keep accounting and tax records | Singapore tax and company law | Legal obligation |
| Prevent and investigate fraud and abuse | To protect the business and our customers | Legitimate interests |
| Keep the site and the admin pages secure | To protect the service | Legitimate interests |
| Remember a partner link so a promised discount is applied | To give you what the link offered | Legitimate interests, and your action in following the link |
| Run the partner programme and pay commission | To perform our agreement with the partner | Contract |
| Send marketing email | Only if you asked for it | Consent, withdrawable at any time |
| Measure how the site is used, with Google Analytics | To see which pages help people and which do not | Consent in the EU, EEA, UK and Switzerland; elsewhere legitimate interests, and you can opt out at any time |
Under the PDPA we rely on your consent, and on the exceptions the PDPA allows for contracts, legal requirements and legitimate interests.
Who we share it with
We use a small number of providers to run the shop. They act on our instructions under a data processing agreement, and none of them may use your data for their own purposes:
- Stripe takes payments, raises invoices and sends receipts. Stripe also screens payments for fraud, which involves automated scoring. Stripe’s own privacy policy applies to its checkout page.
- Google (Firebase and Google Cloud) hosts the website, stores order records and runs the sign-in used by the partner and staff pages.
- Google Workspace (Gmail) carries our email, including the shipping message we send you.
- Google Analytics, unless you switch it off (and in the EU, EEA, UK and Switzerland only after you accept): which pages you visit, roughly where you are, your device and browser, and what you put in the cart or buy. Google uses your IP address to estimate your country and city and does not store it. Advertising features and Google signals are switched off, and nothing is used to show you ads.
- Easyship books the courier and prints the label when the shipping cost is paid.
- Carriers, such as the postal service or a courier, receive your name, address and phone number to deliver your parcel and to contact you about it.
We also share data with our accountants and, if the law requires it, with authorities. We do not sell personal data, we do not share it for cross-context behavioural advertising, and we do not give it to advertisers.
Where your data goes
We are in Singapore. Our providers store and process data in Singapore, the United States, the European Union and other countries where they operate. When data leaves the European Economic Area or the United Kingdom we rely on the European Commission’s Standard Contractual Clauses, the UK Addendum, or an adequacy decision where one covers the country, and we check that the provider protects the data to a comparable standard as the PDPA requires.
How long we keep it
- Order, invoice and accounting records: at least five years, as Singapore tax and company law require, and up to seven where a warranty claim or dispute may still arise.
- Support correspondence: as long as it is useful for helping you, normally two years, then deleted.
- Partner programme records: for as long as the partnership lasts, then seven years for the payments made.
- Server and security logs: a short period set by our host, normally weeks.
- Google Analytics data: 14 months, then Google deletes it.
- Marketing consent: until you withdraw it.
Your cart is stored in your own browser and never leaves your device until you check out.
Cookies and what the site stores on your device
drbartha.com sets no advertising cookies, no tracking pixels and no cross-site trackers. It stores a small amount of data on your own device:
| What | Why | How long |
|---|---|---|
| Cart | Keeps what you put in the cart | Until you clear it or check out |
| Partner link code | Applies the discount a partner link promised, and credits that partner | 90 days |
| Theme | Remembers light or dark mode | Until you clear it |
| Sign-in token, on the partner and staff pages only | Keeps you signed in | Until you sign out |
| Your cookie choice | Remembers whether you accepted or declined Google Analytics | Until you change or clear it |
| Google Analytics cookies (_ga, _ga_QWSXFT2LXL) | Tells one visit from the next; not set if you decline | 13 months |
None of these follow you to other websites. Stripe sets its own cookies on its checkout page for fraud prevention; its cookie policy covers those.
Outside the EU, EEA, UK and Switzerland, Google Analytics runs when you visit, and you can switch it off at any time with Cookie settings at the bottom of every page. In the EU, EEA, UK and Switzerland we ask first: a cookie banner appears, and no analytics cookies are set until you accept. We tell where you are from your device’s time zone, and Google also checks your IP address, so a European visitor whose device shows another time zone still gets no analytics cookies before accepting. If you decline, or your browser sends a Global Privacy Control signal, Google Analytics does not run, and switching it off later removes its cookies.
The videos on the site are hosted on YouTube, a Google service. The review video loads nothing from YouTube until you press play; the product demo loads its preview picture from YouTube, which tells Google your IP address. Once you play a video, the player runs from youtube-nocookie.com and YouTube’s own privacy policy applies to what it records.
Your rights
Wherever you live, you can ask us to tell you what we hold about you, to correct it, or to stop using it, and you can withdraw consent to marketing at any time.
If the GDPR or UK GDPR applies to you, you also have the right to erasure, to restrict processing, to object to processing based on legitimate interests, to receive your data in a portable form, and not to be subject to a decision based solely on automated processing that has a legal or similarly significant effect. We do not make such decisions; Stripe’s fraud scoring can decline a payment, and you can ask us to look at that case by hand.
If you are in California, you can ask us what we collect, use and disclose, ask us to delete or correct it, and opt out of any sale or sharing. We do not sell personal information and we do not share it for cross-context behavioural advertising, as the CCPA defines those terms, and we do not use or disclose sensitive personal information beyond what the law permits. We honour these requests whether or not the CCPA applies to us, and we will not treat you differently for making one. An authorised agent may act for you with written proof.
To exercise any right, email hello@drbartha.com. We answer within 30 days, and within one month where the GDPR or UK GDPR applies. We may ask you to confirm who you are before we act.
If you are not satisfied with our answer, you may complain to the Personal Data Protection Commission of Singapore, to the data protection authority of the EU country where you live, or to the Information Commissioner’s Office in the United Kingdom.
Children
We sell to adults, and the site is meant for parents, teachers and other adults. The product itself collects no data: it needs no account and does not connect to the internet on its own.
We do not knowingly collect personal data from children under 13, or under 16 where local law sets that age, and we do not direct our order process at them. If you believe a child has given us personal data, email us and we will delete it.
Security
Payment card data never reaches us. Order records are held in Google Cloud with access limited to the people who run the shop, and administrative pages require a Google sign-in on an approved account. We use encryption in transit throughout. No system is perfect; if a breach affects your data we will notify you and the relevant authority where the law requires it.
Changes
We update this policy when our processing changes. The date at the top shows the latest version. If a change matters to you, we will say so on the site.
Data protection officer
We have designated a data protection officer as the PDPA requires, and these are the DPO’s business contact details:
Dr. Dénes Bartha, Data Protection Officer BRIXIT PTE. LTD., 206A Woodleigh Link, #14-31, Singapore 361206 hello@drbartha.com
The DPO handles access and correction requests, questions about this policy, and complaints about how we use personal data.
Contact
BRIXIT PTE. LTD. (UEN 202411612Z) 206A Woodleigh Link, #14-31, Singapore 361206 hello@drbartha.com