Privacy Policy

This Privacy Policy explains how ECOMWARTS GROUP PRIVATE LIMITED collects, uses, shares, and protects your personal data when you visit ecomwarts.net, sign up for our free or paid workshops and webinars, join our student community, or buy any of our programs. In this policy, "we", "us", "our", and "eComwarts" mean ECOMWARTS GROUP PRIVATE LIMITED.

This policy is written to meet Singapore's Personal Data Protection Act 2012 (PDPA), and to give the extra rights owed to buyers in the EU, the UK, California, and other regions. Please read it with our Terms of Service and any separate program agreement you sign.

This document explains our privacy practices. It is not legal advice.

1. Who We Are and How to Contact Us

We are the company that owns and operates ecomwarts.net and all eComwarts products.

We are the data controller (under GDPR terms) and the organisation responsible for your personal data (under the PDPA) for the processing described here.

Data Protection Officer (DPO). As required by the PDPA, we have named a Data Protection Officer. You can reach our Data Protection Officer at support@ecomwarts.net. Please put "DPO" or "Privacy" in the subject line so your message is routed correctly.

2. What Personal Data We Collect

We collect the following kinds of personal data:

• Identity and contact data — your name and email address, and (if you give them) your phone number and country.
• Account data — your login and profile details for the paid membership and student community, held through Whop and Discord, such as your username, membership status, and the programs you have access to.
• Purchase and billing data — what you bought, the amount, the date, your order and transaction references, and partial payment details (for example, card type and the last four digits). We do not collect or store your full card number, card payments are handled by Stripe through Whop.
• Support and communications data — the messages, questions, and information you send us by email, SMS, the website, Discord, or our support channels, and our replies.
• Marketing data — your subscription status, the emails and SMS you opened or clicked, and your consent and opt-out choices.
• Automatically collected / technical data — your IP address, device type, operating system, browser type, language, the pages you view, links you click, the site you came from, time and date of visits, and similar usage data, collected through cookies, pixels, and analytics tools (see Section 5).

The login credentials you use to reach our paid membership and community are held by Whop and Discord. We treat any such account-credential data as limited to giving you access, we do not use it to infer any characteristic about you and we do not use it for advertising.

We do not seek to collect special-category or sensitive data (such as health, race, religion, or precise geolocation) and ask that you do not send it to us.

3. How We Collect Your Data

We collect personal data in these ways:

• Directly from you — when you fill in a form on ecomwarts.net (for example, to register for a free workshop or join our email list), buy a product, create an account, join our Discord community, or contact support.
• At checkout, through Whop — when you purchase a product, Whop (and Stripe for the card payment) collects your billing and payment details and shares order and account data back to us.
• Through cookies, pixels, and analytics — when you use our website, as described in Section 5.
• By SMS — when you give your phone number and agree to receive reminders and messages. Every SMS carries an opt-out (see Section 10).
• From the platforms and service providers we use — for example, Whop, Discord, Kit, Meta, and Google may pass us data such as your account status, engagement, or ad performance, in line with their own terms and your settings with them.

4. Why We Use Your Data and Our Legal Basis

We use your personal data only where we have a lawful basis. Below we set out each purpose and the basis we rely on. Where the PDPA applies, we rely on your consent, deemed consent (for example, where you voluntarily give data to complete a purchase you asked for), or a legitimate-interests or other exception permitted by the PDPA. Where GDPR or UK GDPR applies, we name the matching basis.

All non-essential cookies, the Meta pixel, and Google Analytics run on consent only. We do not rely on legitimate interests to set or read them. In US states where consent is not the standard, we run them until you opt out (including through a Global Privacy Control signal, see Sections 5 and 9).

Where we rely on consent, you can withdraw it at any time (see Sections 9 and 10). Where we rely on legitimate interests, we have weighed those interests against your rights.

5. Cookies and Tracking

We and our providers use cookies and similar technologies (pixels, tags, local storage) on ecomwarts.net to make the site work, remember your choices, measure traffic, and show and measure ads.

The main tracking tools we use are:

• Meta pixel (Meta / Facebook) — lets us measure our ads and show retargeting ads to people who visited our site or engaged with us. It sends Meta data about your visit and actions.
• Google Analytics (Google) — helps us see how many people visit, which pages they use, and how our site performs. It may set cookies and collect device and usage data.
• Microsoft Clarity (Microsoft) — records aggregated usage, clicks, scrolling, and session replays so we can see how our pages are used and improve them.
• Whop Pixel (Whop) — measures our advertising on this funnel. It records page views and workshop registrations and attributes them back to the ad that brought you here, so we can measure and optimise our campaigns. It does not run for visitors in the EEA, the UK, or Switzerland, and we do not send Whop your name, email, or phone number from these pages.

We also use cookies that are strictly necessary for the site and checkout to function, which do not need consent.

Consent gate. We show a cookie consent banner to every visitor of ecomwarts.net. The banner blocks all non-essential cookies, the Meta pixel, and analytics until you make a choice. For visitors in the EU and the UK, these trackers do not fire until you consent. For visitors in US states that use an opt-out model, they run until you opt out, and we honour a valid Global Privacy Control (GPC) browser signal as that opt-out.

Profiling. Our advertising and analytics tools build audience segments and profile visitors for advertising and measurement (for example, to show retargeting ads). We do not make decisions about you that are based solely on automated processing and that produce legal or similarly significant effects. You can opt out of this profiling and of targeted advertising at any time by rejecting non-essential cookies in our banner, using GPC, or contacting us as set out in Sections 9 and 14.

How to manage or opt out of cookies:

• Use our cookie consent banner to accept or reject non-essential cookies. You can change your choice at any time.
• Change your browser settings to block or delete cookies. Blocking some cookies may affect how the site works.
• Opt out of Google Analytics with Google's browser add-on, and manage Google ad settings in your Google account.
• Manage Meta ad preferences in your Facebook/Instagram account settings.
• Use a browser signal such as Global Privacy Control (GPC); we treat a valid GPC signal as an opt-out of "sale"/"sharing" and targeted advertising where required (see Section 9).

6. Who We Share Your Data With

We share personal data only with the service providers and parties below, and only as needed for the purposes in this policy. Each acts under contract and, where they process data for us, on our instructions.

• Whop — runs our checkout, customer accounts, and access to paid memberships. Receives your account, order, and access data.
• Stripe — processes card payments through Whop. Receives your payment and billing data. We do not receive or store your full card number.
• Discord — hosts our private student community and group coaching. Receives the account data needed to give you access and run the community.
• Kit (formerly ConvertKit) — sends our marketing and program emails. Receives your name, email, and engagement and consent data.
• Meta / Facebook — advertising, including the Meta pixel and retargeting. Receives website event and audience data as described in Section 5.
• Google — analytics (Google Analytics) and possibly Google Ads. Receives website usage and, for ads, campaign data.
• Microsoft — product analytics and session replay through Microsoft Clarity. Receives website usage and interaction data.

We may also share data with our professional advisers (such as accountants and lawyers), with regulators or authorities where the law requires, and with a buyer or successor if we ever sell, merge, or reorganise the business, in which case we will protect your data as set out here.

We do not sell your personal data for money. Some sharing for advertising and analytics (for example, through cookies and pixels) may count as a "sale" or "sharing" under certain US state laws; see Section 9 for how to opt out.

7. International Data Transfers

We are based in Singapore, and our buyers are worldwide. Your data may be processed in Singapore, the United States, the EU, and other countries where we or our providers operate. Data-protection laws in those countries may differ from those where you live.

When we transfer personal data out of Singapore, we meet the PDPA's transfer-limitation obligation: we take steps so the receiving party protects the data to a standard comparable to the PDPA, for example through contract terms or the provider's certification.

When we transfer personal data out of the EEA or the UK, we rely on a lawful transfer mechanism, such as the European Commission's Standard Contractual Clauses (and the UK Addendum or UK International Data Transfer Agreement for UK data), transfers to countries with an adequacy decision, or another approved safeguard. You can ask us for more detail using the contact in Section 14.

8. How Long We Keep Data and How We Secure It

Retention. We keep personal data only as long as we need it for the purposes in this policy, then delete or anonymise it. Our periods by category are:

• Purchase, billing, tax, and accounting records — kept for 5 years from the relevant transaction or financial year, the minimum period Singapore law requires (for example, under the Income Tax Act, the Goods and Services Tax Act, and the Companies Act). Some records may be kept longer where a legal claim or investigation requires it.
• Account data — kept while you hold an account and for a short wind-down period after it closes, after which it is deleted or anonymised (subject to the tax/accounting period above for any linked purchase records).
• Marketing data — kept until you unsubscribe or withdraw consent, and then only the minimum needed to honour your opt-out (for example, a suppression record so we do not contact you again).
• Support messages — kept for up to 2 years to handle follow-ups and disputes, unless a longer period is needed to defend a legal claim.
• Website and analytics data — kept for up to 26 months, then deleted or aggregated.

Security. We use reasonable technical and organisational measures to protect personal data against loss, misuse, and unauthorised access, including access controls, encryption in transit at our checkout and platforms, and trusted providers. No system is completely secure, so we cannot guarantee absolute security.

Data-breach notification. As required by the PDPA, if a data breach happens that is likely to cause significant harm to affected people, or that meets the scale threshold in the law, we will notify the Personal Data Protection Commission (PDPC) no later than 3 calendar days after we assess that the breach is notifiable, and we will notify affected individuals as soon as practicable. Where GDPR or UK GDPR applies, we will notify the lead supervisory authority within 72 hours of becoming aware of a notifiable breach, and affected individuals without undue delay where the law requires.

9. Your Privacy Rights

Your rights depend on where you live. We honour the rights owed to you under the law that applies. To use any right, contact us as set out in Section 14. We will verify your identity before acting and will not treat you unfairly for using your rights.

9.1 Singapore (PDPA), everyone

Under the PDPA you may:

• Access the personal data we hold about you and ask how it has been used or disclosed in the past year.
• Correct personal data that is wrong or incomplete.
• Withdraw consent to our use of your personal data at any time. If you withdraw consent, we may no longer be able to provide a product or service that depends on it.

We will respond within the time the PDPA allows. A reasonable fee may apply to an access request, and we will tell you first.

Complaints to the PDPC. If you are not satisfied with how we handle your data or your request, please contact our Data Protection Officer first at support@ecomwarts.net so we can try to resolve it. You may also complain to the Personal Data Protection Commission (PDPC) of Singapore at www.pdpc.gov.sg.

9.2 EU and UK (GDPR / UK GDPR)

If you are in the EU or the UK, you also have the rights to:

• Access your personal data.
• Rectification, correct inaccurate or incomplete data.
• Erasure, ask us to delete your data ("right to be forgotten").
• Restriction, ask us to limit how we use your data.
• Portability, receive certain data in a portable format, or have it sent to another controller.
• Object, object to processing based on legitimate interests, and to direct marketing at any time.
• Withdraw consent at any time, without affecting processing done before you withdrew it.

You can also object to the profiling we carry out for advertising and analytics (see Section 5). We do not make solely-automated decisions about you that produce legal or similarly significant effects.

You also have the right to complain to your local supervisory authority. In the UK, that is the Information Commissioner's Office (ICO) at ico.org.uk. In the EU, it is your national data-protection authority. Our EU and UK representatives are named in Section 11.

9.3 California (CCPA / CPRA)

If you are a California resident, you have the right to:

• Know what personal information we collect, use, disclose, and share.
• Delete the personal information we hold about you, subject to legal exceptions.
• Correct inaccurate personal information.
• Opt out of the "sale" or "sharing" of your personal information for cross-context behavioural advertising, and of profiling for targeted advertising.
• Non-discrimination, we will not deny you service, charge a different price, or give you a lower quality of service for using your rights.

Notice at collection, categories of personal information. For the preceding 12 months we collect the CCPA/CPRA categories below, from the sources named, for the purposes named, disclosing them to the categories of third parties named.

Categories we do NOT collect: biometric information; protected-classification characteristics (such as race, religion, health, sexual orientation); professional or employment information; education records; and precise geolocation.

Sensitive personal information. The only category of CCPA "sensitive personal information" we handle is the account log-in credentials you use to reach our paid membership and community, held through Whop and Discord. We use this data only to give you access to your account and the community. We do not use it to infer characteristics about you and we do not use it for advertising. Because we limit it to that purpose, the CPRA right to "limit the use of sensitive personal information" is not engaged. If that ever changes, we will offer that right and update this policy.

Do Not Sell or Share My Personal Information. We do not sell your personal information for money. However, our use of advertising and analytics cookies and pixels (such as the Meta pixel and Google) may count as "selling" or "sharing" under California law. To opt out, reject non-essential cookies in our banner, send a request to support@ecomwarts.net with "Do Not Sell or Share" in the subject line, or use a valid Global Privacy Control (GPC) browser signal, which we honour as an opt-out. You may use an authorised agent to make a request on your behalf.

9.4 Other US states

If you live in another US state with a privacy law now in force (such as Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and others), you have similar rights, to access, correct, delete, and obtain a copy of your personal data, and to opt out of targeted advertising, profiling, and the sale of your data. Some states let you appeal a decision we make about your request. To use these rights, contact us as in Section 14, and we will honour the rights your state gives you.

10. Marketing and How to Unsubscribe

We send marketing by email and, if you opt in, by SMS. You are always in control.

Email (Kit). Every marketing email has a one-click unsubscribe link at the bottom. Click it to stop marketing emails right away. You can also email support@ecomwarts.net to be removed. We may still send you non-marketing messages you need, such as receipts, account notices, and details about a product you bought.

SMS. If you gave your number and agreed to SMS, you can opt out at any time by replying STOP to any message, or by emailing support@ecomwarts.net. We honour every SMS opt-out.

Singapore Spam Control Act and Do Not Call (DNC) Registry. For recipients in Singapore, we follow the Spam Control Act, our marketing messages carry clear sender details and a working unsubscribe option, and we act on opt-outs. Before sending marketing calls, texts, or faxes to a Singapore number, we check the number against the national Do Not Call (DNC) Registry as the PDPA requires, unless you have given us clear consent to contact you on that number, or unless the "ongoing-relationship" exemption applies, that is, you are an existing customer, the message is about the same or a related type of product, and every message carries an opt-out.

11. GDPR Article 27 Representatives (EU and UK)

Because we offer paid products to buyers in the EU and the UK, we are required to appoint representatives under Article 27 of the GDPR and the UK GDPR before selling to EU or UK buyers on more than an occasional basis. Our representatives are:

• EU representative: [EU ARTICLE 27 REPRESENTATIVE, TO BE APPOINTED]
• UK representative: [UK ARTICLE 27 REPRESENTATIVE, TO BE APPOINTED]

Note: These representatives must be formally appointed before we sell to EU or UK buyers on a regular (non-occasional) basis. Until then, EU and UK residents may contact us directly at support@ecomwarts.net for all privacy matters.

12. Children

Our products are for adults. Our website, workshops, and programs are not directed to children under 16, and we do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, please contact support@ecomwarts.net and we will delete it. Where a higher age of consent applies in your country, we apply that age.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will change the "Effective date" at the top and post the new version at ecomwarts.net. If the changes are significant, we will give you clearer notice, such as by email. Please check back so you stay informed. Using our site or products after an update means you accept the updated policy, to the extent the law allows.

14. How to Contact Us to Exercise Any Right

For any privacy question, request, or complaint, including to access, correct, delete, port, or restrict your data, to object, to opt out of sale/sharing or targeted advertising, or to withdraw consent, contact us:

Please put "Privacy" or the right you want to use in the subject line, addressed to the Data Protection Officer. We will verify your identity, respond within the time the law requires, and tell you if we need more information or cannot fully meet a request. If you are in Singapore and are not satisfied, you may contact the PDPC (www.pdpc.gov.sg). If you are in the EU or UK, you may contact your local supervisory authority or the ICO (ico.org.uk).