Privacy Policy

This Privacy Policy sets forth the principles governing how Celesterra Pte. Ltd. (hereinafter referred to as "the Company," "we," "us," or "our," a corporation established in Singapore) effects the collection, utilization, disclosure, and protection of personal data acquired through the operational website located at www.aporenaturals.com (hereinafter referred to as "the Site").

By accessing or otherwise utilising the Site, individuals assent to the stipulations delineated within this Privacy Policy and hereby grant consent to the processing of their personal data in conformance with the Singapore Personal Data Protection Act 2012 (PDPA). Revisions to this Policy may be implemented periodically without prior notification, and continued usage of the Site subsequent to such amendments constitutes acknowledgement and acceptance of said revisions.

1. Acquisition of Personal Data (Notification and Consent Obligations)

Personal data is obtained by the Company via two methods:

A. Data Provided Voluntarily by the Individual

We collect personal data which individuals elect to furnish to us during interaction with the Site. This may include, but is not limited to:

Identification Data: Name, electronic mail address, physical postal address, and telephony contact number.
Transactional Records: Details pertaining to the acquisition of products or services.
Account Information: Data submitted during the process of account establishment or interaction with customer support mechanisms.

B. Data Collected Through Automated Means (Deemed Consent by Conduct)

Upon accessing the Site, the Company automatically records specific technical data. This information encompasses, but is not limited to, the Internet Protocol (IP) address, type of browser used, device specifications, sequence of pages visited, duration of site presence, and referring Uniform Resource Locators (URLs).

Tracking Technologies, including Cookies: The Site employs various tracking mechanisms, including cookies, tags, and pixels (e.g., Google Analytics, Meta/Facebook Pixel). The function of these technologies is categorised as follows:

Essential Functionality: Operational necessities, such as the maintenance of session state and shopping cart contents.
Performance and Analysis: Evaluation of site traffic volumes, identification of performance anomalies, and assessment of user engagement metrics.
Marketing and Promotional Activity: Facilitation of content personalisation, targeted advertisement delivery, and measurement of advertising campaign efficacy.

Basis for Consent and Right of Objection: Continued utilisation and browsing of the Site are construed as deemed consent for the non-essential collection, use, and disclosure of personal data (including IP address, device information, and browsing behaviour) via the aforementioned technologies. This presumption of consent is operative unless the individual exercises their prerogative to object. Individuals may effect a withdrawal of consent (opt-out) regarding non-essential tracking technologies through the following procedures:

Adjustment of Web Browser Settings: Modification of browser parameters to restrict or inhibit the setting of cookies. This constitutes the designated primary mechanism for user-managed control over tracking.
Activation of 'Do Not Track' (DNT) Signals: We acknowledge and adhere to DNT signals activated within the browser for the purposes of analytical and marketing data processing.

Note: The restriction of cookies via browser configuration may lead to limitations in the functionality and overall operational performance of the Site.

2. Objectives for Data Processing (Purpose Limitation Obligation)

Personal data may be processed for the purposes listed below, which are deemed reasonable and pertinent within the operational context:

Category of Use	Specific Activities
Transaction Execution	Processing of orders, management of customer accounts, execution of returns/refunds, and provision of required customer support services.
Promotional and Advertising Activities	Deployment of targeted advertising campaigns on relevant platforms, generation of audience segments, quantitative assessment of digital advertising expenditure, and dispatch of electronic mail marketing communications, subject to the recipient's opt-out status.
Site Management and Security	Enhancement of the Site and product offerings, optimisation of the user interface, detection and prevention of security incidents, and internal operational data analysis (inclusive of anonymised data processing).
Statutory Compliance	Adherence to applicable legal mandates, response to regulatory authority requests, and maintenance of necessary corporate records (e.g., fiscal documentation).

Personal data shall not be utilised for objectives not described herein unless specifically required or permitted pursuant to applicable law.

3. Disclosure of Personal Data to Third Parties (Disclosure Obligation)

Personal data may be disclosed to external entities where such disclosure is necessitated by business operational requirements:

Service Vendors: Entities providing services integral to our operations, including payment processing, logistical services, IT infrastructure management, data hosting, and providers of analytical and marketing services.
Governmental and Statutory Bodies: Disclosure mandated by legal requirement, court order, or regulatory enforcement body (e.g., tax authorities, PDPC).
Professional Consultants: External auditors, legal counsel, or other professional advisers.
Corporate Restructuring: Parties engaged in activities such as mergers, acquisitions, or asset transfers.

4. Transnational Data Transfer (Transfer Limitation Obligation)

Personal data collected may undergo transmission to and subsequent processing in jurisdictions situated outside of Singapore, primarily for the engagement of global service providers.

In compliance with the PDPA’s Transfer Limitation Obligation (Section 26), we shall implement requisite measures to ensure that any overseas recipient of personal data is legally bound by obligations—such as binding contractual stipulations or formally approved corporate rules—to afford the transferred data a level of protection at minimum comparable to that mandated by the PDPA.

By proceeding with the use of the Site, individuals consent to this transmission and acknowledge that, notwithstanding the implementation of safeguards, personal data may become subject to the jurisdiction-specific legislation of the destination territory.

5. Data Protection and Retention (Protection and Retention Limitation Obligations)

A. Protection

The Company maintains appropriate administrative, technical, and physical safeguards (e.g., secure hosting infrastructure, regulated access controls, appropriate encryption) designed to protect personal data from unauthorised access, collection, use, disclosure, or corruption. Absolute security cannot be guaranteed for any transmission or storage method.

B. Retention

Personal data retention shall persist only for the duration required to achieve the stated purposes in this Policy, or to satisfy mandatory legal, regulatory (e.g., corporate and fiscal record retention periods), or operational requirements. Data that ceases to be necessary for these requirements shall be subjected to secure destruction or permanent anonymisation.

6. Individual Data Rights (Access and Correction Obligation)

Subject to the parameters of applicable law, individuals possess the right to request:

Access: Access to their personal data held by the Company, inclusive of information concerning the manner of its use or disclosure during the preceding year.
Correction: Rectification of any data that is determined to be inaccurate or incomplete.

Such formal requests are to be directed to the Data Protection Officer (DPO) and may be subject to the imposition of a reasonable administrative fee.

7. Governing Jurisdiction

This Privacy Policy and all matters related to the utilisation of the Site and the processing of personal data shall be governed by and construed in accordance with the laws of Singapore.

8. Data Protection Officer and Contact Information (Accountability Obligation)

The mandatory Data Protection Officer (DPO) is responsible for overseeing adherence to the PDPA.

Any formal enquiries regarding this Privacy Policy, requests related to personal data rights, or instances of consent withdrawal are to be directed exclusively to the designated DPO:

Data Protection Officer (DPO)