Data Protection Policy

1. Overview

Toroping Group is committed to protecting the personal data of our members, customers, sellers, and website visitors. This Data Protection Policy describes the measures we take to ensure compliance with the Singapore Personal Data Protection Act (PDPA) and other applicable data protection laws across all our brands, including SUNMORI and TRIBE.

2. Data Protection Principles

We adhere to the following principles:

• Lawfulness & Fairness: We collect and process personal data only for legitimate purposes with consent or other lawful basis.
• Purpose Limitation: Data is used only for the purposes for which it was collected.
• Minimization: We collect only the data necessary for our operations.
• Accuracy: We maintain accurate and up-to-date records.
• Storage Limitation: Data is retained only as long as necessary.
• Accountability: We demonstrate compliance through documented policies and procedures.

3. Consent Management

Where consent is the basis for processing, we obtain it clearly and proactively. Members and customers may withdraw consent for marketing communications or non-essential data processing at any time by contacting businessdevelopment@toroping.com. Withdrawal of consent does not affect the lawfulness of processing prior to withdrawal.

4. Access & Correction Rights

Individuals may request access to their personal data held by Toroping Group and request correction of inaccurate or incomplete data. Requests should be submitted to businessdevelopment@toroping.com with sufficient identification. We will respond within 30 days of receiving a valid request.

5. Data Security Measures

We implement layered security controls including:

• Encryption of data in transit (TLS/SSL) and at rest.
• Role-based access controls and authentication for internal systems.
• Secure payment processing through PCI-DSS compliant partners (e.g., Stripe).
• Regular security reviews and vulnerability assessments.
• Staff training on data protection and confidentiality.
• Audit logging for sensitive data access and administrative actions.

6. Data Breach Response

In the event of a data breach, Toroping Group will take immediate steps to contain the breach, assess its impact, and notify affected individuals and relevant authorities where legally required. We maintain an incident response plan to ensure timely and appropriate action.

7. Cross-Border Data Transfer

As our infrastructure and service providers may operate outside Singapore, personal data may be transferred to or stored in other countries. We ensure such transfers comply with PDPA requirements and that comparable protection is in place for your data.

8. Data Protection Officer

Toroping Group has designated a Data Protection Officer (DPO) responsible for overseeing data protection compliance. For data protection matters, contact: dataprotection@toroping.com.

9. Third-Party Processors

We engage trusted third-party service providers (e.g., cloud hosting, payment processors, email delivery) who may process personal data on our behalf. These providers are bound by contractual obligations to protect data in accordance with our policies and applicable law.

10. Policy Updates

We review and update this Data Protection Policy periodically to reflect changes in our practices or legal requirements. Updated versions will be posted on this page with the revised "Last updated" date.

11. Contact

For any data protection inquiries, contact us at dataprotection@toroping.com.