Privacy Policy
Last updated: 24 June 2026
JoAndrew (operated by J.A. COSMEHEALTH, registered in <REGISTRATION_COUNTRY>) takes your privacy seriously. This page explains what data we collect, why, how long we keep it, and your rights under Singapore law (PDPA 2012) <ADD_OTHER_APPLICABLE_LAW> for SG customers.
1. What we collect
- Account data: name, email, phone, billing/shipping address (when you create an account or place an order).
- Order data: what you bought, when, payment method (we never see full card numbers, our payment gateway handles that).
- Messages: anything you send us via email, WhatsApp, or contact forms.
- Visit source: only if you allow optional cookies, the website or campaign that brought you here (for example a search engine or a social post), so we can see which channels lead to orders. We do not currently run Google Analytics or advertising trackers. If we add them, we will update this policy and ask for your consent first.
- Cookies: small files stored in your browser. Essential ones run the cart, checkout and login. Optional ones record the visit source above and are only set if you accept them in the cookie banner. See section 8.
2. Why we collect it
- To process and ship your order.
- To send you order updates (dispatch, delivery, returns).
- To respond to your questions.
- To improve the Site (which pages get used, where people leave).
- To comply with tax and accounting laws (we keep invoices for 7 years).
- To send marketing emails, but only if you opt in. You can unsubscribe from any marketing email in one click.
3. Who we share it with
We don’t sell your data. We share it with:
- Payment providers (the methods shown at checkout) to process your payment. We never see or store full card numbers.
- Couriers (<COURIERS>) to deliver your order, they get your name, phone, and address.
- Email service (our email provider) to send you order updates and, only if you opted in, marketing emails.
- Hosting (<HOSTING_PROVIDER>), the servers that run the Site.
- Government, if legally required (tax audit, court order).
4. How long we keep it
- Order data + invoices: 7 years (<TAX_RETENTION_BASIS>).
- Account data: until you delete your account, then purged within 30 days (except order records, which stay 7 years).
- Marketing list: until you unsubscribe.
- Analytics: 14 months (Google’s default for GA4).
5. Your rights
- Access: ask what data we have on you.
- Correct: ask us to fix wrong data.
- Delete: ask us to delete your account and non-required data.
- Stop marketing: one click in any marketing email.
- Withdraw consent: anytime, for any optional processing.
- Lodge a complaint: with Singapore’s PDPC <ADD_OTHER_REGULATOR>.
To exercise any of these, email hello@joandrew.com.sg. We respond within 14 days.
6. International transfers
Some of our service providers (Stripe, Google) are based outside <REGISTRATION_COUNTRY>. When you use the Site, your data may be transferred to and processed in the US, EU, or other countries. These providers are bound by their own privacy policies and data-handling standards.
7. Security
We use SSL encryption (HTTPS) on every page. Payment data is handled by PCI-DSS compliant gateways. Account passwords are hashed (never stored in plain text). Access to customer data is restricted to staff who need it (mostly Teresa Kong, the owner, and our part-time fulfilment helper).
8. Cookies and browser storage
When you first visit, a banner asks whether you accept optional cookies. You can change your choice at any time with the “Cookie settings” link in the footer. Declining does not affect shopping.
| Name | Type | Purpose | Kept for |
|---|---|---|---|
| woocommerce_cart_hash, woocommerce_items_in_cart, wp_woocommerce_session_* | Essential | Remember what is in your cart and run checkout | Up to 2 days |
| wordpress_logged_in_*, wordpress_sec_* | Essential | Keep you signed in to your account | Until you sign out, or up to 14 days if you tick “Remember me” |
| ja_consent | Essential | Remember your cookie choice | 6 months |
| ja_fx_rates_cache (browser storage, not a cookie) | Functional | Store exchange rates for the currency switcher; never sent to us | Until rates refresh |
| sbjs_first, sbjs_current, sbjs_session, sbjs_udata, sbjs_first_add, sbjs_current_add, sbjs_migrations | Optional (only with your consent) | WooCommerce order attribution: records the source of your visit so we know which channels lead to orders | Session to 6 months |
The site also loads fonts from Google Fonts, which means your browser connects to Google’s servers to download them. Google receives your IP address for this but no cookies are set.
9. Children’s data
The Site is for adults. We don’t knowingly collect data from anyone under 18. If you’re a parent and your child created an account, email us and we’ll delete it.
10. Changes to this policy
Material changes get a 30-day notice (email or banner). The “last updated” date at the top tells you when the most recent change was made.
11. Contact
Privacy questions: hello@joandrew.com.sg. We treat every privacy request as priority.