Privacy policy generator for restaurants and cafes in Singapore
Singapore's Personal Data Protection Act 2012 applies to every F&B business that collects customer details, from a hawker taking WhatsApp preorders to a restaurant group with an app and a loyalty programme.
The generator below writes a privacy policy built around the PDPA obligations that matter for food businesses: consent, purpose, access and correction requests, protection, retention, transfers abroad and making your Data Protection Officer reachable.
Your privacy policy
Fill in to finish:
- Trading name
- Registered company name
- Business address
- Contact email
Privacy policy
Last updated: 27 October 2026
This policy explains how our business, trading as our business ("we", "us", "our"), collects, uses, shares and protects your personal data when you visit our outlets, order from us, use our website or join our programmes, and the choices and rights you have.
Who we are and how to contact us
- our business, trading as our business
- Address: , Singapore
- Email:
Laws this policy follows
- Personal Data Protection Act 2012 of Singapore
What we collect and why
We only collect what we need. Here is what we collect in each situation, and what we use it for.
When you order from us (online, pickup, delivery or at the table)
What we collect:
- your name, phone number and email address
- your delivery address and any delivery notes
- what you ordered, when, and any special requests
Why we use it:
- to prepare, deliver or hand over your order
- to contact you about your order, for example if an item is unavailable or your rider is on the way
- to issue receipts and handle refunds or complaints
When you pay
What we collect:
- the amount, payment method and payment status
- payment details you enter are handled by our payment provider; we do not see or store your full card number
Why we use it:
- to take payment and issue refunds
- to detect and prevent fraud
- to keep the tax and accounting records the law requires
When you agree to hear from us
What we collect:
- your name, phone number (including WhatsApp) and email address
- what you buy and which messages you open or click, so our offers are relevant
Why we use it:
- to send you promotions, new menu items and event news by WhatsApp, SMS or email
When you visit our website
What we collect:
- cookies and similar technologies on your device
- pages visited, device and browser type, approximate location from your IP address, and how you arrived
Why we use it:
- to make the website work, such as keeping your basket
- with your consent where required, to measure visits and show you relevant ads on other sites (for example Google Analytics and Meta Pixel)
Allergy and dietary information
If you tell us about an allergy or dietary need, we use it only to prepare your food safely, with your consent, and we do not use it for marketing. Please also tell our staff in person: we cannot guarantee that any dish is free from allergens.
Who we share your data with
We do not sell your personal data. We share it only with:
- payment providers that process your payments
- other service providers that host our website, ordering, messaging and IT systems, under contracts that require them to protect your data and use it only for us
- professional advisers, such as accountants, auditors and lawyers
- the police, regulators, courts or other authorities, when the law requires it or to protect our rights, customers or staff
- a buyer or successor, if our business or part of it is sold or reorganised
Transfers outside your country
Some of our service providers store or process data in other countries. When we transfer your personal data abroad, we make sure it receives a comparable level of protection, for example by using providers in countries with adequate data protection laws or by contract terms that require them to protect it.
How long we keep your data
- orders, invoices and payment records: 5 years, because tax and accounting laws require it
- marketing preferences: until you unsubscribe; we keep a record of your opt-out so we do not contact you again
- anything else: only as long as needed for the purpose we collected it for, or as the law requires
How we protect your data
We use reasonable technical and organisational measures to protect your personal data against loss, misuse and unauthorised access, including encrypted connections, access limited to staff who need it, and service providers bound by confidentiality. No system is completely secure, so please keep your account login details private.
If a data breach is likely to put you at risk, we will tell you and the relevant authority as the law requires.
Marketing and how to stop it
We only send marketing messages if you agreed to them or if the law otherwise allows it. You can stop them at any time: use the unsubscribe link in an email, reply STOP to a WhatsApp or SMS message, change your account settings, or contact us. Stopping marketing does not affect messages about your orders.
Cookies
Some cookies are needed for our website to work and cannot be switched off. We only use analytics and advertising cookies with your consent where the law requires it, and you can change your choice at any time in your browser or in our cookie settings.
Your rights
You can:
- ask for access to your personal data in our possession or control, and how it has been used or disclosed in the past year
- ask us to correct an error or omission in your personal data
- withdraw your consent to our collection, use or disclosure of your personal data, on reasonable notice
We will reply as soon as reasonably possible, and within 30 days. If we need longer, we will tell you within those 30 days when we expect to reply.
To use any of these rights, email us at . We may need to confirm your identity before we act on your request. We will not treat you less favourably for using your rights.
Children
Our services are not aimed at children. We do not knowingly collect personal data from children without the consent of a parent or guardian. If you think a child has given us personal data, please contact us and we will delete it.
Complaints
If you are unhappy with how we handled your personal data, please contact us first at so we can try to put it right.
You can also complain to the Personal Data Protection Commission of Singapore (PDPC).
Changes to this policy
We may update this policy from time to time. We will post the new version on this page with a new "Last updated" date, and tell you directly about important changes where the law requires it.
Before you publish
- Read the whole policy and remove anything that does not match what you really do. A policy that describes practices you do not follow is worse than none.
- Have a lawyer qualified in each country you selected review it before you rely on it. This generator is a drafting aid, not legal advice.
- Publish it where customers can find it before they give you data: your website footer, online ordering page, WiFi sign-in page and loyalty sign-up.
- Singapore: designate at least one Data Protection Officer and make their business contact details publicly available (this policy does so if you fill in the DPO fields).
- Singapore: before sending marketing messages to Singapore phone numbers, check them against the Do Not Call Registry unless the customer gave clear consent.
- Singapore: notifiable data breaches must be reported to the PDPC within 3 calendar days of assessing that they are notifiable.
Nothing you type here is sent to or saved by EatsVenture: the policy is put together in your browser. This tool is a drafting aid, not legal advice, and does not guarantee compliance with any law.
What Singapore's PDPA means for your restaurant
Make your DPO reachable
Every organisation must designate at least one Data Protection Officer and make their business contact information publicly available. Fill in the DPO fields and the policy does this for you.
Do Not Call Registry
Before sending promotional calls, SMS or WhatsApp messages to Singapore numbers, check the Do Not Call Registry unless the customer gave clear and unambiguous consent.
30 days to answer
Access and correction requests should be answered as soon as reasonably possible. If you need longer than 30 days, tell the customer within those 30 days.
3 days to report a breach
A notifiable data breach must be reported to the PDPC within 3 calendar days after you assess that it is notifiable.
Privacy policy generator by country
Questions restaurant owners ask
Do Singapore cafes need a privacy policy for a loyalty stamp card?
A paper stamp card with no name does not collect personal data. A digital loyalty programme, or a paper card linked to a phone number, does, so the PDPA applies.
Can I collect NRIC numbers for reservations or loyalty sign-up?
Generally no. The PDPC advises against collecting full NRIC numbers unless the law requires it or it is necessary to establish identity to a high degree of fidelity. A phone number or email is enough for orders and loyalty.
Is this policy enough to comply with the PDPA?
A policy is one part of compliance. You also need internal practices that match it, a DPO, staff who know how to handle requests, and reasonable security. Have the text reviewed by a Singapore lawyer.
Is this privacy policy generator really free?
Yes. There is no sign-up and no watermark. Copy the text or download it as HTML, Markdown or PDF and use it on your own website.
Do you store the details I type in?
No. The policy is put together in your browser. Your business details are not sent to or saved on our servers.
Which countries does it cover?
It has specific clauses for Malaysia (PDPA), Singapore (PDPA), the European Union (GDPR) and the United Kingdom (UK GDPR). You can also select other countries, which get general clauses and a reminder to check local law.
Is the generated policy legal advice?
No. It is a restaurant-specific draft to save you time. Check that it matches what you actually do, and have it reviewed by a lawyer in each country where you operate.
Keep it up to date without thinking about it
EatsVenture runs your own online ordering, loyalty and WhatsApp marketing, with your privacy policy, terms and refund policy filled in from your business details and published on your ordering site.
Talk to us on WhatsApp