Overview & Scope of Policy
This Privacy Policy applies to the Peppermeal multi-restaurant food ordering platform, mobile web interfaces, digital menus, QR table ordering web applications, and standalone whitelabel merchant storefronts operated by Bellpepper Pte. Ltd. (“we”, “us”, or “our”).
By using our digital marketplace, scanning restaurant on-table QR codes, placing takeaway or delivery orders, or registering an account, you acknowledge and consent to the collection, use, disclosure, and processing of your Personal Data in accordance with this Policy and the Singapore Personal Data Protection Act 2012 (PDPA).
Personal Data We Collect
We only collect personal data that is reasonably necessary to fulfill your dining orders, reservations, and customer account services. This includes:
- Identity & Contact Details: Your full name, Singapore mobile phone number (+65), email address, date of birth (for birthday milestone vouchers), and profile avatar if uploaded.
- Delivery & Location Information: Saved delivery addresses, postal codes (6-digit Singapore postal codes), floor/unit numbers, delivery gate codes, and delivery instructions.
- Dining & Order History: Specific food item preferences, customization options (e.g. spice level, ice level), dietary allergy notes provided to chefs, table numbers for on-table dining, and reservation booking details.
- Loyalty & Stored Value: E-wallet balances, loyalty points earned and redeemed, digital stamp card stamps, and promotional coupon codes claimed.
- Device & Telemetry Data: IP address, browser type, operating system, network connection type, and anonymous session telemetry used strictly to optimize page speeds and prevent automated fraud.
Purpose of Data Processing
We collect and process your personal data for the following legitimate purposes:
- Fulfilling Orders & Kitchen Preparation: Transmitting order items, dietary notes, and customer names to restaurant kitchen display systems (KDS) and chef stations.
- Table Reservations: Confirming table availability, seating party sizes, and notifying restaurant hosts.
- Payment Verification: Facilitating Singapore PayNow SGQR payment handshakes and tokenized Stripe credit/debit card transactions.
- Delivery Dispatch: Sharing recipient name, contact number, and delivery address with assigned delivery riders.
- Customer Support: Resolving refund requests, order discrepancies, or lost items.
- Legal Compliance: Complying with Singapore tax obligations (e.g., 9% GST invoice tracking with the Inland Revenue Authority of Singapore - IRAS).
Cloud WhatsApp Messaging & Communications
Peppermeal integrates with the official Meta Cloud WhatsApp Business API to provide real-time dining communications.
- Transactional Updates: Order confirmations, food ready notices, table reservation passes, and rider live tracking links.
- Two-Way Customer Support: Real-time messaging with restaurant support staff.
- Marketing Opt-In: Promotional vouchers and spend milestone rewards are only dispatched to diners who have actively opted in.
- Easy Opt-Out: You can unsubscribe from promotional WhatsApp messages at any time by replying
STOPor toggling notifications in your customer profile.
Payment Processing & Financial Security
Your financial security is protected with industry-leading safeguards:
- No Storage of Raw Card Data: Peppermeal does not store full 16-digit credit card numbers, CVVs, or bank account PINs on our application servers.
- Tokenized Stripe Gateway: All card payments are processed directly through Stripe Payments Singapore Pte. Ltd., certified as a PCI-DSS Level 1 Service Provider (the highest security grade in the payment industry).
- PayNow SGQR: Real-time Singapore PayNow QR transfers are generated dynamically using official Singapore banking standards with automated transaction reference validation.
Data Sharing & Third-Party Disclosures
We only disclose your personal data to trusted service partners under strict confidentiality agreements:
- Partner Restaurants: The specific restaurant fulfilling your meal receives your name, table/delivery details, and allergen notes to prepare your order.
- Delivery Couriers: Delivery personnel receive only the minimum information necessary to execute delivery (name, address, delivery instructions, contact number).
- Cloud & Infrastructure Providers: Secure database servers, binary media storage, and Meta Graph API gateways operating under ISO/IEC 27001 security standards.
- Law Enforcement & Regulators: When required by Singapore law, court order, or governmental authorities.
Cookies & Local Storage
We use cookies and local storage tokens strictly to ensure application functionality:
- Essential Session Cookies: Maintain your active login state and CSRF security validation tokens.
- Cart & Table State: Preserve your food cart items and table number selection while browsing restaurant menus.
- Preference Cookies: Store dark/light theme choices and language preferences.
You can manage or disable cookies via your browser settings, though certain interactive ordering features may require cookies to function properly.
Data Retention & Storage
We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable laws in Singapore (such as maintaining accounting records for 5 years under the Singapore Companies Act and GST Act).
When personal data is no longer required, it is irreversibly anonymized or securely purged from our active MySQL databases and backup systems.
Your Rights Under the Singapore PDPA
As a user of Peppermeal in Singapore, you possess statutory rights regarding your personal data:
- Right to Access: Request a copy of the personal data we hold about you and how it has been used.
- Right to Correction: Request the correction of any inaccurate or incomplete personal data.
- Right to Withdraw Consent: Withdraw consent for marketing communications or optional analytics processing.
- Right to Erasure / Account Deletion: Request the closure of your account and deletion of your saved customer profile.
Security Safeguards
We employ rigorous administrative, physical, and technical safeguards to prevent unauthorized access, collection, disclosure, copying, or alteration of your personal data:
- Strict role-based access control (RBAC) preventing unauthorized cross-store data leakage.
- Encrypted database connections and binary streaming endpoints.
- Regular security audits, automated vulnerability testing, and secure session invalidation.
Data Protection Officer (DPO) Contact
If you have any questions, feedback, or requests regarding this Privacy Policy or wish to exercise your rights under the PDPA, please contact our designated Data Protection Officer (DPO):
