Effective 28 October 2026
Unicorn Pack Pte. Ltd. (UEN 202416833G), 138 Robinson Road, #02\-54, Oxley Tower, Singapore 068906, is the controller of personal data collected through unicornpack.com, our accounts and Design Studio, our quotation and order process and our customer support ("we", "us").
Version 1.0. Effective from 28 October 2026. Previous versions are available on request.
This Policy applies to visitors, account holders, customers and their staff and contacts, and anyone who contacts us. If you are a business customer, the personal data of your employees and contacts is protected in the same way. Content you upload may contain personal data of other people; you are responsible for having the right to use it (Terms of Use, section 4).
| Category | Examples | Source |
|---|---|---|
| Account and company data | name, email, phone, password (hashed), company name and role, company membership and invitations you send to colleagues, account settings, market preference | you |
| Order and delivery data | products, quantities, artwork versions, delivery and billing addresses, recipient name and phone, business tax number if you provide one, order history, invoices | you |
| Quote requests | product and sea\-freight quote forms, and files you attach to them (PDF, JPG, PNG or ZIP) | you |
| Uploaded content | artwork, logos, text and files you upload or create in the Design Studio, including any personal data they contain | you |
| Payment data | payment confirmation, last four digits and card type, transaction ID. Full card details are entered directly into Stripe's secure checkout and never reach our servers | you via Stripe |
| Declarations and evidence | checkout declarations, waivers, approvals, with time stamps, IP address and device identifiers | generated when you act on the Site |
| Support communications | contact and support forms, emails, complaint evidence such as photos | you |
| Device and usage data | IP address, browser and device type, pages requested, referring page, first\-party cookie identifiers, server logs | collected automatically (section 5) |
| Purpose | Data | Legal basis (where required) |
|---|---|---|
| Creating your account, quoting, taking and fulfilling orders, manufacturing, delivery, invoicing | account, order, quote, uploaded content, payment | performance of a contract |
| Artwork review, intellectual\-property screening and fraud prevention | uploaded content, declarations, device data | legitimate interests (protecting rights holders, preventing fraud); legal obligations |
| Customer support and handling complaints, returns and refunds | support communications, order data | contract; legitimate interests |
| Keeping records of orders, approvals and declarations as evidence | declarations, order data | legitimate interests (establishing and defending legal claims); legal obligations (tax and accounting) |
| Site security, monitoring and improvement | device and usage data | legitimate interests |
| Marketing emails about our products | contact data, order history | consent (opt\-in); you can withdraw at any time |
| Complying with law, sanctions screening, responding to lawful requests | any | legal obligation |
We do not sell your personal data, and we do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. Fraud screening on payments is performed by Stripe under its own policies.
Strictly necessary (no consent needed). Our store platform sets first\-party cookies to keep you logged in, remember your cart, your market and the company you are acting for, and to serve pages quickly:
| Cookie | Purpose | Lifetime |
|---|---|---|
_medusa_jwt | keeps you logged in | 7 days |
_medusa_cart_id | remembers your cart | 7 days |
up_market_preference | remembers your market and currency | 7 days |
up_active_company_id | remembers which company account you are acting for | 7 days |
_medusa_cache_id | page caching | 1 day |
The Design Studio also keeps draft settings, your canvas and, for guests, up to 12 uploaded files (1 MB in total) in your browser's local storage so you do not lose work; this stays on your device until you save, clear it or it is replaced. Stripe sets its own cookies on the checkout page for payment security and fraud prevention.
Fonts, icons and images from third parties. Some icon and font files used on the Site are loaded from Google (Google Fonts and Material Symbols), and some images are temporarily served from a third\-party content network (Anima). When your browser requests those files, the provider receives your IP address, browser type and the address of the page you are on. We are moving these files to our own servers.
Analytics and advertising. We do not currently use analytics, advertising, chat or session\-recording tools. If we add any in future, we will ask for your consent first and provide a cookie\-settings link in the footer to withdraw it.
We share personal data only as needed for the purposes above, with:
We do not currently use any external tax, analytics, chat or CRM service. Currency rates are fetched from a public exchange\-rate service without any personal data.
Our systems are hosted in the European Union (Frankfurt). Your data is accessed by our team in Singapore, and shared with recipients in China (production and delivery), the United States (Stripe; and Customer.io unless configured for EU processing) and, for deliveries, the country of the recipient. Where your data originates in the EEA or the UK and is transferred to a country without an adequacy decision, we rely on Standard Contractual Clauses approved by the European Commission (and the UK International Data Transfer Addendum), with supplementary measures where needed, or on your explicit consent where the law allows. Australian and New Zealand customers: we are likely to disclose your data to recipients in Singapore, China, the United States and the European Union as described above.
| Data | Retention |
|---|---|
| Account | while your account is active; deleted on request, or after 3 years without any login or order, after we email you first |
| Abandoned carts | 90 days |
| Orders, invoices, payment records and checkout declarations | up to 10 years after the transaction, as required by tax, accounting and limitation laws in the countries we sell to |
| Ordered (locked) designs and approval evidence | 6 years after the last order using them, kept with the order record for reorders and as evidence of what was approved |
| Un\-ordered designs and uploaded assets | until you delete them in your account, or 24 months after your last activity |
| Quote requests and attached files | 24 months after the quote is closed |
| Support communications | 3 years after the case is closed; correspondence about a dispute, claim or chargeback is kept with the order record |
| Marketing consent records | while you are subscribed, plus proof of consent and withdrawal for 3 years |
| Server logs | access logs 90 days (or the minimum our hosting provider allows); security logs and incident records 12 months |
Until deletion is automated, we review stored data against this schedule every quarter. A recorded legal hold may suspend deletion of specific records while a dispute, chargeback or legal request is open. Backups are retained by our hosting provider for a limited period and then overwritten. When the retention period ends we delete or anonymise the data.
We protect your data with encryption in transit, access controls, logging and staff confidentiality obligations. Payments are processed by Stripe, a PCI DSS Level 1 provider. Artwork files are shared with production partners only through expiring links. No system is completely secure; tell us at privacy@unicornpack.com if you suspect a problem with your account.
Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal data, to restrict or object to its processing, to withdraw consent, and to complain to a supervisory authority. To exercise a right, email privacy@unicornpack.com from the address on your account or provide other proof of identity. We respond within one month (or the shorter period required by local law) and do not charge a fee unless requests are manifestly unfounded or excessive. You can delete un\-ordered designs and uploaded assets yourself in your account; to delete your account, email us. Some data must be kept despite a deletion request, for example order and invoice records required by tax law or evidence needed for an open dispute, chargeback or legal claim; in that case we restrict it to those purposes and tell you what we kept and why.
The Site is for businesses and adults and is not directed to children; we do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it.
We may update this Policy. We post the new version with its effective date and notify registered customers of material changes by email or on the Site.
If you are in the EEA or the UK, the GDPR or UK GDPR applies. Our legal bases are listed in section 4. You have the rights of access, rectification, erasure, restriction, data portability and objection, and the right to withdraw consent at any time without affecting prior processing. You may complain to your local supervisory authority (in the UK, the Information Commissioner's Office). Transfers outside the EEA/UK are described in section 7. Non\-essential cookies are set only with your consent (section 5).
We handle personal information in accordance with the Australian Privacy Principles and the New Zealand Privacy Act 2020 to the extent they apply to us. We are likely to disclose your personal information to overseas recipients in Singapore, China, the United States and the European Union (section 6). You may request access to or correction of your personal information via privacy@unicornpack.com; if you are not satisfied with our response you may complain to the Office of the Australian Information Commissioner or the New Zealand Office of the Privacy Commissioner. We will notify affected individuals and the regulator of eligible data breaches as required. We do not use your personal information to make automated decisions that significantly affect you.
We do not sell or share personal information for cross\-context behavioural advertising and do not use it for targeted advertising. Residents of states with consumer privacy laws may have rights to access, delete, correct and obtain a copy of their data and to opt out of certain processing; contact privacy@unicornpack.com and we will honour requests as required by the law that applies to you. We do not respond to "Do Not Track" signals. We do not knowingly collect data from children under 13.
We comply with the Personal Information Protection and Electronic Documents Act and applicable provincial law. Your data may be processed outside Canada, including in the European Union, Singapore, China and the United States, where it may be accessible to the authorities of those countries under their laws. You may withdraw consent, subject to legal and contractual restrictions, and may complain to the Office of the Privacy Commissioner of Canada. Quebec residents: the person in charge of the protection of personal information is our Data Protection Officer, privacy@unicornpack.com.
We comply with the Personal Data Protection Act 2012. Our Data Protection Officer can be reached at privacy@unicornpack.com. Transfers outside Singapore are made only where the recipient is bound by legally enforceable obligations to provide a comparable standard of protection. You may complain to the Personal Data Protection Commission.
