Privacy Policy

We collect personal data only when you interact with our platform. The categories of data we hold are:

Identity and contact data

• Name, phone number, and email address — provided when you submit an enquiry form, request a valuation, or create an account.
• Vehicle interest data — the make, model, price range, or listing you expressed interest in, captured with every enquiry.

Usage and technical data

• Browser type, operating system, and device category.
• Pages visited, search queries entered, and features used on 360carmart.com.
• IP address and approximate geographic region (country / city level only).

What we do not collect

We do not collect NRIC numbers, passport details, financial account credentials, or any sensitive personal data as defined under the PDPA unless explicitly required for a specific regulated service (such as a loan application initiated by you) and disclosed separately at that point.

We use your personal data for the following purposes, each of which we rely on a lawful basis under the PDPA:

We do not use your personal data for profiling, automated decision-making with legal effect, or targeted advertising on third-party ad networks.

We do not sell, rent, or trade your personal data. We disclose it only in the following limited circumstances:

Verified dealers (on enquiry)

When you submit an enquiry on a listing, your name, phone number, email address, and vehicle interest are shared with the specific dealer who holds that listing. Dealers are bound by our Dealer Agreement, which prohibits them from using your data for any purpose other than responding to your enquiry. They may not pass your data to any other party.

Service providers (data processors)

We engage third-party processors who act solely on our instructions and are contractually prohibited from using your data for their own purposes:

• Supabase Inc. — cloud database and storage infrastructure hosted on AWS ap-southeast-1 (Singapore region). Supabase processes personal data as a data processor under a Data Processing Agreement with 360CarMart.
• Vercel Inc. — edge hosting for the web application. Request logs are retained for up to 30 days.
• PostHog Inc. — product analytics. Data is self-hosted or EU-hosted; user IDs are pseudonymous.

Legal and safety disclosures

We may disclose personal data to law enforcement, regulators, or courts where required by Singapore law or a valid legal order, or where necessary to protect the safety of any person.

No third-party advertising networks

We do not share your data with Facebook, Google Ads, programmatic ad exchanges, or any other ad-tech intermediary for the purpose of targeted advertising.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, and loss:

• Transport encryption — all data in transit between your browser and our servers is encrypted via TLS 1.2 or higher.
• At-rest encryption — database volumes are encrypted at rest using AES-256.
• Access controls — dealer portal access requires verified dealer credentials. Internal staff access to personal data is restricted by role and logged.
• Data minimisation — we collect only what is necessary for each stated purpose and delete data when it is no longer needed.
• Retention — enquiry contact data is retained for 12 months after your last interaction, after which it is deleted or anonymised. Account data is retained while your account is active.

No transmission over the internet is completely secure. In the unlikely event of a data breach that is notifiable under the PDPA, we will inform the Personal Data Protection Commission (PDPC) and affected individuals within the timeframes required by law.

Under the Singapore Personal Data Protection Act 2012 and its amendments, you have the following rights in relation to personal data we hold about you:

Right of access

You may request a copy of the personal data we hold about you, and information about how it has been used or disclosed in the past year.

Right of correction

You may request that we correct any personal data that is inaccurate or incomplete. We will make the correction within 10 business days and, where reasonable, notify the parties to whom we have previously disclosed the data.

Right to withdraw consent

Where we rely on your consent to process personal data (for example, for optional marketing emails), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. Withdrawing consent for core service communications (such as enquiry receipts) may limit our ability to provide the service to you.

Right to data portability

Under the PDPA's data portability obligation, you may request that we transmit certain personal data you have provided to us directly to another organisation in a commonly used machine-readable format, where technically feasible.

How to exercise your rights

Submit your request by email to privacy@360carmart.com. We will verify your identity before processing the request and respond within 10 business days. Some requests (such as large access requests) may require up to 30 days; we will notify you if this applies.

If you are unsatisfied with our response, you may lodge a complaint with the Personal Data Protection Commission (PDPC).

We use cookies and similar local storage technologies to make the site function and to understand how it is used.

We do not use advertising cookies, third-party tracking pixels, or any technology designed to follow you across other websites. We do not place cookies for retargeting or behavioural profiling purposes.

For any questions, access requests, correction requests, or complaints regarding our handling of personal data, please contact our Data Protection Officer:

This policy may be updated from time to time. Material changes will be announced on this page with a revised “Last updated” date. Continued use of 360CarMart after a policy update constitutes acceptance of the revised terms, to the extent permitted by applicable law.