LITTLE FARMS PTE LTD

DATA PROTECTION NOTICE

Effective Date: 14 May 2026     Last Updated: 14 May 2026

This Data Protection Notice ("Notice") sets out the basis on which Little Farms Pte Ltd ("we", "us", or "our") may collect, use, disclose, or otherwise process personal data of our customers in accordance with the Personal Data Protection Act 2012 (No. 26 of 2012), as amended ("PDPA"), and all subsidiary legislation and advisory guidelines issued by the Personal Data Protection Commission ("PDPC") thereunder.

 

This Notice applies to personal data in our possession or under our control, including personal data processed by organisations we have engaged to collect, use, disclose, or process personal data on our behalf.

In this Notice:

 

"customer" means an individual who (a) has contacted us through any means to find out more about any goods or services we provide, or (b) may, or has, entered into a contract with us for the supply of any goods or services by us; and

 

"personal data" means data, whether true or not, about a customer who can be identified: (a) from that data; or (b) from that data and other information to which we have or are likely to have access.

 

Other terms used in this Notice shall have the meanings given to them in the PDPA where the context so permits.

Depending on the nature of your interaction with us, personal data we may collect from you includes:

 

•  Name, NRIC/FIN, passport number, or other identification information;

•  Contact information such as address, email address, or telephone number (including mobile number);

•  Nationality, gender, date of birth, and marital status;

•  Photographs and other audio-visual information;

•  Employment information;

•  Financial information such as credit card, debit card, or bank account information;

•  Purchase history, transaction data, and loyalty programme activity;

•  Communication preferences, including consent to receive messages via email, SMS, and WhatsApp (or other over-the-top messaging platforms); and

•  Any other personal data you voluntarily provide to us.

 

We do not collect your NRIC number or a copy of your NRIC unless such collection is required or authorised by law, or where it is necessary to accurately establish or verify your identity to a high degree of fidelity (e.g. for age-restricted purchases), consistent with the PDPC’s Advisory Guidelines on the PDPA for NRIC and Other National Identification Numbers.

We generally do not collect your personal data unless:

 

(a)  it is provided to us voluntarily by you directly or via an authorised representative, after you (or your authorised representative) have been notified of the purposes for which the data is collected and have provided consent to its collection and use for those purposes; or

(b)  collection and use of personal data without consent is permitted or required by the PDPA or other applicable laws.

 

We shall seek your consent before collecting any additional personal data or using your personal data for a purpose not previously notified to you, except where permitted or authorised by law.

 

We may collect and use your personal data for any or all of the following purposes:

 

(a)  performing obligations in the course of or in connection with our provision of the goods and/or services requested by you;

(b)  verifying your identity;

(c)  responding to, handling, and processing queries, requests, applications, complaints, and feedback from you;

(d)  managing your relationship with us, including administration of our Avocado Club loyalty programme and related member benefits;

(e)  processing payment or credit transactions;

(f)  sending you marketing information about our goods or services — including promotions, events, lucky draws, membership and rewards schemes, and new product launches — via channels for which you have provided consent, which may include email, SMS, WhatsApp, and other messaging platforms;

(g)  administering and improving our e-commerce website (littlefarms.com) and digital channels;

(h)  conducting analytics and research to improve our products, services, and customer experience;

(i)  complying with any applicable laws, regulations, codes of practice, guidelines, or rules, or to assist in law enforcement and investigations conducted by any governmental and/or regulatory authority;

(j)  any other purposes for which you have provided the information; and

(k)  any other incidental business purposes related to or in connection with the above.

 

We may disclose your personal data to:

 

(a)  third party service providers and agents engaged to perform functions listed above on our behalf (e.g. fulfilment, logistics, payment processing, customer relationship management, and marketing technology platforms);

(b)  relevant governmental and/or regulatory authorities, whether in Singapore or abroad, where required by law; and

(c)  any successor entity or acquirer in the event of a restructuring, merger, or acquisition of our business.

 

The purposes listed in the above clauses may continue to apply even after your relationship with us has been terminated or altered, for a reasonable period thereafter (including, where applicable, a period to enable us to enforce our rights under any contract with you).

Where you have provided your mobile telephone number to us and have given separate, explicit consent, we may send you marketing communications via:

 

•  SMS (text messages);

•  WhatsApp messages (via the WhatsApp Business Platform or equivalent); and

•  Other over-the-top (OTT) messaging platforms,

 

containing promotions, product updates, event invitations, and other marketing content relating to Little Farms goods and services.

 

Consent to receive mobile marketing messages (including WhatsApp) is:

 

•  Separate from, and not a condition of, your purchase of goods or services from us;

•  Obtained through a clear, affirmative opt-in mechanism (e.g. a tick-box on our registration, loyalty sign-up, or checkout form that is not pre-ticked); and

•  Documented and retained by us as required under the PDPA.

 

Before sending any marketing message to a Singapore telephone number (whether by SMS, voice call, fax, or WhatsApp), we will check the national Do Not Call (DNC) Registry, unless you have given us clear and unambiguous consent to receive such messages notwithstanding your registration on the DNC Registry. We will maintain records of such consent checks.

 

You may opt out of marketing messages at any time by:

 

•  Replying STOP (or the equivalent opt-out keyword) to any SMS or WhatsApp message we send you;

•  Clicking the unsubscribe link in any marketing email from us;

•  Contacting our Data Protection Officer at the details in Section 10 below; or

•  Updating your communication preferences in your online account at littlefarms.com.

 

Once we receive your opt-out request, we will cease sending the relevant type of marketing messages within a reasonable period and will not charge any fee for processing your opt-out.

The consent you provide for the collection, use, and disclosure of your personal data remains valid until you withdraw it in writing. You may withdraw consent and request us to stop using and/or disclosing your personal data for any or all of the purposes listed in Section 3 above by submitting your request in writing to our Data Protection Officer at the contact details in Section 10.

 

Upon receipt of your written request to withdraw consent, we may require reasonable time (depending on the complexity and impact of the request) to process it and to notify you of the consequences, including any legal consequences that may affect your rights and liabilities to us. We will generally seek to process requests within ten (10) business days.

 

Whilst we respect your decision, please note that depending on the nature and scope of your request, we may not be in a position to continue providing goods or services to you, and we will notify you before completing the processing of your request. Should you decide to cancel your withdrawal of consent, please inform us in writing at the contact details in Section 10.

 

Withdrawal of consent does not affect our right to continue to collect, use, and disclose personal data where such collection, use, and disclosure without consent is permitted or required under applicable laws.

You have the right to:

 

•  Request access to a copy of the personal data we hold about you, or information about the ways in which we use or disclose your personal data; and

•  Request that we correct or update any personal data we hold about you that is inaccurate, incomplete, or misleading.

 

You may submit such requests in writing or by email to our Data Protection Officer at the contact details in Section 10. Please note that a reasonable fee may be charged for access requests. If so, we will inform you of the fee before processing your request.

 

We will respond to your request as soon as reasonably practicable. Should we be unable to respond within thirty (30) days of receiving your request, we will inform you in writing of the date by which we expect to respond. Where we are unable to provide the personal data or make the correction requested, we will generally inform you of the reasons (except where we are not required to do so under the PDPA).

We have implemented appropriate administrative, physical, and technical security measures to protect personal data from unauthorised access, collection, use, disclosure, copying, modification, disposal, or similar risks. These measures include, but are not limited to, up-to-date antivirus protection, encryption, and the use of privacy filters to secure storage and transmission of personal data. Personal data is disclosed internally and to authorised third-party service providers and agents only on a need-to-know basis.

 

In the event of a data breach that is notifiable under the PDPA (i.e. one that results, or is likely to result, in significant harm to affected individuals, or that affects 500 or more individuals), we will:

 

•  Notify the PDPC within three (3) calendar days of determining that the breach is notifiable; and

•  Notify affected individuals as soon as practicable where the breach is likely to result in significant harm to those individuals.

 

While we strive to protect your personal data, no method of transmission over the Internet or electronic storage is completely secure. We continuously review and enhance our information security measures.

We generally rely on personal data provided by you or your authorised representative. To ensure that your personal data is current, complete, and accurate, please update us if there are changes to your personal data by informing our Data Protection Officer in writing or by email at the contact details in Section 10.

We retain personal data for as long as it is necessary to fulfil the purposes for which it was collected, or as required or permitted by applicable laws. We will cease to retain personal data, or remove the means by which the data can be associated with you, as soon as it is reasonable to assume that such retention no longer serves the purposes for which the data was collected and is no longer necessary for legal or business purposes.

We generally do not transfer your personal data to countries or territories outside Singapore. Where we do so, we will comply with the Transfer Limitation Obligation under the PDPA, including ensuring that the recipient organisation provides a standard of protection for the personal data that is at least comparable to that under the PDPA (e.g. by putting in place contractual arrangements, such as data transfer agreements based on the ASEAN Model Contractual Clauses, or by transferring to a country on the PDPC’s approved list). Where required, we will also seek your consent.

We have appointed a Data Protection Officer (DPO) who is responsible for overseeing our compliance with the PDPA and this Notice. You may contact our DPO if you have any enquiries or feedback on our data protection policies and procedures, or if you wish to make any request:

 

Data Protection Officer:   Adeline Koh

Email Address:                  info@littlefarms.com

Postal Address:               Little Farms Pte Ltd, Singapore

This Notice applies in conjunction with any other notices, contractual clauses, and consent clauses that apply in relation to the collection, use, and disclosure of your personal data by us.

 

We may revise this Notice from time to time without prior notice. You may determine whether any revision has taken place by referring to the date on which this Notice was last updated (shown at the top of this Notice). Your continued use of our services constitutes your acknowledgement and acceptance of such changes.