Privacy
Privacy policy
Last updated 4 November 2026
In short
- A shop's data belongs to the shop. We look after it for them and use it only to run Sunwin One.
- We don't sell personal data, and we don't use it for advertising.
- Card numbers never reach us: the card payment provider takes the card. We keep only the card type and last four digits for the receipt.
- The cloud copy of a shop's data is stored in Singapore.
- This website uses no cookies and keeps no IP addresses.
1. This website
Visit statistics, with no personal data. We count page views, how far down the page visitors scroll, clicks on “Book a demo”, the kind of device (phone, tablet or computer), the website that linked to us and campaign tags in the link. Each browser tab gets a random number that is forgotten when the tab closes. We don't use cookies, don't record IP addresses and send nothing when your browser asks sites not to track.
When you contact us. If you send the “Book a demo” form, email or WhatsApp us, we keep your name, business, contact details and message to reply, arrange a demo or send a quote, and delete them when they're no longer needed for that. Form requests are stored with our cloud hosting provider in Singapore and emailed to our sales inbox.
2. Sunwin One: who is responsible
When a business (a café, restaurant, shop or salon: “the shop”) uses Sunwin One, the shop decides what to record about its customers and staff and is responsible for it under the PDPA. Sunwin processes that data on the shop's behalf, as a data intermediary, only to provide Sunwin One. If you are a customer or employee of a shop and want to see, correct or delete your data, please ask the shop; we help them answer you.
For the shop's own account with us (the owner's name, email, phone, billing and licence), Sunwin is responsible.
3. What Sunwin One keeps
| What | Details |
|---|---|
| Sales | Orders, items, prices, discounts, tax, tips, refunds, voids, payments, closing reports and cash drawer counts. |
| Card payments | Taken by the shop's card payment provider on the shop's own account. We keep the card type and last four digits (e.g. Visa •••• 4242) and the payment reference, to print receipts and give refunds. Card numbers, expiry dates and security codes never reach Sunwin. |
| PayNow | The app shows a QR code with the shop's PayNow number and the amount. No bank details of the person paying reach Sunwin. |
| The shop's customers (only for the features the shop uses) | Loyalty: mobile number, name, optional email, notes, whether they agreed to marketing, points and visits. Bookings: name, mobile, services and time. Gift cards and packages: balance, and a name or mobile if given. Pre-orders: name, mobile, pickup time and deposits. QR orders at a table: the order and, if the guest gives it, a mobile number. |
| Staff | Name, username, role, optional photo, PIN (stored only in a form that can't be turned back into the PIN), hourly rate and commission rate if set, clock-in times, and a history of sign-ins on the tablets. |
| Menu and stock | Items, prices, photos, recipes, stock levels, suppliers and purchase orders. |
| The tablets | A device identifier (so a reinstall keeps its licence), the device model and app version, and error reports when the app has a problem (what went wrong and where, the app version and device model) so we can fix it. |
| The owner's account | Name, email, password (never visible to us), business details, licence and subscription. |
Receipts sent by WhatsApp or email go from the shop's own WhatsApp or email app on the tablet. Sunwin doesn't send them or keep a copy of the message.
4. Where it is kept
Everything is kept on the shop's tablets, so the till works without the internet. When a tablet is linked to the cloud, a copy is kept with our cloud hosting provider in Singapore: the shop's tablets share the same data, the owner portal works, and nothing is lost if a tablet breaks. Tablets also keep their own backups and send one to the cloud every day.
5. Who helps us run it
Like most software companies, we use a small number of carefully chosen service providers, each only for its job and under a written agreement that protects the data:
| Provider | What for |
|---|---|
| Cloud hosting (Singapore) | Storing the cloud copy of a shop's data, sign-in and backups |
| The shop's card payment provider | Card payments: contactless, card readers and online payment for QR orders. The shop opens its own account with the provider and agrees to the provider's terms. |
| Email and messaging delivery | Sending the daily sales report to the email addresses and WhatsApp numbers the owner chooses |
| Website and email hosting | Running this website and our business email |
| App stores | Delivering the app and its updates |
Some of these providers handle data outside Singapore. When they do, we make sure it is protected to a standard comparable to the PDPA, as the PDPA requires. Shops can ask us for the current list of providers at support@sunwin.sg.
6. How we use it
- To run Sunwin One for the shop: sales, receipts, reports, sync between tablets, backups and the owner portal.
- To give support, fix problems and keep the service secure.
- To bill the shop and manage its licence.
- To tell the owner about important changes: updates, security and the subscription.
We don't use a shop's customer or staff data for our own marketing, and we don't sell it. Sunwin staff look at a shop's data only when needed to support that shop or keep the service running.
7. Keeping it safe
- Each business can reach only its own data.
- Data travels encrypted between the tablets, the cloud and the owner portal.
- Staff sign in with their own PIN, and PINs are never stored in readable form. Repeated wrong PINs lock sign-in for a while.
- A lost or replaced tablet can be cut off from the business's data straight away.
- Copies of the data are made regularly and before every app update, so a fault doesn't lose sales.
If a data breach affects a shop's data, we tell the shop without undue delay so it can decide whether to notify the Personal Data Protection Commission and the people affected, and we help it do so.
8. How long we keep it
- While the subscription runs, for as long as the shop uses it. The shop can delete records on its tablets.
- Cloud backups: the 14 most recent for each tablet. Backups on the tablet itself are thinned out over time and kept for up to 12 months.
- When the subscription ends, the shop's cloud data is kept for 60 days, so the shop can come back or ask for a full export (spreadsheets and a backup file). After that it is erased from our systems. Copies on the shop's own tablets stay with the shop.
- If a shop asks us to delete its business, it is locked at once and erased after 7 days (the 7 days let a mistake be undone).
- Error reports: only while we need them to fix the problem. Website visit statistics contain no personal data.
- Billing records: as long as Singapore law requires (generally 5 years).
9. Your choices
You can ask to see the personal data we hold about you, ask us to correct it, or withdraw your consent to its use. Shops can ask for an export of all their data at any time. If you are a shop's customer or employee, please ask the shop first (section 2); we help them answer you.
Write to our data protection officer at support@sunwin.sg. We reply within 30 days. If you're not happy with our answer, you can contact the Personal Data Protection Commission at pdpc.gov.sg.
10. Children
Sunwin One is a tool for businesses. It isn't meant for children, and we don't knowingly collect their data.
11. Changes
When we change this policy we update the date at the top, and for important changes we tell shop owners by email first. See also our terms of service.
Contact
Sunwin Solutions, Singapore · data and customer questions support@sunwin.sg · sales hello@sunwin.sg