Privacy Policy

Who is responsible for your data

This policy applies to incurelab.com and its subdomains, to orders placed through the Site, and to enquiries, quotations and technical support handled by Incure.

The Incure entity responsible for your personal data depends on where you are and which entity you deal with:

Our Data Protection Officer, appointed under section 11(3) of the Singapore Personal Data Protection Act 2012, can be reached at support@uv-incure.com or by post to the Singapore address above, marked for the attention of the Data Protection Officer.

What we collect

We collect personal data directly from you. We do not buy personal data from data brokers and we do not build profiles about you from third-party sources.

We do not seek and do not want sensitive personal data — health information, government identification numbers, biometric data, or information about race, religion, political opinions, trade union membership or sexual orientation. Please do not include such information in an enquiry or in the remarks field at checkout.

Payment data and Stripe

Card payments on incurelab.com are processed by Stripe. When you pay, you are redirected to Stripe Checkout and you enter your card details on a page hosted by Stripe.

Stripe acts as an independent controller of the card data it collects and processes it under its own privacy policy and under the PCI DSS standard. What comes back to us is limited to what we need in order to fulfil and account for the order: confirmation of a successful payment, the amount and currency, the payment method type, the card brand and last four digits, the Stripe payment and charge identifiers, and the name, email, phone number and addresses you entered at checkout.

When Stripe confirms that a payment has succeeded, our system records the order as paid and sends an internal order notification containing those details to our order-processing mailbox so that the order can be picked, packed and shipped. Stripe event records are retained on our server for a limited period so that a payment confirmation is not processed twice.

For Stripe's own handling of your data, see Stripe's privacy policy at stripe.com/privacy.

Why we use your data

Consent and legal basis

Under the Singapore Personal Data Protection Act 2012 we collect, use and disclose personal data:

• with your consent, which you give by placing an order, submitting an enquiry or subscribing;
• on the basis of deemed consent, where you voluntarily provide data for a purpose that is obvious — for example giving us a delivery address so that we can deliver, which necessarily involves passing it to a carrier;
• on the basis of legitimate interests under the First Schedule to the Act, for fraud prevention, network and information security, and the ordinary administration of our business, where we have assessed that this does not have an adverse effect on you that outweighs the benefit; and
• where the Act permits or requires it without consent, including for legal compliance, investigations and proceedings.

Where United States federal or state law applies, we process personal information as necessary to perform our contract with you, to comply with our legal obligations, and for our legitimate business purposes as described in this policy.

We collect only what is reasonable for these purposes, and we will not use your data for a materially different purpose without telling you and, where required, obtaining your consent.

Who we share it with

We share personal data only as set out below, and only to the extent needed:

• Stripe — payment processing, refunds and chargebacks.
• Carriers and freight forwarders — your name, delivery address, phone number and, for dangerous goods, the consignment details, so that delivery can be made and customs cleared.
• Customs authorities and brokers — where required for import or export of your shipment.
• Our hosting and email providers — the Site and our mail are hosted by our web hosting provider; order notifications are delivered through our mail infrastructure.
• Our other group entity — Incure, Inc. and Incure Adhesives Manufacturing Pte Ltd share order and customer information where needed to fulfil an order, provide technical support or maintain a single customer record. See Section 7.
• Professional advisers — accountants, auditors, insurers and lawyers, under a duty of confidence.
• Authorities — where we are required to disclose by law, court order or regulatory demand, or to establish, exercise or defend legal claims.
• A buyer or successor — if we sell or reorganise all or part of our business, customer records may transfer as part of that transaction, subject to equivalent protection.

We require every service provider that handles personal data on our behalf to process it only on our instructions, to protect it, and not to use it for its own purposes. We do not disclose your personal data to any third party for that party's own marketing.

Transfers between Singapore and the United States

We operate in both Singapore and the United States, and our service providers — including Stripe and our hosting provider — operate internationally. Your personal data may therefore be transferred to, stored in and accessed from a country other than the one you are in, including the United States.

Where personal data is transferred out of Singapore, we comply with the Transfer Limitation Obligation in section 26 of the Personal Data Protection Act 2012 and Part 3 of the Personal Data Protection Regulations 2021. We transfer personal data overseas only where the recipient is bound by legally enforceable obligations — by contract, by binding corporate rules or by applicable law — to provide a standard of protection at least comparable to that under the Act, or where another basis permitted by the Regulations applies.

If you would like more information about the safeguards applying to a particular transfer, contact our Data Protection Officer.

How long we keep it

We cease to retain personal data, or remove the means by which it can be associated with you, as soon as it is reasonable to assume that the purpose for which it was collected is no longer served by retention and retention is no longer necessary for legal or business purposes — as required by section 25 of the Personal Data Protection Act 2012.

How we protect it

We make reasonable security arrangements to protect personal data in our possession or control against unauthorised access, collection, use, disclosure, copying, modification, disposal or similar risks. These include:

• encryption of data in transit using TLS across the Site and at checkout;
• payment card data being handled entirely by Stripe, so that it never reaches our systems;
• access controls limiting order and customer data to staff who need it for their role;
• server configuration that prevents credentials, configuration files and internal logs from being served over the web;
• keeping software and hosting infrastructure patched and up to date; and
• contractual confidentiality and security obligations on our service providers.

No method of transmission or storage is completely secure. While we work to protect your data, we cannot guarantee absolute security, and you send information to us at your own risk. If you believe your interaction with us is no longer secure, tell us immediately at support@uv-incure.com.

Data breach notification

If a data breach occurs that results in, or is likely to result in, significant harm to affected individuals, or that is of a significant scale, we will notify the Personal Data Protection Commission of Singapore as soon as practicable and in any case within 3 calendar days of determining that the breach is notifiable, and will notify affected individuals as required by section 26D of the Personal Data Protection Act 2012.

Where United States state breach notification law applies to affected individuals, we will notify them and any required regulator within the time and in the manner that law requires.

Your rights

Everyone

• Access. Ask for a copy of the personal data we hold about you and information about how it has been used or disclosed in the past year.
• Correction. Ask us to correct data that is inaccurate or incomplete. We will correct it unless we are satisfied on reasonable grounds that a correction should not be made, and will send the correction to organisations we disclosed the data to in the past year.
• Withdraw consent. Withdraw your consent to our collection, use or disclosure of your personal data, on reasonable notice. We will tell you the likely consequences — withdrawing consent to the data needed to process orders means we can no longer supply you.
• Unsubscribe. Opt out of marketing at any time, without affecting your orders or support.

If you are in the United States

Depending on your state of residence, you may also have the right to know the categories and specific pieces of personal information we have collected, the sources, the purposes and the categories of recipients; to request deletion of your personal information; to request correction; to obtain a portable copy; to opt out of any sale or sharing of personal information or of targeted advertising; and not to be discriminated against for exercising these rights.

We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not process it for targeted advertising, so there is nothing for you to opt out of. If we ever change that, we will update this policy and provide an opt-out mechanism before doing so.

You may use an authorised agent to make a request. We will verify your identity, and the agent's authority, before acting.

Making a request

Email support@uv-incure.com, marked for the attention of the Data Protection Officer, with enough information for us to identify you and locate the data. We may ask for proof of identity. We respond to access and correction requests as soon as practicable, and within 30 days where required by the Personal Data Protection Act 2012; if we cannot, we will tell you within 30 days when we will. United States requests are answered within the period the applicable state law requires, typically 45 days.

A reasonable fee may be charged for an access request where the Act permits it. We will tell you the fee before proceeding. Some data must be retained for legal, tax, safety or export-control reasons even after a deletion request; we will explain where that applies.

Cookies and site analytics

The Site uses cookies and similar technologies for the following purposes:

• Strictly necessary — keeping the contents of your shopping cart, maintaining your session through checkout, and security. The Site cannot work without these.
• Payment — Stripe sets cookies on its checkout pages for fraud prevention and to operate the payment flow.
• Analytics — where used, to understand in aggregate how the Site is navigated so we can improve it.
• Blog — the WordPress blog at incurelab.com/wp sets its own cookies for comments and site functionality.

Most browsers let you refuse or delete cookies through their settings. Blocking strictly necessary cookies will prevent the cart and checkout from working. We do not use cookies for advertising, and we do not permit third-party advertising networks to track you across other sites from ours.

We do not currently respond to browser “Do Not Track” signals, as no common standard for them has been adopted. Where required by applicable state law, we honour recognised opt-out preference signals such as Global Privacy Control.

Marketing communications

We send product news, technical bulletins and offers only to people who have asked to receive them or who have bought from us and have not opted out. Every marketing message includes an unsubscribe link, and we act on unsubscribes promptly.

• Singapore. We comply with the Do Not Call provisions of Part 9 of the Personal Data Protection Act 2012. We check the Do Not Call Registry before sending marketing messages to Singapore telephone numbers, and mark marketing messages as required.
• United States. We comply with the CAN-SPAM Act, including accurate sender and subject information, a valid postal address and a working opt-out.

Opting out of marketing does not stop transactional and safety messages — order confirmations, shipping notices, invoices, Safety Data Sheets, product safety notices and recalls. We are required to send those and you cannot opt out of them while you hold or use our Products.

Children

The Site is intended for business customers and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, contact us and we will delete it.

Third-party sites

The Site links to third-party sites and services, including Stripe, our social media pages and carrier tracking pages. This policy does not cover them. Read their privacy policies before providing personal data to them.

Changes to this policy

We may update this policy from time to time. The current version, with its effective date, is always posted here. Where a change materially affects how we use your personal data, we will take reasonable steps to bring it to your attention and, where the law requires it, obtain your consent. Continuing to use the Site or to order from us after a change takes effect means you accept the updated policy.

Contact and complaints

For any question, request or complaint about your personal data, contact our Data Protection Officer:

Email: support@uv-incure.com (attention: Data Protection Officer)
Singapore: Incure Adhesives Manufacturing Pte Ltd, 33 Ubi Avenue 3, Singapore 408868 — +65 6270 2188
United States: Incure, Inc., 1301 Asheville HWY, Spartanburg, SC 29303, USA — +1 (860) 748-2979

We will acknowledge your complaint and aim to resolve it promptly. If you are not satisfied with our response, you may complain to the relevant regulator:

• Singapore — the Personal Data Protection Commission, at pdpc.gov.sg.
• United States — the Attorney General of your state, or, in California, the California Privacy Protection Agency.