Data Protection Notice

When you register, we collect:

• Your name and contact details — first and last name, email address, mobile number.
• Your ceremony details — the school or partner institution your registration code belongs to, your programme, your gown size (where the event asks for one), and your chosen gown collection date and location.
• An identification number — only where the specific event asks for one (for example a matriculation number). Not every event does; if yours does, the field appears on the form with its own label. If you do not see it, we are not collecting it.
• Your order — the package, guest tickets, optional add-ons, any request for extra guest tickets, and the amount payable.
• Payment and refund records — payment method, our payment reference, whether and when payment was received, and, if applicable, cancellation, refund and gown-deposit records. We never see or store your card number, bank login or PayNow credentials — those are handled entirely by our payment provider (see section 3).
• Gown collection and return records — when the gown was collected and returned, by whom, its condition, and the status of your refundable deposit.
• An authorised collector, if you name one — if you ask someone else to collect your gown, we record that person’s name and phone number, and when you agreed to the authorisation. Please only give us their details if they are content for you to do so.
• Technical records — your IP address is recorded briefly with registration attempts, and with staff login attempts, purely to limit abuse (for example someone spamming the form). It is not used to profile or track you, and it is cleared as those counters roll over.

We use your personal data only to run your ceremony registration and gown rental:

• to register you for the ceremony and reserve your gown in the right size;
• to allocate guest tickets and manage venue capacity;
• to take payment, and to issue refunds and handle the refundable gown deposit;
• to send you operational emails — your confirmation and booking record, payment reminders, collection reminders, and notices about your gown or deposit;
• to hand you the right gown at the collection counter and record its return;
• to keep accurate financial and administrative records of the event.

We do not sell your personal data, and we do not use it for advertising.

We disclose your personal data only to the following, and only for the purposes above:

• Your own school or partner institution — for ceremony administration (for example the graduand list, gown sizes and guest numbers for your ceremony). Each institution receives only the records of students registered under its own code, and the file we send them contains no payment amounts and no phone numbers.
• HitPay (our payment provider) — we send your name, email address, the amount payable and our payment reference so that they can take your payment and, where applicable, process a refund. Your payment details are given to HitPay, not to us.
• Brevo (our email provider) — your email address and name, so that our emails to you can be delivered.
• Our hosting and database providers (Vercel and Neon) — they store and serve the system on our behalf; they do not use your data for their own purposes.
• Where the law requires it — for example a lawful request from a public authority.

We keep encrypted backups of the registration database so that your booking can be recovered if something goes wrong. Backups are encrypted at rest and are accessible only to Raffles Studio.

We keep your registration records for as long as is necessary to fulfil the purposes described above — through your ceremony and the matters that follow it, such as gown return and deposit refunds — and no longer than the law requires or permits. When they are no longer needed, they are deleted or anonymised. Financial records may be kept for longer where Singapore law requires it.

Encrypted backups roll off on their own schedule (currently up to 90 days), so a deleted record may persist in a backup for a short period before that backup expires.

You may, at any time:

• ask for a copy of the personal data we hold about you, and how it has been used;
• ask us to correct anything that is wrong — a misspelt name, the wrong email, the wrong gown size or collection date;
• ask us to delete your personal data, where we are not required to keep it;
• withdraw your consent to our continued collection, use or disclosure of your personal data.

To do any of these, email us at rafflesstudio@gmail.com. We will respond within a reasonable time. Please tell us your name and your registration reference (it looks like REG-XXXXXXXX) so we can find you.

Please note: if you withdraw consent or ask us to delete your data before your ceremony, we may no longer be able to provide your gown, your guest tickets or your registration, and cancellation and refund terms for your event will apply.

Access to registration data is restricted to authorised Raffles Studio staff accounts, protected by individual passwords. Your private booking link is unguessable and specific to you — please treat it like a password and do not share it. Data is transmitted over an encrypted connection, and backups are encrypted at rest.

For any question about this notice, or about how we handle your personal data, contact Raffles Studio Pte. Ltd. at rafflesstudio@gmail.com.

Raffles Studio’s general privacy policy for its other services is published at rafflesstudio.com/privacy-policy. Where that policy and this notice differ, this notice governs the registration system.