Privacy Policy

This Privacy Policy explains how LISTLAH collects, uses, discloses and protects personal data when you use our website and apps to buy, sell or browse listings in Singapore. We handle personal data in line with Singapore's Personal Data Protection Act 2012 (PDPA).

1. Who we are

LISTLAH is operated and marketed by Orix Marketing, Sri Lanka ("we", "us"), which is responsible for the personal data described in this policy. Our Data Protection Officer can be reached at privacy@listlah.com or by post at 51 Changi Business Park Central 2, #04-05 The Signature, Singapore 486066.

2. Personal data we collect

Information you give us

• Account details: your name, username, email address, mobile number (when you verify it), password (stored only as a one-way hash) and profile photo.
• Business accounts: your business name and UEN, which we use to verify your business.
• Listings: titles, descriptions, photos, prices, category details and the planning area of the item. If you drop a pin on the map, only the planning area is shown to others, never your exact pin. Photos are re-saved without location (EXIF/GPS) data.
• Messages, reviews and reports: messages you exchange through LISTLAH chat, reviews you leave and reports you file.
• Payments: details of paid services you buy (amounts, dates, status, invoice). Card details are entered on our payment partner's checkout and never reach us.
• Support: what you tell us when you contact us.

We do not ask for your NRIC, FIN or passport number, or copies of identity documents. If Singpass verification becomes available and you choose to use it, we keep only a scrambled (hashed) identifier confirming that a real person verified, not your NRIC number or Myinfo details.

Information collected automatically

• Usage: searches, listings viewed or saved, and contact actions such as revealing a phone number, stored without IP addresses or contact details.
• Device and security information: a random device identifier and a scrambled form of your IP address, used to keep accounts secure and to detect fraud and fake accounts.
• Cookies: see section 8.

3. How we use personal data

• to run your account and show your listings to buyers, and to let buyers and sellers contact each other;
• to keep the marketplace safe: automated checks for scams, prohibited and counterfeit items, duplicate listings and fake accounts, and posting limits based on account history. A person reviews account holds and suspensions, and you can ask us how a decision about your account was made;
• to provide paid services, issue invoices and keep financial records;
• to answer your questions and resolve disputes;
• to improve LISTLAH using aggregated statistics;
• to send you marketing only if you have switched it on in Privacy → Your choices. Service messages (security alerts, listing updates, receipts) are not marketing;
• to meet legal obligations and respond to lawful requests from the authorities.

4. What other users can see

Your public profile name, badge and reviews; your listings (text, photos, price and planning area); and any phone or WhatsApp number you choose to add to a listing. Search engines can see listings too. Do not put personal details you want to keep private in a listing or its photos.

5. Who we share personal data with

We do not sell personal data. We share it only:

• with service providers who process it for us under contract: website hosting, email and SMS delivery, bot protection (Cloudflare Turnstile), payment processing (PayHere: your name, email and phone are sent to the checkout) and, only if you accept analytics or advertising cookies, Google Analytics and Google AdSense;
• with authorities such as the Singapore Police Force, when the law requires it or to report suspected crime such as scams;
• with a buyer of our business, if LISTLAH is sold or restructured, under the same protections.

6. Transfers outside Singapore

LISTLAH is operated from Sri Lanka, and some service providers process data outside Singapore (for example our payment partner PayHere, in Sri Lanka). When personal data leaves Singapore, we make sure it keeps a standard of protection comparable to the PDPA, through contracts and our own security measures, as the PDPA's Transfer Limitation Obligation requires.

7. How long we keep personal data

• Usage statistics: about 13 months. Mobile verification codes: 30 days. Fraud-prevention records: up to 2 years.
• Invoices and payment records: as long as tax and accounting laws require.
• When you close your account we erase your profile and contact details and take down your listings. We keep invoices and payment records; messages you already sent, which also belong to the people you sent them to and now show as from "Deleted user"; records of reports and moderation decisions, without your contact details; and a scrambled form of your phone number for one year, so banned accounts cannot simply return.

8. Cookies

We use strictly necessary cookies to sign you in, keep forms secure and remember your cookie choice. Analytics (Google Analytics) and advertising (Google AdSense) cookies load only if you accept them in the cookie banner. You can change your choice at any time from "Cookie settings" at the bottom of every page. Our pages also load fonts from Google Fonts, so your browser sends a request, including your IP address, to Google.

9. Your rights

• Access: download your personal data in Privacy, or ask us.
• Correction: edit your details in account settings, or ask us to correct anything else.
• Withdraw consent: switch off optional uses in Privacy → Your choices at any time.
• Close your account: in Privacy → Close my account.

You can also email privacy@listlah.com from the email address on your account. We reply within 30 days; if we need longer, we will tell you when to expect a reply. Some information may be withheld where the PDPA allows, for example details of how we detect fraud, or other people's personal data. If you are not satisfied with our response, you may contact the Personal Data Protection Commission (PDPC).

10. Security and data breaches

We protect personal data with encryption, scrambled (hashed) identifiers, restricted and logged staff access, and regular reviews. Read more in Cyber Security. If a data breach is likely to cause you significant harm, we will notify you and the PDPC as the PDPA requires.

11. Do Not Call

We do not send marketing calls or SMS to Singapore numbers unless you have agreed, and we check the Do Not Call Registry before any telemarketing.

12. Children

LISTLAH is intended for users aged 18 and over. Younger users may use it only with a parent or guardian's consent and supervision. If you believe a child has given us personal data without that consent, please contact us and we will delete it.

13. Changes to this policy

We will post changes on this page with a new "Last updated" date, and tell registered users about significant changes before they take effect.

14. Contact

Data Protection Officer: privacy@listlah.com, 51 Changi Business Park Central 2, #04-05 The Signature, Singapore 486066.