Effective: 1 May 2026 · Last updated: 8 May 2026
City Infrastructure Singapore Pte. Ltd. is the organisation responsible for the collection, use and disclosure of personal data through the Platform under the PDPA. Our office is in Singapore. In connection with the Platform, we act as a commercial agent of the Partner Restaurants (as defined in our Terms of Service) to facilitate, process and conclude orders for the supply of meals on their behalf. You can reach our Data Protection Officer using the contact details at the end of this notice.
We collect personal data in three ways: information you give us, information we receive from your employer or other third parties, and information we collect automatically when you use the Platform.
| Category | Examples |
|---|---|
| Contact details | Name, work email, mobile number, company name and your role at that company. |
| Order details | Items ordered, dietary preferences, delivery address (typically an office address), unit/level, building access notes, special instructions, delivery date and time. |
| Account & billing | Account credentials, billing contact, purchase history, invoicing details. We do not store full payment card numbers — these are handled by our payment processors. |
| Communications | Messages you send us (email, chat, phone) and our responses, including any feedback you share about an order or Partner Restaurant. |
| Device & usage data | IP address, device and browser type, language settings, pages viewed, referring URL, timestamps and similar technical data collected through cookies and analytics tools. |
| Marketing preferences | Whether you have subscribed or unsubscribed to our marketing communications. |
We use personal data to operate the Platform and to provide our catering services to your company. Specifically, we use it to:
Under the PDPA, we collect, use and disclose personal data only where you have given consent (express or deemed), or where we are legally permitted or required to do so without consent. By placing an order, signing up to the Platform or contacting us, you consent to the collection and use of your personal data as described in this notice.
You can withdraw your consent at any time using the contact details at the end of this notice. Before we process your withdrawal, we will inform you of the likely consequences. For example: if you withdraw consent for order-related processing, we will be unable to process or deliver orders to you and your account may need to be deactivated; if you withdraw consent for marketing only, you will no longer receive promotional communications but your account and ordering capabilities will not be affected.
We share personal data only where it is necessary to operate the Platform or where we are required to do so by law. This includes sharing with:
We do not sell personal data.
The Platform uses cookies and similar technologies to keep you signed in, remember your cart, measure performance and understand how visitors use the site. You can control or disable cookies through your browser settings; doing so may affect how the Platform functions. We may use third-party analytics tools (for example, traffic analytics) that collect aggregated, non-identifying usage information.
We retain personal data only for as long as is reasonably necessary for the purposes set out above, including to meet legal, tax and accounting requirements. Order and invoice records are typically retained for at least five (5) years to satisfy Singapore tax obligations. Account information is retained for the life of your account and a reasonable period afterwards. Once data is no longer required, we will securely delete or anonymise it.
We use reasonable administrative, technical and physical safeguards designed to protect personal data against loss, misuse and unauthorised access. These include encrypted connections, access controls, staff training and regular reviews of our practices. No system is completely secure, however, and we ask you to keep your account credentials confidential and to let us know promptly if you suspect unauthorised use.
In the event of a data breach that is likely to result in significant harm to affected individuals, or that affects 500 or more individuals, we will notify the Personal Data Protection Commission and affected individuals as soon as practicable and in any event within three (3) calendar days of our assessment that the breach is a notifiable data breach, in accordance with the Personal Data Protection (Notification of Data Breaches) Regulations 2021.
Some of our service providers are based outside Singapore. Where we transfer personal data overseas, we take reasonable steps to ensure that the recipient is bound by legally enforceable obligations to provide a standard of protection comparable to that under the PDPA, for example through contractual safeguards.
Subject to the conditions and exceptions in the PDPA, you may:
To exercise any of these rights, please email our DPO at the address below. We may need to verify your identity before responding. We will reply within a reasonable time and, where required by the PDPA, within 30 days. A reasonable fee may apply for access requests, in line with PDPA guidelines.
If you are not satisfied with our response, you have the right to refer the matter to the Personal Data Protection Commission of Singapore (PDPC) at www.pdpc.gov.sg.
The Platform is intended for use by businesses and adults. We do not direct the Platform to children and do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with personal data, please contact us so we can take appropriate action.
We may update this Privacy Notice from time to time. The "Last updated" date at the top reflects the most recent version. If we make material changes, we will notify you through the Platform or by email. Continued use of the Platform after the change takes effect indicates your acceptance of the updated notice.
City Infrastructure Singapore Pte. Ltd. (Smart City Eats)