Privacy Policy

This Privacy Policy describes the practices of the studio known as DIY Travel SG, which operates under DIYTRAVEL.SG PTE. LTD. at 99 ARAB STREET, Singapore 199795. We plan self-guided trips, so we handle information about where people want to go, how they like to travel and what they are willing to spend. This document explains what we collect, why we collect it, how long we keep it and what you can ask us to do with it.

We have written this policy in plain sentences because privacy notices are too often read only when something has gone wrong. If any part of it is unclear, write to us and we will explain the point in a direct reply. Nothing in this policy reduces any right that the law gives you, and where a legal rule requires more than this document offers, that rule wins.

The policy applies to this website, to messages sent to our published email address, to telephone calls placed to our published number, to forms completed at the Arab Street studio and to the planning documents we deliver to clients. It does not apply to other companies whose services you choose to use for flights, hotels, insurance or visa applications, each of which has its own notice.

1. Who Controls Your Data

The entity responsible for the personal data described here is DIYTRAVEL.SG PTE. LTD., a company registered in Singapore with its business address at 99 ARAB STREET, Singapore 199795. The studio trades publicly as DIY Travel SG, and both names refer to the same office and the same records.

Questions, requests and complaints about personal data should be sent to contact@diytravelsg.lol or raised by telephone at +18457399870. A written request is easier for us to track, so we encourage email where practical. If you visit the studio in person, the planner at the desk can note your request and pass it to the person who maintains our records.

We do not appoint a separate external data protection officer because the scale of our processing does not require one. The managing staff of the company together act as the point of accountability for data questions, and every member of the studio is briefed on the handling rules set out in this policy.

2. Personal Data We Collect

We try to collect only what a planning studio genuinely needs. The categories below describe the full range we may hold, though any single client relationship will usually involve only a few of them.

• Identity details such as your name, the names of people travelling with you and the preferred form of address for each person.
• Contact details such as email addresses, telephone numbers, messaging handles you choose to share and, where relevant, a postal address for sending printed plans.
• Trip details such as travel dates, departure city, destinations, party size, mobility needs, dietary preferences and the activities you ask us to include.
• Budget information such as the spending band you tell us and the categories you want emphasised in a budget sheet.
• Correspondence including emails, messages, notes taken during planning calls and the draft documents exchanged while a plan is being prepared.
• Billing details such as the name on an invoice, the amount agreed for a planning engagement and the reference of a payment received.
• Technical information such as the browser type, approximate region and pages visited when you use this website, collected in a form that does not identify you personally.

We do not ask for passport numbers, identity card numbers, full card numbers or bank credentials as part of routine planning. If a planning task ever seems to require such a document, we will say so explicitly, explain why and offer an alternative wherever one exists.

3. How We Collect Personal Data

Most information reaches us because you choose to share it. You may complete the contact form on this website, send an email, call the studio, speak with a planner at the Arab Street desk or reply to a question during a planning conversation. In each case you decide how much detail to provide, and you can decline any question that feels unnecessary.

A smaller amount of information is generated automatically when the website is used. Our hosting provider records basic request logs, including the time of a visit and the address of the page requested, so that faults can be traced and abuse can be limited. These logs are not used to build a profile of any visitor, and we do not combine them with planning records.

We do not buy contact lists, and we do not obtain personal data from data brokers. If a person refers you to the studio, we will record that referral only after you make contact yourself, and we will not treat a referral as consent to marketing.

4. Purposes of Processing

We use personal data for a defined set of purposes connected to planning travel. The main purposes are listed here, and any new purpose would be described to you before we began.

• To reply to enquiries and answer questions about services, availability and scope.
• To prepare itinerary cards, transit sequences, budget sheets, food trail maps and group coordination notes.
• To arrange planning calls, studio visits and follow-up reviews of draft documents.
• To issue invoices, confirm payments and keep the accounting records that law requires.
• To improve the studio by reviewing which kinds of plans work well and where advice needs updating.
• To protect the studio and its clients against fraud, misuse of documents and unauthorised access.
• To send service updates about a plan already underway and, where you have opted in, occasional studio news.

We do not use personal data to make automated decisions that produce legal effects for you. Planning is done by people, and a planner reviews every document before it is delivered.

5. Legal Basis for Processing

Where the law of Singapore or another applicable jurisdiction requires a legal basis, we rely on the following grounds. We rely on your consent for optional activities such as receiving studio news or sharing a testimonial. We rely on the performance of an engagement for the work needed to prepare and deliver a plan pack. We rely on legal obligation for accounting, tax and record keeping duties. We rely on legitimate interests for keeping the website secure, answering ordinary enquiries and improving our planning materials, always balanced against your rights.

Consent can be withdrawn at any time, and withdrawal is as easy as giving it. If you withdraw consent for a purpose that depends on it, we will stop that activity, though earlier processing remains lawful. Withdrawal does not affect a planning engagement that rests on a separate basis.

In some situations the law permits processing without consent, for example where a document must be kept for tax purposes or where a legal claim needs to be defended. We limit such processing to what the situation requires.

6. Itinerary and Travel Details

Travel details deserve their own explanation because they can reveal more than a name and an email address. The dates you travel, the places you visit and the mobility needs you describe may suggest information about health, religion or family circumstances. We treat all trip details as sensitive in practice, even where the law classifies them as ordinary data.

Only the planners working on your engagement can open a full plan file. Support staff who prepare printing and binding see the completed cards but not the correspondence that produced them. When a plan includes dietary or accessibility notes, those notes appear only where they are needed for a booking to be understood, and we avoid repeating them in general commentary.

If you ask us to share a plan with other members of a group, we will share the planning documents and the contact sheet that you approve. We will not share your private correspondence or any budget notes that you asked us to keep between the studio and yourself.

7. Payments and Billing Records

Fees for planning work are invoiced to the name and address you provide. Our records note the invoice number, the amount, the date and the reference of the payment received. Full card numbers are handled by the payment provider you choose and are not stored in the studio systems.

Accounting records are kept for the period required by Singapore tax and company law. These records are limited to what a business must retain, and they are stored separately from planning files so that a routine request about a plan does not require anyone to search financial data.

If a payment is disputed, we may need to review correspondence about the engagement and pass relevant details to our bank or professional adviser. We share only what the dispute requires and keep a note of what was shared.

8. Cookies and Local Storage

This website is deliberately simple. It does not run advertising trackers, social media pixels or behavioural profiling scripts. The pages are served as static documents, and the only browser storage in use supports basic functions such as remembering whether a menu was left open.

Where a small cookie or local storage entry is set, it is placed for the operation of the site rather than for measurement of your interests. You can clear these entries at any time through your browser settings, and the site will continue to work, with perhaps one extra click to reopen a menu.

Our hosting provider may keep request logs as described earlier. These logs help us detect faults and abuse. They are not used to identify individual visitors, and we do not merge them with contact records.

9. Sharing With Service Providers

We do not sell personal data and we do not trade it with advertisers. We share information only with providers who help us run the studio, and only the amount needed for their task.

• Hosting and email providers that store the website files and deliver studio correspondence.
• Printing and binding suppliers that produce the paper plan packs when a client requests a physical set.
• Accounting and payment services that issue invoices and record receipts.
• Professional advisers such as lawyers or auditors, when a specific matter requires their input.
• Public authorities, where a valid legal request compels disclosure.

Each provider is expected to protect the information it handles and to use it only for the service it supplies to us. Where a provider processes data outside Singapore, the transfer section below explains how we approach the risk.

If the studio is ever reorganised or transferred, planning records may move with the business. In that case the receiving entity would be bound by this policy, and we would notify affected clients before any material change in handling.

10. International Transfers

Our studio is in Singapore, and most processing happens here. Some providers, however, operate servers in other countries, so a message may be stored abroad while it waits to be read. We choose providers with reasonable security practices and require them to protect the information they hold on our behalf.

When a transfer leaves Singapore, we look at the destination and the nature of the data. Routine correspondence may travel to a provider with strong protections, while a file containing sensitive trip details stays within services we have reviewed more closely. Where a contract can set the standard, we use one that requires confidentiality and limits onward sharing.

If you would prefer that your information not leave Singapore, tell us before the engagement begins. In some cases we can keep a plan entirely on local systems, though a few services such as international email delivery cannot be guaranteed to remain within one country.

11. Retention Periods

We keep personal data only as long as we need it. Enquiries that do not become engagements are cleared within twelve months. Planning files are kept for three years after the trip ends, so that a client can return for a similar route or ask a question about an earlier plan. Accounting records are kept for the period required by law, which is currently five years for most company records.

When a retention period ends, records are deleted or irreversibly anonymised. Paper documents are shredded by a licensed service, and digital files are removed from active systems and from the backup cycle as it rolls forward. We note deletions in a simple register so that we can demonstrate the practice is followed.

You may ask for earlier deletion, and we will comply unless a legal obligation requires us to keep a record. If part of a file must be retained, we will explain which part and why, and we will delete everything else.

12. Security Measures

Security at a small studio rests on careful habits as much as on tools. We use encrypted connections for the website and for email where the provider supports it. Access to planning files is limited to the planners assigned to an engagement, and accounts are protected with strong passwords and a second verification step where available.

Paper packs are prepared in the studio and stored in a locked cabinet before collection or delivery. Drafts that are no longer needed are shredded rather than placed in ordinary waste. Portable drives are not used to move client files; documents travel through approved channels with access controls.

If a breach occurs that is likely to cause harm, we will investigate promptly, take steps to contain it, notify affected clients without undue delay and report to the relevant authority where the law requires. We keep a short incident record so that lessons are applied to future practice.

13. Your Rights and Choices

Subject to applicable law, you have the right to ask what personal data we hold about you, to receive a copy, to have errors corrected, to request deletion, to restrict or object to certain processing and to withdraw consent for optional activities. You may also ask for a portable copy of information you provided.

To make a request, write to contact@diytravelsg.lol with enough detail for us to locate your records, such as the name used for the plan and the approximate dates of the trip. We may ask a question or two to confirm identity before releasing information, because we do not want to hand a plan file to the wrong person.

We aim to answer within thirty days. If a request is complex, we will explain the reason for any delay and give a new date. There is no fee for an ordinary request, though a reasonable charge may apply where a request is manifestly unfounded or repetitive.

You also have choices about communication. You can ask us to use a particular channel, to avoid marketing messages entirely or to remove you from a follow-up reminder about an unfinished plan.

14. Privacy for Children

Our planning services are intended for adults who organise their own travel. We do not knowingly collect personal data from children through this website, and we do not direct marketing to children. Where a family plan includes children, the adult client provides the names and ages needed for planning, and we treat that information with the same care as any other trip detail.

If you believe a child has sent personal data to the studio without an adult involved, contact us and we will remove the information promptly. A parent or guardian may also ask to review, correct or delete data about a child that we hold as part of a family plan.

We do not ask for photographs of children, and we do not publish images of clients or their families without written permission. Any photograph used in studio material would be of a public place with no identifiable person, unless a separate release has been signed.

15. Marketing Communications

We send studio news only to people who have asked for it. You can opt in when you contact us or later by writing to the studio. Each message includes a simple way to stop receiving further news, and a request to stop is acted on without any follow-up persuasion.

Service messages about a plan already underway are different from marketing. We will still write to confirm a meeting, ask a planning question or send a finished document, because those messages are part of the work you asked us to do. Even then, you can tell us to use a different channel or to reduce the volume.

We do not sell subscriber lists or share them with partners for their own marketing. If the studio ever runs a joint event with another organisation, any message about it would come from us and would follow the same opt-out rule.

16. Third Party Websites

Our pages may link to transport operators, official tourism sites, mapping services or other resources that help with planning. Those sites are independent, and their privacy practices are their own. We check links for relevance but cannot control what a destination site records once you leave our pages.

We encourage you to read the notice of any site that asks for payment details, passport information or account registration. If a link on our site appears to lead somewhere unexpected, tell us and we will review it promptly.

References to hotels, tour operators or restaurants are provided as planning suggestions. A mention does not mean that the business has reviewed this policy or that we have audited its data practices.

17. Changes to This Policy

We review this policy at least once a year and whenever a practice changes in a material way. The review date at the top of the page shows the current version, and earlier versions are kept in the studio archive so that we can explain how a practice has evolved.

If a change affects how we handle information already collected, we will describe the change to affected clients by email before it takes effect, unless the change is minor or the law requires immediate action. A revised policy will never reduce protection for data already held without a clear explanation and, where appropriate, a fresh choice.

Continuing to use the website or to work with the studio after an update means the current policy applies to new information. You are always welcome to ask for a copy of the version that applied at the time of your engagement.

18. Complaints and Contact

If something about our handling of personal data concerns you, please tell us first. Write to contact@diytravelsg.lol or call +18457399870 and describe what happened. We will acknowledge the message, investigate and reply with what we found and what we propose to do.

Most concerns are resolved at that stage, often because a record was incomplete or a message went to an address that was no longer in use. If you remain unhappy, you may raise the matter with the Personal Data Protection Commission of Singapore or with the supervisory authority in your own country where that authority accepts complaints from you.

Our office is at DIYTRAVEL.SG PTE. LTD., 99 ARAB STREET, Singapore 199795. Visitors are welcome during business hours, and a planner will help you put a request in writing if you prefer to raise it in person.