Privacy Policy

Last Updated: June 2026

THE ORDINARY CO. ("THE ORDINARY CO.", "we", "us" or "our") respects your privacy and is committed to safeguarding the personal data entrusted to us.

This Privacy Policy describes how we collect, use, disclose, process and protect your personal data when you visit our website, purchase products from us, subscribe to our communications, interact with our advertisements, or otherwise engage with our services.

By accessing or using our website, you acknowledge that you have read and understood this Privacy Policy.

1. Collection of Personal Data

We may collect personal data that you voluntarily provide to us, including but not limited to:

• Name;

• Email address;

• Telephone number;

• Billing and delivery addresses;

• Order and transaction details;

• Correspondence with our customer service team;

• Marketing preferences; and

• Any other information you choose to provide to us.

We may also collect certain information automatically through cookies, pixels and similar technologies, including:

• IP address;

• Browser type and device identifiers;

• Website usage and browsing behaviour;

• Referral sources;

• Purchase and conversion data; and

• Information regarding your interaction with our website, advertisements and communications.

2. Purposes for Which Personal Data is Collected

We may collect, use, disclose and process personal data for purposes including:

• Processing and fulfilling orders;

• Facilitating payment transactions;

• Providing customer support and responding to enquiries;

• Managing customer accounts;

• Delivering products and services;

• Maintaining and improving our website and user experience;

• Conducting analytics and business administration;

• Detecting, investigating and preventing fraud or unauthorised activities;

• Complying with legal and regulatory obligations;

• Communicating with customers regarding products, services and transactions;

• Conducting advertising, remarketing and audience measurement activities; and

• Any other purpose reasonably related to the foregoing.

3. Marketing Communications

Where permitted by applicable law, we may use your personal data to provide information regarding our products, collections, events, promotions and other marketing initiatives.

You may withdraw your consent to receive marketing communications at any time by using the unsubscribe mechanism included in our communications or by contacting us directly.

Withdrawal of consent shall not affect communications relating to existing transactions, order fulfilment, customer service matters or other non-marketing purposes.

4. Cookies and Similar Technologies

Our website utilises cookies, pixels, web beacons and similar technologies to distinguish users, improve website functionality, analyse traffic patterns and support advertising activities.

These technologies may be used to:

• Remember user preferences and shopping cart contents;

• Facilitate website functionality and security;

• Measure website performance;

• Analyse visitor behaviour;

• Evaluate advertising effectiveness; and

• Deliver personalised content and advertisements.

You may configure your browser settings to refuse or restrict cookies. However, certain portions of the website may not function properly if cookies are disabled.

5. Advertising, Analytics and Third-Party Tracking Technologies

We may engage third-party service providers and advertising platforms, including but not limited to Meta Platforms (Facebook and Instagram), TikTok, Google and Shopify, to provide analytics, advertising and measurement services.

These providers may collect information regarding your interactions with our website through cookies, pixels and similar technologies.

Such information may be used to:

• Measure and optimise advertising campaigns;

• Attribute sales and website activity;

• Build and analyse customer audiences;

• Deliver advertisements on third-party platforms;

• Conduct remarketing and retargeting activities; and

• Improve the relevance of advertising content.

Where permitted by law, we may disclose limited customer information, including identifiers in hashed or encrypted form, transaction information and website activity data, to advertising and analytics partners for the foregoing purposes.

The collection and use of information by such third parties are governed by their respective privacy policies and practices.

6. Disclosure of Personal Data

We may disclose personal data to third parties where reasonably necessary for the operation of our business, including:

• Payment service providers;

• Logistics, warehousing and delivery partners;

• Technology, ecommerce and website hosting providers;

• Customer relationship management and email marketing platforms;

• Advertising and analytics providers;

• Professional advisers, auditors and insurers; and

• Governmental, regulatory or law enforcement authorities where required by law.

We do not sell personal data to third parties for monetary consideration.

7. International Transfers

Personal data may be transferred to, processed in, or stored outside Singapore by our service providers and business partners.

Where personal data is transferred outside Singapore, we will take reasonable steps to ensure that the receiving party provides a standard of protection comparable to that required under applicable data protection laws, including the Personal Data Protection Act 2012 of Singapore ("PDPA").

8. Protection of Personal Data

We maintain reasonable administrative, physical and technical safeguards designed to protect personal data against unauthorised access, collection, use, disclosure, copying, modification, disposal or similar risks.

Notwithstanding the foregoing, no method of transmission over the internet or electronic storage system can be guaranteed to be completely secure. Accordingly, we cannot warrant or guarantee the absolute security of personal data.

9. Retention of Personal Data

We retain personal data only for as long as is reasonably necessary to fulfil the purposes for which it was collected, to satisfy legal, regulatory, accounting or reporting requirements, or as otherwise permitted or required by applicable law.

10. Access, Correction and Withdrawal of Consent

Subject to applicable law, individuals may request:

• Access to personal data in our possession or under our control;

• Information regarding the use or disclosure of such personal data;

• Correction of inaccurate or incomplete personal data; and

• Withdrawal of consent for the collection, use or disclosure of personal data.

Requests may be submitted using the contact details set out below. We reserve the right to verify the identity of any individual making such a request before responding.

11. Third-Party Websites

Our website may contain links to third-party websites, applications or services that are not owned or controlled by THE ORDINARY CO.

We are not responsible for the privacy practices, content or security of any third-party websites. Users access such websites at their own risk and are encouraged to review the applicable privacy policies before providing any personal data.

12. Amendments to this Privacy Policy

We reserve the right to amend, modify or update this Privacy Policy at any time by publishing the revised version on our website.

Any amendments shall take effect upon publication unless otherwise stated.

13. Contact Information

Questions, requests or concerns regarding this Privacy Policy or our handling of personal data may be directed to:

THE ORDINARY CO.
Email: hello@theordinary.co

We will endeavour to respond to all legitimate requests within a reasonable period and in accordance with applicable law.