Effective Date: August 20, 2025

This privacy policy (“Policy”) describes how Biteback (“Biteback,” “we,” “our,” or “us”) collects, uses, discloses, and protects personal data in accordance with the Personal Data Protection Act 2012 (No. 26 of 2012) of Singapore (“PDPA”), as well as other applicable data protection laws across Asia where we operate. It also explains your rights and choices regarding your personal data.

This Policy governs your use of the Biteback mobile application (“Application”), the biteback.co website (collectively, “Website”), and any other online services owned and operated by Biteback that link to this Policy (“Services”). (Together, the Website, Application, and Services are the “Biteback Program”).

1. Applicability

Data protection law distinguishes between organizations that determine the purposes and means of processing (“data controllers” or “organizations”) and those that process on behalf of others (“data intermediaries” or “processors”). This Policy applies where we act as a data controller/organization. Where we process data on behalf of a business partner or merchant, that partner’s privacy policy will apply.

This Policy is tailored for users in Singapore and Asia. If you are located in the European Union, United Kingdom, or other jurisdictions, please note that additional rights and disclosures may apply under local law.

If you have questions or concerns about this Policy, please contact us at hello@biteback.co.

2. What Personal Data Do We Collect?

We may collect the following categories of personal data when you interact with the Biteback Program:

(a) Information You Provide Directly

• Contact Information: Name, phone number, email address, and mailing/billing address.

• Demographic Information: Age, gender, birthday (day and month), and general location.

• Account Information: Username, password, and account preferences.

• Payment Information: Credit/debit card details (card number, expiry date, security code). Payment is processed securely by third-party providers; we do not store full card details.

• Purchase Information: Transaction details, such as items purchased, date, time, location, and amount.

• Dining Preferences: Information you provide regarding allergies, dietary restrictions, or preferences.

• Referral Information: If you refer our Services or gift credit, we may collect the recipient’s contact details (e.g., email).

• User Content: Any messages, feedback, images, or other content you provide.

• Job Application Information: Employment/education history, references, CVs, transcripts, and other application details.

(b) Information Collected Automatically

When you use the Biteback Program, we may automatically collect:

• Device information (IP address, device ID, browser type, operating system).

• Usage information (pages visited, time spent, app activity).

• Location information (where permitted by your device settings).

(c) Information from Third Parties

We may receive personal data about you from:

• Merchants when you transact using Biteback credit.

• Payment processors and financial institutions.

• Marketing and referral partners.

3. How Do We Use Your Personal Data?

We use your personal data to:

• Provide and operate the Biteback Program.

• Process payments and complete transactions.

• Customize your user experience, including dining recommendations.

• Communicate with you (service updates, marketing where consented).

• Manage referrals, promotions, and rewards.

• Improve our Services through analytics and research.

• Comply with applicable laws, regulations, and legal obligations.

4. Consent & Deemed Consent

(a) Consent

By providing your personal data to Biteback, you consent to our collection, use, and disclosure of your personal data for the purposes set out in this Policy. Where required by law, we will obtain your express consent before collecting additional personal data or using your data for new purposes.

You may withdraw your consent at any time by contacting us at hello@biteback.co. Please note that withdrawing consent may affect our ability to provide certain services to you.

(b) Deemed Consent

Under the Singapore PDPA, we may rely on deemed consent in the following situations:

• Deemed Consent by Conduct: When you voluntarily provide personal data for a purpose that is obvious in the circumstances (e.g., providing payment details to complete a transaction).

• Deemed Consent by Contractual Necessity: When it is reasonably necessary for us to fulfill a contract with you.

• Deemed Consent by Notification: Where permitted under the PDPA, we may notify you of new purposes for which we intend to use your personal data and give you a reasonable period to opt out. If you do not opt out, you are deemed to have consented.

We will always assess whether relying on deemed consent is appropriate, having regard to your interests, rights, and expectations.

5. Disclosure of Personal Data

We may disclose your personal data to:

• Merchants and business partners: To fulfill your purchases and redemptions.

• Payment processors and service providers: Who assist in payment, hosting, analytics, or support.

• Professional advisors: Such as auditors, lawyers, and consultants.

• Regulators and authorities: Where required under applicable law.

• Other parties: With your consent or at your direction.

We do not sell your personal data.

6. International Data Transfers

Your personal data may be transferred to and processed in countries outside of Singapore and your country of residence, including the United States. Where required, we will ensure that such transfers comply with applicable data protection laws (e.g., using contractual safeguards under the PDPA).

7. Data Retention

We retain personal data for as long as reasonably necessary to fulfill the purposes outlined in this Policy, unless a longer retention period is required by law.

8. Your Rights

Subject to applicable law, you may have the right to:

• Access your personal data we hold.

• Correct or update your personal data.

• Withdraw consent to processing (note this may affect service provision).

• Request deletion of your personal data (subject to legal/operational limits).

• Opt out of marketing communications at any time.

To exercise your rights, contact us at hello@biteback.co.

9. Security

We adopt reasonable security measures to protect personal data against unauthorized access, collection, use, disclosure, copying, modification, or disposal. However, no method of transmission over the Internet or method of electronic storage is completely secure.

10. Updates to This Policy

We may update this Policy from time to time. Updates will be posted with a revised effective date.

11. Data Protection Officer (DPO)

In compliance with the Singapore PDPA, Biteback has appointed a Data Protection Officer (“DPO”) to oversee our compliance with data protection obligations and address questions, feedback, or complaints relating to your personal data.

If you wish to exercise your rights, withdraw consent, or have any concerns about how your personal data is being handled, you may contact our DPO at:

Data Protection Officer
Biteback
📧 hello@biteback.co

We will respond to your query within a reasonable timeframe, in accordance with the requirements of the PDPA.