SG Third Spaces (sgthirdspaces.com) · Effective date: 04 October 2026 · Last updated: 12 October 2026
1. Who we are
SG Third Spaces ("we", "us", "our") operates sgthirdspaces.com, a directory of community groups and gatherings in Singapore.
- Operator: Chloe Chua
- Contact email: chloe@sgthirdspaces.com
- Data Protection Officer (DPO): Chloe Chua, chloe@sgthirdspaces.com
This notice explains how we collect, use, disclose and protect personal data under the Personal Data Protection Act 2012 (PDPA) of Singapore.
2. Who this notice covers
- Visitors who browse the directory.
- Group owners ("organisers") who create accounts and list groups.
- People who send an enquiry to a group through the directory.
- People named in listings, such as a group's contact person.
3. Personal data we collect
| Category | What it includes | Where it comes from |
|---|---|---|
| Owner account | Name, email address, and any phone number or other details you give us | You, when you sign up |
| Listing details | Group name, description, category, neighbourhood, upcoming gatherings, website, Telegram, Instagram, founded year, images | You, when you submit or edit a listing |
| Contact details in a listing | Any personal name, email or phone number you choose to publish | You |
| Enquiries | Your name, contact details and message, sent to a group | You, when you send an enquiry |
| Featured bidding (organisers) | Bid amounts, the listing bid for, and payment status. Card details are handled by our payment provider, not stored by us | You, through the bidding form |
| Organiser verification | Name, contact details, the social or messaging accounts used to check the group, and the notes from our review | You, and our review |
| Admin records | Listing approval and moderation decisions, and reports received and how we responded | Our admin team |
| Technical data | IP address, browser type, device type, pages visited, times of visit, and login session data | Automatically, when you use the site |
| Local device storage | The "My List" saved groups are kept in your browser only (see section 10) | Your device |
We do not knowingly collect personal data from children under 13. See section 12. We do not collect NRIC numbers or other government identification numbers from organisers or participants unless the law requires it.
4. Why we collect and use personal data
We collect and use personal data only for these purposes:
- To create and manage owner accounts and listings.
- To publish approved listings, including the group information you choose to make public.
- To pass your enquiry to the group you contacted, so they can reply to you.
- To review, approve and moderate listings, and to keep the directory safe and accurate.
- To run the featured bidding process, take payment on card-on-file, and handle failed payments.
- To respond to your questions, requests and complaints.
- To keep the site secure, prevent fraud and misuse, and fix technical problems.
- To send service messages, such as sign-in links, listing approval notices and bidding results.
- To send marketing messages, but only where you have opted in (see section 9).
- To meet legal and regulatory obligations.
- To keep a record of organiser checks, approvals and reports, to investigate concerns, and to defend or pursue legal claims.
5. Consent
- We rely on your consent when you choose to submit a listing, send an enquiry, or create an owner account.
- Where you send an enquiry, the form shows: "By sending, you agree to share your info with [group name]. We never sell your data."
- We may also rely on deemed consent (for example, when you voluntarily provide your details to contact a group) and on the exceptions allowed by the PDPA.
- Publishing a listing means the information in it is public. Do not publish anyone's personal details without their permission.
You can withdraw consent at any time (see section 11). Withdrawing consent may mean we can no longer provide some services to you.
6. Who we share personal data with
- The group you contact. When you send an enquiry, we pass your name, contact details and message to that group only. We do not forward enquiries about other groups.
- Public listing content. Information you publish in a listing is visible to anyone who visits the page. Approved listings may also be indexed by search engines.
- Service providers that help us run the site, under contracts that require them to protect your data:
- Lovable (hosting, database, authentication and file storage)
- Stripe (card-on-file and bidding payments)
- Our email provider (sign-in links and service emails)
- Google Analytics (analytics)
- Authorities. Where required by law, a court order or a competent authority. We may also disclose information to the police or other authorities where we reasonably believe it is needed to investigate a crime, or to prevent serious harm to a person.
- Business transfers. If we sell or merge the business, personal data may transfer to the new owner under the same protections.
We do not sell personal data.
7. Transfers outside Singapore
Some of our service providers store or process data outside Singapore, including Singapore and the United States. Where we transfer personal data overseas, we take steps required by the PDPA to make sure it receives a standard of protection comparable to the PDPA, for example through contracts with our providers.
8. How long we keep personal data
- Enquiries: 12 months after the enquiry, then deleted or anonymised.
- Owner accounts and listings: while the account is active, and for 12 months after closure, unless we must keep records for legal, tax or dispute reasons.
- Listing approval and report records: 3 years after the listing is removed, so we can show what we checked and how we responded to reports. We keep this for legal claims and investigations.
- Bidding and payment records: 5 years, to meet accounting and tax requirements.
- Technical logs: 90 days.
When we no longer need personal data for any purpose, we stop keeping it or remove the means by which it can be linked to you.
9. Marketing messages
- We send marketing emails or messages only if you opt in.
- Every marketing message includes a clear way to unsubscribe, free of charge.
- We will not send marketing messages to a Singapore telephone number unless we have checked the Do Not Call Registry or have clear consent, as required by the PDPA.
10. Cookies and local storage
- We use essential cookies and similar technologies to keep you signed in and keep the site working.
- "My List" saves groups in your browser's local storage. This data stays on your device. We do not receive it, and clearing your browser data removes it.
- We use Google Analytics to understand how the site is used.
You can control cookies through your browser settings. Blocking essential cookies may stop parts of the site from working.
11. Your rights
Under the PDPA you may:
- Request access to the personal data we hold about you, and how it has been used or disclosed in the past year.
- Request correction of inaccurate or incomplete personal data.
- Withdraw consent to our use or disclosure of your personal data, for any purpose.
To make a request, email chloe@sgthirdspaces.com and include enough detail for us to verify your identity. We will respond within 30 days. If we cannot meet that timeline, we will tell you why and when we will respond. We may charge a reasonable fee for access requests, and we will tell you the fee before we process the request.
We may refuse a request where the PDPA allows it, and we will tell you the reason.
If you are not satisfied with our response, you may complain to the Personal Data Protection Commission (PDPC) of Singapore.
12. Children
The directory is not designed for children under 13. Owner accounts must be created by a person aged 18 or over. If we learn that we have collected personal data from a child without appropriate consent, we will delete it.
13. Security
We protect personal data with reasonable security arrangements, including:
- Encrypted connections (HTTPS).
- Passwordless email sign-in links for owners.
- Restricted admin access, with separate roles for administrators.
- Access limited to staff who need it.
- Our providers' security controls, under contract.
No online service is completely secure. Please protect your email account, because it controls access to your owner account.
14. Data breaches
If a data breach occurs that is likely to cause significant harm to affected individuals, or that involves 500 or more individuals, we will:
- Notify the PDPC as soon as practicable, and within 3 calendar days after we assess the breach is notifiable.
- Notify affected individuals as soon as practicable where required under the PDPA.
15. Links to other sites
Our listings link to group websites, Telegram, Instagram and other third-party services. Those services have their own privacy policies. We are not responsible for them.
16. Changes to this notice
We may update this notice from time to time. We will post the new version on this page and change the "Last updated" date. For material changes, we will also notify organisers by email where we hold an address.
17. Contact us
For any privacy question, request or complaint, email chloe@sgthirdspaces.com.
This notice is governed by the laws of the Republic of Singapore, including the PDPA.