Privacy Notice

Overview

This notice explains how Kuro Cat Hotel & Resort collects, uses, discloses, and protects personal data under Singapore's Personal Data Protection Act 2012 (PDPA). It applies to the kurocats.sg website, bookings you place through our booking partner, and any communications you send us. We are the organisation responsible for personal data described below.

What We Collect

We collect only what the stay actually needs, plus what the law requires us to keep on file.

• Booking and stay details: When you book a stay, we collect your name, email address, phone number, the dates of stay, and details about your cat: name, breed, age, vaccination records, vet memo (if applicable), feeding and medical notes, and an emergency contact.
• Contact and enquiry messages: When you message us via WhatsApp, email, or any form on this site, we collect the content of your message and whatever identifiers you choose to share (name, phone, email).
• Payment information: Payments are processed by our booking partner Purrito (kuro.purrito.tech). We do not see or store your card details. Purrito retains only the minimum card information its payment processor requires for fraud checks and refund handling.
• Analytics and advertising: With your consent via the cookie banner, we use Google Analytics 4, Google Ads, and Meta Pixel to measure traffic, attribute conversions, and build retargeting audiences. These tools may collect IP address, device and browser data, approximate location, referring URL, and site interactions.
• Reviews and maps: If you leave us a review on Google, the review and any public profile data you chose to include are shown on Google's platforms. We see this data only in the same form any member of the public can see it. Google Maps interactions on our contact page are governed by Google's own privacy policy.
• Functional cookies: Cookie consent preferences are stored in a first-party cookie so the banner does not reappear on every visit.

Why We Use It

We use personal data to process and service your booking, keep your cat safe while in our care, handle payments and refunds, answer your questions, meet our record-keeping obligations under Singapore law, and (with your consent) measure how the website is performing and show advertising relevant to you.

Legal Basis Under PDPA

Personal data tied to your booking, the care of your cat, and our contractual obligations is processed under the PDPA's deemed consent provisions (Section 15) because it is necessary to provide the service you requested. Analytics and advertising cookies are processed only on your explicit consent, given through the cookie banner and withdrawable at any time.

Third-Party Processors

We share personal data only with the processors we rely on to run the hotel and the website:

• Vercel: Hosts the website and logs routine request metadata.
• Purrito (kuro.purrito.tech): Handles the booking form and payment flow.
• Google: Google Analytics 4 (traffic measurement), Google Ads (conversion tracking and remarketing), Google Maps (embedded on the contact page), Google Reviews (public review surface), and Google Tag Manager (loader for the above).
• Meta: Meta Pixel for Facebook and Instagram conversion tracking and retargeting.
• WhatsApp: End-to-end encrypted messaging when you initiate a chat with us.

Each processor handles data under its own privacy terms. Links to those terms are available on request.

Cross-Border Transfers

Several processors above host data outside Singapore, typically in the United States or the European Union. We rely on each processor's published safeguards and, where applicable, standard contractual clauses to meet the PDPA's requirement that transferred data receive a standard of protection comparable to the PDPA.

How Long We Keep It

We keep personal data only for as long as the purpose it was collected for requires, plus any period the law or our contracts demand:

• Booking records: 3 years from the end of the stay. Lets us respond to follow-up questions, handle disputes, and honour repeat customers.
• Payment records: 5 years per ACRA and IRAS record-keeping rules.
• Contact messages that do not convert to a booking: 12 months.
• Cat medical notes and vet memos: retained alongside booking records and deleted at the same time.
• Google Analytics 4 data: 14 months (Google's default retention).
• Advertising cookies set by Google Ads and Meta: per the provider's own default, typically 30 to 90 days.
• Cookie consent preferences: 12 months, after which the banner reappears.

Cookies and Consent

The cookie banner splits cookies into Necessary, Analytics, and Advertising. Selecting 'Necessary Only' disables Google Analytics, Google Ads, and Meta Pixel for your session. You can change your selection any time via the banner or by clearing site data in your browser.

Your Rights Under PDPA

Under the PDPA you have the right to:

• Access: request a copy of the personal data we hold about you.
• Correction: ask us to update data that is inaccurate or incomplete.
• Withdrawal: withdraw consent to the collection, use, or disclosure of your personal data for any purpose.
• Complaint: lodge a complaint with Singapore's Personal Data Protection Commission (PDPC) at pdpc.gov.sg.

How to Make a Request

To submit an access, correction, or withdrawal request, email contact@kurocats.sg with the subject line 'Data Request'. We will acknowledge receipt within fourteen business days and respond substantively within 30 calendar days. If we cannot meet that window we will tell you why and give a revised timeline.

Security

We protect personal data with TLS encryption in transit, access controls on our booking and hosting providers, and a limited internal team authorised to handle booking data. We notify affected individuals and the PDPC of any data breach that meets the PDPA notification threshold.

Children's Data

We do not knowingly collect personal data from anyone under 13. If you believe we have collected data from a child without parental consent, email contact@kurocats.sg and we will delete it.

Changes to This Notice

We may update this notice as the business evolves or the law changes. Material changes will be flagged at the top of this page. The 'Last updated' date below always reflects the most recent revision.

Contact the Data Protection Officer

For complaints unresolved after contacting us, you may lodge a complaint with Singapore's Personal Data Protection Commission at pdpc.gov.sg.