TWOOAK Mobile Privacy Policy

Last Updated: 3 August 2026

1. Introduction

WDNS PTE. LTD. ("TWOOAK", the "Company") respects the privacy of its users and is committed to protecting Personal Information in accordance with applicable data protection laws. This Privacy Policy describes how TWOOAK collects, uses, discloses, stores and otherwise processes Personal Information collected through the TWOOAK Customer Loyalty Programme, the TWOOAK mobile application and any related products or services (collectively, the "Service"). Users are encouraged to read this Privacy Policy carefully before accessing or using the Service or providing any Personal Information. By accessing or using the Service or by providing Personal Information to TWOOAK, the User acknowledges that the User has read, understood and accepted this Privacy Policy.

2. Use by Minors

If the User is under eighteen (18) years of age, the User should review these Privacy Policies together with the User's parent or legal guardian to ensure that both the User and the User's parent or legal guardian understand and accept these Privacy Policies.

3. Collection of Personal Information

TWOOAK may collect Personal Information from the User in connection with registration, account management, participation in the Rewards Programme, purchases, promotions, surveys, customer support requests or other activities made available through the Service.

Depending on the services requested, TWOOAK may collect information including but not limited to:

  • Name

  • Mobile Number

  • Email Address;

  • Transaction history

  • Survey responses

  • Reviews; and

  • Purchase information relating to participating merchants.

Where particular information is mandatory for the provision of a service, TWOOAK will identify the required information at the point of collection. TWOOAK may combine Personal Information collected through the Service with information obtained:

  • from previous transactions;

  • through offline interactions;

  • From online transactions;

  • from affiliated companies;

  • from business partners;

  • from publicly available sources, including publicly accessible social media profiles; and

  • from other lawful third-party sources.

Where the User provides Personal Information relating to another individual, the User represents and warrants that the User has obtained all necessary authority and consent to provide such information to TWOOAK and to permit TWOOAK to collect, use and disclose that information in accordance with this Privacy Policy.

4. Device Information

TWOOAK may collect technical information relating to the User's device, including:

  • unique device identifiers;

  • device model;

  • operating system;

  • operating system version;

  • application version;

  • device language;

  • device settings; and

  • other technical identifiers reasonably necessary for operation of the Service.

Such information assists TWOOAK in operating, maintaining, improving the Service.

5. Sensitive Personal Information

Unless specifically requested by TWOOAK, Users should not submit sensitive Personal Information through the Service. Where TWOOAK expressly requests Sensitive Personal Information, such information shall be collected, used and processed only for the purposes stated at the time of collection and in accordance with applicable law.

6. Automatic Collection of Information

TWOOAK and its authorised service providers may automatically collect certain information when the User accesses or uses the Service. Such information assists TWOOAK in ensuring the proper operation, security, performance and continuous improvement of the Service.

6.1 Browser and Device Information

Depending on the User's device and browser, TWOOAK may automatically collect information including:

  • Media Access Control (MAC) address;

  • Internet Protocol (IP) address;

  • browser type;

  • browser version;

  • operating system;

  • operating system version;

  • screen resolution;

  • device model;

  • device identifier;

  • language settings;

  • application version; and

  • other technical information required for compatibility and diagnostics.

This information is collected to ensure proper functionality, troubleshoot technical issues, improve performance and maintain security.

6.2 Cookies and Similar Technologies

TWOOAK and its authorised service providers may use cookies, software development kits (SDKs), local storage, pixels and similar technologies to collect information regarding the User's interaction with the Service.

These technologies may be used to:

  • recognise returning Users;

  • maintain login sessions;

  • remember user preferences;

  • improve application performance;

  • personalise content and promotions;

  • analyse usage patterns;

  • measure the effectiveness of advertising campaigns;

  • improve customer experience; and

  • enhance security.

7. Collection, Use and Disclosure of Personal Information

TWOOAK collects, uses and discloses Personal Information only for purposes permitted by applicable law and consistent with this Privacy Policy. Where required by applicable law, TWOOAK shall obtain the User's consent before collecting, using or disclosing Personal Information. TWOOAK may also process Personal Information where such processing is necessary:

  • for the performance of a contract with the User;

  • to comply with legal or regulatory obligations;

  • for the establishment, exercise or defence of legal claims;

  • to protect the vital interests of an individual where permitted by law; or

  • for TWOOAK's legitimate business interests, provided such interests are not overridden by the rights and interests of the User.

8. Purposes of Processing

TWOOAK may collect, use and process Personal Information for one or more of the following purposes:

8.1 Provision of the Service

Personal Information may be processed to:

  • register and administer the User's account;

  • authenticate the User;

  • administer the TWOOAK Rewards Programme;

  • process purchases, orders and voucher redemptions;

  • manage loyalty points and membership status;

  • verify eligibility for promotions and rewards;

  • provide customer support;

  • respond to enquiries and complaints;

  • provide requested products or services; and

  • communicate with the User regarding the Service.

8.2 Administrative Communications

TWOOAK may use Personal Information to send communications relating to:

  • account administration;

  • security notifications;

  • password resets;

  • transaction confirmations;

  • purchase receipts;

  • changes to the Service;

  • amendments to legal terms;

  • policy updates; and

  • other operational or administrative matters.

These communications form part of the operation of the Service and may not be capable of being opted out of where they are necessary for the provision of the Service or compliance with applicable law.

8.3 Customer Support

TWOOAK may process Personal Information to:

  • investigate customer enquiries;

  • resolve complaints;

  • verify identity;

  • provide technical assistance;

  • improve customer service; and

  • maintain records relating to customer interactions.

8.4 Business Operations

TWOOAK may process Personal Information for legitimate business purposes including:

  • data analytics;

  • reporting;

  • internal administration;

  • accounting;

  • auditing;

  • fraud prevention;

  • cybersecurity;

  • risk management;

  • regulatory compliance;

  • quality assurance;

  • business continuity;

  • product development;

  • service improvement; and

  • operational planning.

8.5 Personalisation

Where permitted by applicable law, TWOOAK may analyse Personal Information to:

  • understand customer preferences;

  • personalise the User's experience;

  • recommend products or services;

  • customise promotions;

  • improve marketing relevance; and

  • tailor content displayed through the Service.

Where consent is required for personalisation activities, TWOOAK shall obtain such consent before processing Personal Information for those purposes.

8.6 Marketing

Subject to applicable law and the User's marketing preferences, TWOOAK may use Personal Information to send:

  • promotional offers;

  • newsletters;

  • event invitations;

  • loyalty programme updates;

  • product recommendations;

  • promotional campaigns; and

  • other marketing communications.

Marketing communications may be delivered by:

  • email;

  • SMS;

  • push notifications;

  • telephone;

  • postal mail; or

  • other communication channels authorised by applicable law.

9. Disclosure of Personal Information

TWOOAK may disclose Personal Information where reasonably necessary for the purposes described in this Privacy Policy.

Recipients may include:

9.1 Affiliates

TWOOAK may disclose Personal Information to affiliated companies within its corporate group for purposes consistent with this Privacy Policy.

9.2 Service Providers

TWOOAK may disclose Personal Information to authorised third-party service providers engaged to perform services on TWOOAK's behalf.

Such services may include:

  • cloud hosting;

  • infrastructure services;

  • payment processing;

  • customer support;

  • software development;

  • application hosting;

  • analytics;

  • cybersecurity;

  • fraud prevention;

  • data storage;

  • auditing;

  • marketing;

  • email delivery;

  • SMS delivery;

  • logistics;

  • voucher management; and

  • other operational support services.

Service providers are authorised to process Personal Information only to the extent necessary to perform contracted services and are required to implement appropriate security measures.

9.3 Business Transactions

Personal Information may be disclosed where reasonably necessary in connection with:

  • a merger;

  • acquisition;

  • restructuring;

  • sale of assets;

  • corporate reorganisation;

  • joint venture;

  • financing transaction;

  • insolvency proceeding; or

  • similar corporate transaction.

Where required by applicable law, TWOOAK shall take reasonable steps to ensure that any successor organisation continues to protect Personal Information in accordance with applicable legal requirements.

9.4 Legal Requirements

TWOOAK may disclose Personal Information where disclosure is required or permitted by applicable law, including where necessary to:

  • comply with legal process;

  • comply with court orders;

  • comply with regulatory requirements;

  • respond to requests from law enforcement agencies;

  • respond to requests from governmental authorities;

  • protect TWOOAK's legal rights;

  • investigate suspected fraud;

  • prevent unlawful activity;

  • protect public safety; or

  • establish, exercise or defend legal claims.

9.5 Other Disclosures

Where required by applicable law, TWOOAK shall obtain the User's consent before disclosing Personal Information for purposes not otherwise described in this Privacy Policy.

10. Non-Personal Information

Where permitted by applicable law, TWOOAK may collect, use, disclose and process information that does not identify an individual for any lawful purpose. Where non-personal information is combined with Personal Information in a manner that identifies an individual, the combined information shall be treated as Personal Information for as long as it remains identifiable.

11. Marketing Preferences

The User may opt out of receiving marketing communications from TWOOAK at any time. An opt-out request may be submitted by sending an email to hello@twooak.com 

TWOOAK shall process opt-out requests as soon as reasonably practicable.

12. Access, Correction and Deletion

Subject to applicable law, the User may request to:

  • access Personal Information;

  • correct inaccurate Personal Information;

  • update Personal Information;

  • restrict processing of Personal Information;

  • withdraw consent where consent forms the basis of processing;

  • request deletion of Personal Information; or

  • exercise any other applicable privacy rights.

Requests may be submitted by contacting TWOOAK at: hello@twooak.com

TWOOAK shall respond to valid requests within the timeframe required under applicable law.

Where additional time is reasonably required, TWOOAK shall notify the User of the delay and provide an estimated response date where required by law.

13. Cross-Border Transfer of Personal Information

Personal Information collected by TWOOAK may be stored, accessed, processed or transferred to countries outside the User's country of residence where TWOOAK, its affiliates or authorised service providers maintain facilities or operations. Such countries may have data protection laws that differ from those applicable in the User's country of residence.

Where Personal Information is transferred outside the User's country of residence, TWOOAK shall implement appropriate contractual, technical and organisational safeguards to protect Personal Information in accordance with applicable data protection laws.

By using the Service or providing consent where required by applicable law, the User acknowledges that Personal Information may be transferred, stored and processed in countries outside the User's country of residence.

14. Security of Personal Information

TWOOAK implements reasonable technical, organisational and administrative safeguards designed to protect Personal Information against:

  • unauthorised access;

  • unauthorised disclosure;

  • misuse;

  • alteration;

  • loss;

  • destruction; and

  • other forms of unlawful processing.

Security measures may include:

  • access controls;

  • authentication mechanisms;

  • encryption technologies;

  • monitoring systems;

  • security reviews;

  • internal policies and procedures; and

  • contractual obligations imposed on service providers.

However, no method of transmission over the Internet or method of electronic storage can be guaranteed to be completely secure. Accordingly, TWOOAK cannot guarantee absolute security of Personal Information. If the User believes that the security of the User's account or Personal Information has been compromised, the User should notify TWOOAK immediately using the contact details provided in this Privacy Policy.

15. Data Breach Notification

Where TWOOAK becomes aware of a data breach involving Personal Information, TWOOAK shall assess the nature and severity of the incident and take appropriate measures to contain, investigate and remediate the breach.

Where notification is required under applicable law, TWOOAK shall notify:

  • affected individuals; and

  • relevant regulatory authorities,

within the applicable legal timeframe.

Notification may include information regarding:

  • the nature of the breach;

  • categories of affected Personal Information;

  • potential impact;

  • remedial measures taken;

  • recommended steps for affected individuals; and

  • contact information for further enquiries.

16. Retention of Personal Information

TWOOAK shall retain Personal Information for as long as reasonably necessary to fulfil the purposes for which the information was collected, including:

  • providing and maintaining the Service;

  • administering accounts;

  • maintaining transaction records;

  • managing loyalty programme activities;

  • complying with legal obligations;

  • resolving disputes;

  • preventing fraud;

  • enforcing agreements;

  • conducting audits; and

  • protecting TWOOAK's legal rights.

The factors considered when determining retention periods may include:

(a) the duration of the User's relationship with TWOOAK;

(b) whether TWOOAK has ongoing obligations to provide services to the User;

(c) whether retention is required by law or regulation;

(d) whether retention is necessary for accounting, taxation or audit purposes; and

(e) whether retention is necessary for the establishment, exercise or defence of legal claims.

When Personal Information is no longer required, TWOOAK shall take reasonable steps to securely delete, anonymise or dispose of such information in accordance with applicable law and internal retention practices.

17. Third-Party Sites and Services

TWOOAK engages trusted third-party service providers to support the operation, maintenance, security and improvement of the TWOOAK application and related services.

Such third-party providers process Personal Information only as necessary to provide contracted services on behalf of TWOOAK and in accordance with their respective privacy obligations.

TWOOAK's third-party service providers including but not limited to the following:

Supabase

Provides backend infrastructure, authentication services, database management and secure data storage.

Cloudflare

Provides infrastructure services, API hosting, security protection and performance optimisation.

Shopify

Provides e-commerce services, customer account management, purchase history management and prescription-related order information processing.

Google Maps Platform

Provides mapping services, geolocation functionality, store location features and nearby store functionality.

Sentry

Provides application monitoring, analytics, crash reporting, error tracking and diagnostics.

These third-party providers maintain their own privacy policies governing their collection, use and protection of Personal Information.

Users are encouraged to review the privacy policies of such third-party providers.

18. Application Permissions

To provide certain features and functionality, the TWOOAK application may request access to certain device permissions.

These permissions may include:

19.1 Camera Access

Camera access may be requested to enable:

  • QR code scanning;

  • barcode scanning; and

  • other scanning-related functions.

19.2 Location Access

Location access may be requested to provide:

  • nearby store information;

  • location-based services;

  • store discovery features; and

  • relevant promotions.

19.3 Notifications

Notification access may be requested to send:

  • promotional messages;

  • order updates;

  • account notifications;

  • reminders;

  • loyalty programme updates; and

  • important service communications.

19.4 Biometric Authentication

Where supported by the User's device, biometric authentication features such as Face ID, Touch ID or Android biometric authentication may be used to enable secure and convenient account access. The User may enable, disable, grant or revoke device permissions through the User's device settings. Disabling certain permissions may affect the availability or functionality of specific features within the Application.

20. Contacting TWOOAK

WDNS PTE. LTD.

43 North Canal Road
#02-01
Singapore 059299

is responsible for the collection, use and disclosure of Personal Information under this Privacy Policy. Any questions, requests, complaints or enquiries regarding this Privacy Policy or TWOOAK's handling of Personal Information may be submitted by email to: hello@twooak.com

21. Changes to This Privacy Policy

TWOOAK reserves the right to amend, update or revise this Privacy Policy from time to time.

Any revised Privacy Policy shall become effective when published through the Service or otherwise made available by TWOOAK. The User's continued access to or use of the Service after such changes become effective constitutes acceptance of the revised Privacy Policy.

TWOOAK recommends that Users review this Privacy Policy periodically to remain informed about how Personal Information is collected, used, disclosed and protected.

This Privacy Policy was last updated on 3 August 2026.