Privacy Policy
Last updated: 9 October 2026
1. Who we are
BTO Group Reno is a trading name of BTOGROUPRENO.SG PTE. LTD. (UEN 202427322E), 61 Woodlands Industrial Park E9 #02-14/15/16/24/26, E9 Premium, Singapore 757047. We provide renovation and carpentry services for HDB homeowners in Singapore. “We”, “us” and “our” mean BTOGROUPRENO.SG PTE. LTD.
Our Data Protection Officer is Pei Jia: [email protected], (+65) 8852 6257.
2. What we collect and why
| When | What we collect | Why |
|---|---|---|
| You ask for a VR tour on an estate page | Name, Singapore mobile number, the estate and design you opened. If you tick a box: the time, the page and the exact wording you ticked, as proof of what you agreed to. Our website platform also keeps a shortened IP address, your browser and device details, the page that referred you and a session identifier | To open the VR for you and, if you tick the first box, to call or WhatsApp you about renovation packages and quotations for that estate. The security and referral details keep the form safe and show which pages bring enquiries |
| You message us on WhatsApp (the “Get the VR on WhatsApp” button or the chat button) | Your WhatsApp number and name, and what you write. Some replies may be written by an AI assistant provided by Meta (Meta Business AI); our team can step in at any time | To reply and send what you asked for |
| You send a quotation request form | What you type in (for example name, mobile, email, estate, unit type), the page you were on, and how you found us | To prepare your quotation and reply to you about it. A few forms also have an optional box to hear about group-buy updates; we use your details that way only as described next to that box |
| You chat with our AI assistant | What you type, any name and mobile number you give, and your IP address | To answer you and pass your enquiry to our team |
| You order or become a customer | Name, address, contact details, order and project records, payment confirmation (we do not store card numbers) | To do the work, handle defects and warranty, and meet accounting and legal duties |
| You browse the site | Pages viewed, device and browser, approximate location, how you arrived, cookie identifiers | To run and improve the site and measure our advertising (section 8) |
| You comment or log in | What you enter, your IP address and browser string | To show your comment and detect spam |
We do not ask for NRIC numbers.
3. Calls, WhatsApp and marketing (VR form)
First box (required to unlock the VR with the form). If you tick it, you agree that we may call or WhatsApp you at the number you entered about renovation packages and quotations for that estate, even if your number is on the Do Not Call (DNC) Registry. We treat this permission as lasting 30 days from your submission, and after that we do not contact you about it unless you reply to us or ask us to.
Optional second box. If you tick it, you also agree that we may send you WhatsApp marketing messages about group-buy pricing and special offers for that estate, up to 4 a month, even if your number is on the DNC Registry. This continues until you opt out, until 12 months pass without a reply from you, or until we delete your details, whichever comes first.
You do not have to tick anything to get the VR. Use the “Get the VR on WhatsApp” button instead. We send the links in that chat and reply only to what you ask; we do not add you to marketing for this.
Our first message to you is a WhatsApp text that says who we are and how to stop. We call only after you reply or if you asked us to call. We do not record calls. We do not sell your details, and we do not give them to marketing agencies or other companies for their own marketing.
4. How to stop (withdraw)
Reply STOP to any of our WhatsApp messages, tell us on a call, or email [email protected]. We then stop all calls and messages to that number. The only exception is if you are already a customer: we will still send the messages we need to carry out your contract (for example appointment times, delivery, defects and warranty), but nothing else.
We aim to act the same working day, and no later than 10 working days after you tell us. After you withdraw:
- we keep only your mobile number, the date and how you withdrew on a do-not-contact list, so that we can show what you asked and do not contact you again;
- we delete your other details at the end of the retention period in section 6;
- the VR links you already opened keep working;
- ticking the boxes again on a later form does not cancel your withdrawal. If you want to hear from us again, write to [email protected] and we will check with you first.
If someone gave us your number without your permission, tell us at [email protected]. We will not contact you, and we keep only the number on our do-not-contact list so that it is not used again.
5. Who handles your data
We use these service providers. Most process data for us under their terms; Google and Meta also use some data from their analytics and advertising tools under their own privacy policies. Some are outside Singapore:
| Provider | For | Where |
|---|---|---|
| Our own web and mail servers | Website, database, staff email, backups | Singapore |
| Google (Analytics, Tag Manager, Ads, Sheets, Workspace) | Site measurement, advertising, spreadsheets and email | United States and the other countries where Google operates data centres |
| Meta (WhatsApp, WhatsApp AI assistant, advertising pixel) | Our WhatsApp chat, including AI-assisted replies, which Meta handles under its own terms; measuring our Facebook and Instagram ads | United States and the other countries where Meta operates |
| Brevo | Sending our website emails, including notification emails; Brevo logs copies for a limited time | European Union (France, Germany, Belgium) |
| Cloudflare | Spam check on forms | United States and the other countries where Cloudflare operates |
| Anthropic | Our chat assistant: what you type in the chat is sent to Anthropic’s servers to generate the answer | United States, and other regions where Anthropic processes data |
| Hotjar | Shows us how visitors use our pages; it masks what you type into form fields by default | Ireland (European Union) |
| Installation, delivery and subcontractor partners | Only after you become a customer, and only what they need to do the job | Singapore |
When data goes outside Singapore, we take steps to make sure the receiver protects it to a standard comparable to Singapore’s PDPA, mainly through the provider’s terms. We may also disclose data where the law requires it, for example to a regulator or a court.
The VR tour itself opens on Kujiale’s website (operated by Hangzhou Qunhe Information Technology, in China). When you open it, your browser connects directly to Kujiale, which can see your IP address and device details; what you do there is handled under Kujiale’s own privacy policy. We do not put your name or number in the link or send them to Kujiale.
6. How long we keep it
| Data | How long |
|---|---|
| VR form details if you never become a customer | 12 months from the day you submit, then deleted |
| AI-chat records (what you type in the chat) if you never become a customer | 12 months from the day you send them, then deleted |
| Quotation requests and AI-chat sign-ups (name and number) if you never become a customer | New entries are kept for up to 12 months. Entries older than that (from before October 2026) are being reviewed |
| WhatsApp conversations with us if you never become a customer | Deleted once there has been no message for 12 months |
| Customer records (contract, quotation, payment, project, warranty) | 6 years after the last transaction or warranty end, whichever is later, or longer if the law requires |
| Do-not-contact list (number, date, how you withdrew) | As long as needed to honour your withdrawal; we review it every year |
| Proof of consent (time, page, wording) | Kept with your record and deleted with it |
| Website analytics | As set in our Google Analytics account, never longer than 14 months |
| Comments | Until you ask us to remove them |
Copies in notification emails, sales spreadsheets and WhatsApp chats are cleared by our staff once a month, so they may stay up to a month longer. Backups are kept for up to 13 months and then deleted; if we ever restore from a backup, we delete again anything that should already have been deleted. Backups are not used to contact anyone. We keep data longer only when the law requires it or we need it to deal with a dispute.
7. Your rights
You can ask us to tell you what personal data we hold about you and how we use and disclose it, to correct it, to stop using it (section 4), or to delete what we no longer need to keep (we must or may keep some, for example for accounting or a warranty claim). Email [email protected]. We reply within 30 days and tell you if we need longer. We may ask you to prove who you are first. There may be a small fee for large access requests; we will tell you before charging.
8. Cookies and website tools
When you visit our site, we and our service providers set cookies and similar technologies. Some are needed to run the site. Others measure and improve it (Google Analytics, Hotjar) and measure our advertising (Google Ads, Meta). These load when you visit the page; we do not yet ask for your choice first. You can block or delete them in your browser settings, install a tracking-protection extension, or use the providers’ own opt-outs (the Google Analytics opt-out add-on, Google’s ad settings, Meta’s ad preferences and Hotjar’s do-not-track page). Blocking them will not stop you from using the site. Our Cookie Policy describes the types we use.
9. Protection, comments and links
Our site uses HTTPS. Admin access is limited to named staff and protected by extra login protections, and consent records are available only in our admin area. If a data breach is likely to cause you significant harm, or affects many people, we will tell the Personal Data Protection Commission within 3 calendar days of deciding it must be reported, and we will tell you where the law requires.
If you comment, we keep what you enter, your IP address and browser string to detect spam. An anonymised string from your email may be sent to Gravatar to check for a profile picture. Pages may embed videos or images from other sites, which collect data as if you had visited them directly. We are not responsible for other sites.
10. Changes
We post changes here and update the date at the top. If a change affects data you already gave us, we ask for your consent again where the law requires it.
11. Contact
BTOGROUPRENO.SG PTE. LTD. (UEN 202427322E), trading as BTO Group Reno
61 Woodlands Industrial Park E9 #02-14/15/16/24/26, E9 Premium, Singapore 757047
Data Protection Officer: Pei Jia · [email protected] · (+65) 8852 6257
