Introduction
companion-co Pte Ltd, a company registered in Singapore ("we", "us", or "our"), operates Aven Vendors, the vendor portal of Aven (https://aven.wedding), where wedding vendors manage their storefront, packages, enquiries, bookings, contracts, and payments.
This Vendor Privacy Policy applies to vendor organisations and every individual who signs in to the vendor portal on their behalf (owners, admins, and members). Our general Privacy Policy continues to apply to anything not covered here.
This policy is intended to align with the Personal Data Protection Act 2012 (PDPA) of Singapore. By using Aven Vendors, you acknowledge that you have read this policy.
Information We Collect
We collect information you provide and information generated as you use the vendor portal:
- Account information from Google sign-in, such as your name, email address, profile photo, and Google account identifier.
- Business and verification information, such as your business name, entity type, registration number (e.g. UEN), business address, contact details, social links, and documents you submit for verification.
- Phone numbers you verify, including the owner's phone number.
- Storefront and catalog content, such as your store profile, photos, packages, add-ons, pricing, FAQs, and discount codes.
- Marketplace activity, including messages with couples, enquiries, booking requests, contracts, milestones, invoices, reviews, and disputes.
- Payment and payout information processed through our payment provider. We do not store full bank account or card numbers on our servers.
- Google Calendar data if you choose to connect it, used only to sync bookings you create.
- Technical and usage data, such as device type, browser, IP address, and pages or features accessed.
How We Use Your Information
We use vendor data to:
- Operate the vendor portal and display your storefront to couples.
- Verify your identity and business before your storefront goes live.
- Facilitate enquiries, bookings, contracts, and payments between you and couples.
- Provide customer support and troubleshoot problems with your account.
- Detect, investigate, and prevent fraud, abuse, policy violations, and security incidents.
- Enforce our Terms of Service and resolve disputes.
- Measure and improve the service, including aggregated insights about storefront performance.
- Send service, transactional, and (where permitted) marketing communications.
- Comply with legal, regulatory, tax, and accounting obligations.
Access by Aven Personnel
Authorised Aven personnel may access your vendor account and its data, including viewing your vendor portal as you see it, when reasonably necessary to provide support, help you complete onboarding, verify your business, investigate reports, disputes, fraud, or security issues, maintain and improve the service, or comply with law.
This access is:
- Limited to personnel whose role requires it, and granted only through internal controls that are not self-service.
- Read-only when we view your vendor portal on your behalf. We do not send messages, change bookings, or alter information shared with couples while doing so.
- Recorded in internal audit logs.
- Subject to confidentiality obligations.
We may not notify you each time your account is accessed for these purposes.
International Transfers
Our service providers may store or process data outside Singapore. Where we do so, we take steps to ensure the data receives a standard of protection comparable to the PDPA, including contractual safeguards.
Security
We use administrative, technical, and physical safeguards designed around recognised industry frameworks, including:
- Encryption of data in transit (TLS) and at rest by our infrastructure providers.
- Role-based access controls and least-privilege access for personnel.
- Audit logging of administrative access and sensitive actions.
- Use of reputable infrastructure providers that maintain their own independent security certifications.
- Ongoing monitoring, vulnerability management, and incident response procedures.
No system is completely secure. If we become aware of a data breach that is notifiable under the PDPA, we will notify affected individuals and the Personal Data Protection Commission as required.
Retention
We retain vendor data while your account is active and as long as needed for the purposes in this policy. After closure, we keep records of transactions, contracts, invoices, disputes, and verification for as long as required for legal, tax, accounting, and dispute-resolution purposes, then delete or anonymise them.
Messages and contracts you exchanged with couples form part of the couple's records too, and may be retained for their benefit.
Your Rights
Subject to the PDPA and applicable exceptions, you may:
- Request access to the personal data we hold about you and how it has been used or disclosed in the past year.
- Request correction of inaccurate or incomplete personal data.
- Withdraw consent for specific uses. This may affect our ability to provide the service, including keeping your storefront live.
- Request deletion of your account, subject to the retention obligations above.
To make a request, email admin@companion-co.com. We may need to verify your identity and will respond within a reasonable time.
Your Responsibilities
You receive personal data of couples and their guests through Aven. You must use it only to provide the services they booked, keep it secure, and comply with the PDPA and other applicable laws. You are responsible for the actions of members you invite to your vendor organisation.
Changes to This Policy
We may update this policy from time to time. We will post the updated version here with a new date, and notify you of material changes through the vendor portal or by email.
Contact Us
For questions about this policy or your personal data, contact our Data Protection Officer at admin@companion-co.com.