Privacy Policy

Last updated: 2 November 2026

1. About this policy

Brick Borrow Singapore ("we", "us" and "our") respects your privacy. This policy explains how we collect, use, disclose and protect personal data when you visit brickborrow.sg, create an account, use a membership, borrow or return LEGO® sets, purchase gift cards, or contact us. It is intended to explain our handling of personal data under Singapore's Personal Data Protection Act 2012 (PDPA).

2. Personal data we collect

Depending on how you use our services, we may collect:

Account and contact details, such as your name, email address, telephone number and account identifiers.
Delivery and billing details, including addresses and information needed to arrange deliveries and returns.
Transaction and service records, such as memberships, subscriptions, orders, requested or borrowed sets, returns, gift cards, payment status and transaction references.
Information you provide in enquiries, stock-alert requests, feedback and support messages, including attachments you choose to send.
Technical and usage information, such as IP address, browser and device information, pages visited, and cookie or similar technology data collected through the website and its service providers.

If you provide another person's details, for example a gift-card recipient or delivery contact, please ensure you are authorised to do so and let them know about this policy. Please provide only information that is relevant to your request.

3. How and why we use personal data

We use relevant personal data to create and administer accounts and memberships; process subscriptions, orders, payments and refunds; arrange borrowing, deliveries and returns; manage gift cards and requested stock alerts; answer enquiries and resolve service issues; send account, order and service notices; maintain website security and prevent misuse or fraud; understand website performance and improve our services; and meet legal, accounting and regulatory obligations or handle disputes.

We seek consent where the PDPA requires it and may also collect, use or disclose information where the law permits or requires this without consent. We will provide further notice and obtain additional consent when required for a new purpose.

4. Payments and service providers

Payments are handled through the payment services available at checkout. We use billing information, payment status and transaction references to administer purchases and subscriptions. The relevant payment provider's own privacy notice also applies to information it collects directly. Please do not email us full payment-card details.

We may disclose relevant personal data, where needed for the purposes described above, to Wix, which provides our website platform and associated services; payment providers; delivery, return and fulfilment providers; providers supporting our communications, IT and customer service; professional advisers; and authorities or other parties where disclosure is legally required or necessary to establish, exercise or defend legal rights. We limit disclosures to what is appropriate for the purpose.

5. Cookies and website technologies

Our website and its providers use cookies and similar technologies for functions such as sessions, sign-in, checkout and security. Depending on the features enabled, these technologies may also support preferences and usage analytics. We will seek consent for optional technologies where required by applicable law.

You can manage or delete cookies through your browser settings. Blocking some cookies may affect sign-in, checkout or other website functions. Wix explains its own data handling and technologies in the Wix Privacy Policy at wix.com/about/privacy. This policy does not control the practices of external websites you choose to visit.

6. Marketing and service messages

If you subscribe to or otherwise consent to marketing updates, we may use your contact details to send relevant news and offers. You can opt out using the unsubscribe option in a marketing message or by emailing us. Opting out of marketing does not stop essential messages about your account, subscription, orders, payments, deliveries or service requests.

7. Processing outside Singapore

Wix and other providers may store or process personal data outside Singapore. Where we transfer personal data overseas, we will take steps required under the PDPA to ensure a standard of protection comparable to that required in Singapore, including appropriate arrangements with relevant recipients. Wix's Privacy Policy provides information about its international processing.

8. Keeping information secure

We take reasonable technical and organisational measures to protect personal data against unauthorised access, use, disclosure, alteration or loss. Access is limited to people and providers who need the information for the relevant purposes. No internet transmission or storage system is completely secure. If a personal data breach requires notification under applicable law, we will notify the relevant regulator and affected individuals as required.

9. How long we keep personal data

We keep personal data while it is reasonably needed for the purposes described in this policy and for related business or legal requirements, including accounting, resolving disputes and preventing fraud. Closing an account does not necessarily require immediate deletion of every transaction record. We will cease retaining personal data, or remove the means of identifying individuals, when retention is no longer needed for those purposes or legal and business requirements.

10. Access, correction and consent withdrawal

You may request access to personal data we hold about you, information about its use or disclosure during the preceding year, or correction of inaccurate or incomplete information, subject to the PDPA's requirements and exceptions. Contact us using the email below. We may make reasonable identity checks before responding. If we propose charging a reasonable fee for an access request, we will provide a written estimate first. We do not charge for correction requests.

We aim to respond as soon as reasonably possible. If we cannot fulfil an access or correction request within 30 days after receiving it, we will notify you in writing within those 30 days of the time by which we will respond.

You may withdraw consent by giving us reasonable notice. We will explain the likely consequences, which may include being unable to continue a service that needs the relevant information. Once withdrawal takes effect, we will cease the relevant collection, use or disclosure unless required or authorised by law. Withdrawal does not affect earlier lawful handling or processing that the law otherwise permits or requires. You may also contact us about account closure or deletion; we will assess the request together with applicable retention requirements.

11. Children and family use

Parents or guardians should manage their children's use of our services and communications with us. Please avoid sending children's identifying details, photographs or other personal information unless relevant to a specific request. If you believe a child has provided personal data that needs attention, contact us so we can assess and address the matter appropriately.

12. Updates and privacy contact

We may update this policy as our services or legal requirements change. The latest version will be posted on this page with its update date. We will give additional notice and seek consent where the law requires it.

For privacy questions, access or correction requests, consent withdrawal, or concerns about our handling of personal data, contact Brick Borrow Singapore at hello@brickborrow.sg. Please use the subject line "Privacy request" and describe your request without including unnecessary sensitive information. We will direct it to the person responsible for personal data matters.