Privacy Policy

This policy explains how CrocsDeal handles personal information when you read the site, use its optional features or contact us. CrocsDeal is operated in Singapore by Webz Fusion (UEN: 53418515X), the organisation responsible for the processing described here. The business owner is our designated Data Protection Officer (DPO). Contact the DPO at support@crocsdeal.com, with “Privacy request” in the subject. You do not need an account to make a request.

Read our Cookie Policy for browser technologies and Privacy and Data Rights for regional rights, advertising choices, requests and complaints. Visiting or reading this policy is not consent to optional tracking. Mandatory rights under the law applicable to you take priority over this policy and our terms.

Information, purposes and recipients

• Page delivery and security: requests can disclose your IP address, requested address, time, referrer, browser/device details and security events to us and our hosting or security service providers. We use these records to deliver pages, investigate faults and abuse, and protect the publication. Search terms entered in the site's search address may appear in technical request records; do not enter sensitive personal information in a search.
• Messages and rights requests: if you contact us, we and our email providers process your email address, name if supplied, message and relevant correspondence to respond, investigate the issue and document its resolution. Please do not send passwords, full identity documents, medical records, payment-card details or information unrelated to the request.
• Optional analytics: after your separate analytics choice, Google Analytics 4 processes limited page-view and session information, device/browser and connection information. Details and safeguards appear below.
• Advertising and consent: Google AdSense, Google Privacy & Messaging and the participating advertising providers process information needed to present privacy choices, deliver and measure ads, prevent fraud and, where permitted, personalise advertising. This can include IP addresses, online identifiers, browser/device information, approximate location, page context, ad interactions and consent or opt-out records.
• Browser features you request: theme and notification preferences are stored on your device. Sharing controls open the service you choose or your device's share interface. The receiving service applies its own privacy terms. Merely opening a source-information popup does not fetch the external source; choosing to visit that source connects you to its website.
• Private administration: authorised editorial accounts use names, email addresses, authentication credentials, permissions, sessions and security/audit records. Passkeys store a public-key credential with us; fingerprint or face verification takes place through your device/authenticator, rather than supplying us with your biometric template.

Public reading does not require registration, payment or a purchase. CrocsDeal does not operate a retail checkout or collect card details. We do not need your precise location or sensitive health information to provide the publication. Public-source information about authors or subjects may appear in editorial content; privacy concerns about a particular passage can be sent to the DPO.

How we justify processing

In Singapore, we obtain consent where the PDPA requires it and use an exception only where its conditions are met. Information you provide to obtain a response is used for that purpose; it is not blanket permission for unrelated marketing. We notify you of materially different purposes and obtain a new choice where required.

Where the GDPR or UK GDPR applies, our purposes and bases are: consent for optional analytics and consent-dependent advertising/storage; legitimate interests in proportionate site security, technical operation and responding to ordinary enquiries, subject to your interests and rights; and compliance with a legal obligation where a law requires particular processing. A contract basis is used only where processing is necessary for an actual agreement with you. We do not treat legitimate interests as permission to bypass a required cookie or advertising consent.

Google AdSense and advertising partners

Eligible CrocsDeal pages carry Google AdSense ads. Google and other advertising providers can recognise earlier browsing on CrocsDeal and elsewhere through advertising cookies and similar technologies, and use that history to choose ads. Third parties may place or read cookies, use web beacons or process IP addresses and other identifiers in connection with ad delivery, measurement, security and permitted personalisation.

See how Google uses information from sites that use its services, Google's Privacy Policy and Google advertising technologies. Manage personalised Google advertising through My Ad Center. Participating companies also offer choices through the Digital Advertising Alliance opt-out tool; those choices do not cover every company or replace a required site consent.

Google Privacy & Messaging provides the applicable regional advertising message and its vendor/purpose information. Use the message's vendor controls for the parties offered to you and links to their privacy information. On ad-supported pages, the footer's Privacy and cookie settings control reopens Google's available choices. See advertising choices and opt-outs if the control is unavailable or you are reading an ad-free policy page.

For visitors in the EEA, UK and Switzerland, we use Google's certified consent platform for the required advertising choices. Personalised advertising requires the relevant valid consent. Consent-message and ad-delivery code may communicate with Google to establish your region and choices; the presence of that code is not itself a grant of consent. Non-personalised or restricted ads are not a promise that no data is processed or that all cookies are unnecessary.

Advertising identifiers, activity and inferred interests disclosed for cross-context behavioural advertising can be a “sale”, “sharing” or targeted advertising under some US privacy laws, even without a cash payment for the data. We therefore do not claim that advertising involves no sale or sharing. Applicable opt-outs and regional rights are described on the Data Rights page.

Separate analytics choice

Google Analytics 4 starts only after you select Allow analytics in CrocsDeal's Analytics preferences. Rejecting or closing the prompt does not allow collection. The footer control lets you change or withdraw that choice, including on legal pages. Accepting advertising choices does not grant analytics consent, and accepting analytics does not grant advertising personalisation consent.

Our analytics integration removes query strings and fragments from page addresses and reduces external referrers to their origin. It does not send account IDs or form values, and it disables Google Signals and advertising-personalisation signals. It does not load Analytics on administration, search, preview or legal pages. Google still receives technical connection information when a permitted request is made; this is not a claim that the information is anonymous.

Your browser's versioned analytics preference expires after 180 days. Analytics cookies have a configured 180-day lifetime that can refresh during permitted use. Withdrawal stops subsequent collection by this integration and removes its host-only analytics cookies; it does not erase records already received by Google. The configured event-level retention is two months and user-level retention fourteen months, with new activity able to reset the latter. Aggregated reports can have a different lifespan. Contact the DPO about data already collected.

Other disclosures and international processing

We disclose relevant information to providers acting for hosting, security, email and technical support, and to the Google/advertising services described above. Providers may act as processors or as separate controllers for their own stated purposes. We may also disclose information when a law requires it, to establish or defend legal claims, or as necessary for a genuine business transfer subject to applicable protections. We do not give advertisers access to private support or rights-request correspondence.

CrocsDeal is operated from Singapore. International service providers can process information in the United States and other countries where they or their subprocessors operate. Google's data-transfer framework information explains its stated transfer mechanisms. Advertising partners' locations and practices are described in their linked notices. These provider notices do not remove our responsibility for transfers we control.

Where a transfer requires safeguards, we must establish the applicable protection, such as comparable protection under Singapore's PDPA, or an applicable adequacy decision or contractual safeguards under European, UK or Swiss law. We do not claim that every destination has identical laws or that a provider is certified for every transfer. Ask the DPO for the recipients, destinations and safeguards relevant to your information, including how to obtain information about the safeguards.

Retention and security

Retention is tied to purpose, rather than keeping everything indefinitely. Technical records are needed for delivery, fault investigation and abuse prevention; correspondence for responding to and resolving the matter; account/security records for authorised administration and investigation; and a limited rights-request record for demonstrating how we handled the request. A legal hold, dispute or statutory duty can justify a longer period. When the purpose and applicable retention duties end, information should be deleted or de-identified. Browser-storage periods are listed in the Cookie Policy. Ask the DPO about the retention applicable to a specific record.

Access restrictions, secure connections and authentication help protect information. No system can guarantee absolute security. We assess suspected breaches and notify affected people and regulators when the applicable law requires it. Report a suspected privacy or security incident to the DPO without sending secrets in the initial message.

Children, sensitive information and automated decisions

This is a general-audience publication, not a service directed at children. We do not knowingly solicit children's personal information or knowingly use it for personalised advertising. Applicable protections and age thresholds vary by location. If you believe a child has supplied information or received inappropriate tracking, contact the DPO so the circumstances can be investigated and the necessary action taken. We do not require visitors to provide a date of birth or identity document just to read.

We do not use reader data to make decisions producing legal or similarly significant effects, such as credit or employment eligibility. Advertising providers may infer interests to select ads under the available choices. Our use of automation to prepare or check editorial content is a separate activity; it is not a personalised professional assessment of you.

Your rights and changes

The Data Rights page explains Singapore, European/UK/Swiss and other regional rights, response periods, authorised agents, appeals and regulator routes. Exercising a privacy choice does not prevent you from reading public articles. A request concerning our processing is not a waiver of a complaint to a regulator or a right that cannot be excluded.

We update the displayed date when this policy changes. New purposes or material changes to optional processing require appropriate notice and a renewed choice where required; continuing to browse does not provide that choice.