FinMet.SG

Privacy Policy

Website: finmet.sg

Last updated: 16 October 2026

Contents

1. INTRODUCTION

1.1 FINMET PTE. LTD. (UEN 202022529N), trading as FinMet (the "Company", "we", "us" or "our"), is committed to protecting the confidentiality and privacy of personal data.

1.2 This Privacy Policy explains how we collect, use, disclose, store and protect personal data in accordance with the Personal Data Protection Act 2012 of Singapore ("PDPA").

1.3 This Privacy Policy applies to all personal data collected by us in connection with access to and use of finmet.sg (the "Website"), creation and administration of customer accounts, use of our price checker, purchases and sales of physical gold, sell-back, withdrawal, redemption, collection, delivery, vaulting or custody-related arrangements, payment processing, customer support, and any related services offered by FinMet.

1.4 By accessing the Website, creating an account, placing an order, using our price checker, buying, holding, selling, redeeming or collecting gold, requesting delivery of gold, communicating with us, or otherwise providing personal data to us, you acknowledge and consent to the collection, use and disclosure of personal data in accordance with this Privacy Policy, unless such consent is not required under applicable law.

1.5 This Privacy Policy should be read together with our terms and conditions, transaction terms, payment terms, delivery terms, account notices, cookie notices and any other terms or notices that apply to your use of our Website or services.

1.6 Our services are intended for individuals who are at least 18 years of age and who have the legal capacity to enter into transactions with us. We do not knowingly collect personal data from minors. If we become aware that we have inadvertently collected personal data from a minor without appropriate consent, we will take reasonable steps to delete, destroy or anonymise that data, unless retention is required or permitted by law.

2. PERSONAL DATA WE COLLECT

2.1 "Personal Data" means data, whether true or not, about an individual who can be identified from that data, or from that data and other information to which we have or are likely to have access.

2.2 We may collect the following types of personal data from individual customers, account users, authorised representatives, payors, delivery recipients, beneficial owners, directors, shareholders, officers, employees, agents and other relevant persons:

1. full name and any aliases or preferred names;
2. NRIC, FIN, passport number or other government-issued identification number, where required or permitted by law;
3. date of birth, nationality, citizenship, country of residence and tax-residency information where relevant;
4. residential address, mailing address, billing address, delivery address and collection details;
5. contact number, email address and other communication details;
6. occupation, employer, business activity and employment or professional information;
7. bank account details, payment account details, PayNow proxy identifiers (a mobile number or NRIC/FIN linked to your bank account), remitter details, payee details, payment references, refund instructions and related payment information;
8. account information, login details, authentication settings, security records, account status, communication preferences and consent records;
9. transaction history, order records, Gold Balance, gram holdings, pricing records, quote and price-lock records, average purchase price, sell-back, withdrawal, redemption, allocation, storage, vaulting, custody, collection, Handover Record, delivery and proof-of-delivery records;
10. copies of identification documents, photographs, signatures, authority documents, verification records and customer due-diligence information;
11. source-of-funds, source-of-wealth, beneficial-ownership, politically exposed person, sanctions-screening, adverse-media, fraud-risk and customer-risk information, including, for fraud-prevention purposes, the result of matching the masked account-holder name returned by your bank against your identity before releasing payout funds;
12. communications with us, including enquiries, support requests, complaints, feedback, messages, emails, call notes and survey responses;
13. website, device and usage data, including IP address, browser type, device identifiers, operating system, referral source, pages viewed, time spent on the Website, cookies, analytics data and interactions with our price checker or other online tools; and
14. any other information required for account administration, customer support, transaction processing, compliance, audit, tax, accounting, security, fraud-prevention, dispute-resolution, legal or regulatory purposes.

2.3 We generally collect high-identification information, such as NRIC, FIN, passport numbers and copies of identification documents, only where required or reasonably necessary for identity verification, AML/CFT/CPF checks, transaction verification, account security, fraud prevention, dispute resolution or other purposes permitted by law.

2.4 Where you verify your identity using Singpass, we retrieve the following particulars from the Government's Myinfo service, with your consent given on the Singpass consent screen: your NRIC/FIN; principal name and any alias, married or Hanyu Pinyin names; sex; race; date of birth; residential status; nationality/citizenship; pass type, pass status and pass expiry date (where applicable); employment sector; mobile number; email address; and registered address. This data forms part of our customer due-diligence records. Singpass verification is required before you can transact, and this is why customers are not required to upload identification documents; a manual form is available if you prefer to enter your Singpass particulars yourself. Where you sign in with Singpass login, Singpass authenticates you and provides us with your NRIC/FIN so that we can match you to your account; no Myinfo particulars are retrieved at login. Both the Myinfo retrieval and Singpass login use the Singpass gateway, but only the Myinfo retrieval at your first purchase collects your personal particulars.

2.5 Where you provide us with personal data relating to any other individual, including an authorised representative, delivery recipient, beneficiary or other relevant person, you represent and warrant that you have obtained that individual's consent (or are otherwise entitled under the PDPA) to disclose their personal data to us and to permit us to collect, use and disclose it for the purposes set out in this Privacy Policy. You agree to bring the relevant terms of this Privacy Policy to that individual's attention.

2.6 If you visit our office, a collection point, or any physical premises operated by us or our partners, we may collect your image and related personal data through CCTV, visitor-registration systems or other physical security measures, for security, fraud-prevention, incident-investigation and access-control purposes.

2.7 Where a corporate entity contacts us at info@finmet.sg to discuss a bespoke order, we collect the personal data of the individuals who deal with us on that entity's behalf, such as name, business contact details, role and correspondence, together with any identification, authority or due-diligence documents we are required to obtain before transacting. We use that data to respond to the enquiry, to carry out customer due diligence and to administer any resulting arrangement. Information about the entity itself is not personal data, but where it identifies an individual it is handled under this Policy.

2.8 When you collect redeemed gold in person, we check your identity against your original NRIC or work pass card, or the Digital IC in your Singpass app. We record your full NRIC or FIN number, the serial number, refiner and weight of each bar handed over to you, and your signature and that of our representative, in a Handover Record. We record your full NRIC or FIN number at this point because we need to establish accurately that your gold is handed over only to you, and because we are required to keep records of the transaction under the Precious Stones and Precious Metals (Prevention of Money Laundering, Terrorism Financing and Proliferation Financing) Act 2019. The Handover Record forms part of our transaction records and is retained in accordance with Section 6.

3. PURPOSES OF COLLECTION

3.1 We collect, use and disclose personal data for the following purposes:

1. processing purchases, sales, sell-backs, withdrawals, redemptions, collection appointments and handovers, physical-delivery requests, refunds, invoices, receipts, account statements and other transactions;
2. administering, maintaining, verifying, securing, suspending or closing customer accounts and related services;
3. providing and operating the Website, the FinMet account dashboard, the price checker, pricing tools, live or indicative pricing, quote and price-lock functions, transparent fee calculations and our gold purchase, sell-back and redemption services;
4. recording and managing Gold Balances, gram holdings, allocation records, custody or vaulting records, Handover Records and delivery records;
5. sourcing, allocating, storing, insuring, auditing, delivering, redeeming or selling back the physical gold allocated to customers;
6. processing payments, withdrawals, refunds, chargebacks, settlement, reconciliations, failed payments and payment disputes;
7. conducting customer due diligence, enhanced due diligence, ongoing monitoring, sanctions screening, politically exposed person screening, adverse-media checks, source-of-funds and source-of-wealth checks, fraud checks and customer-risk assessments;
8. verifying identity, authority, ownership, beneficial ownership, payment source, delivery recipient details, transaction purpose and the accuracy of information provided to us, including at the handover of redeemed gold;
9. complying with legal, regulatory, tax, accounting, audit, AML/CFT/CPF, sanctions, reporting, record-keeping, court, regulatory and law-enforcement obligations;
10. detecting, preventing, investigating and responding to fraud, scams, suspicious transactions, unauthorised access, misuse, cyber incidents, payment issues, identity theft and unlawful or harmful activity;
11. responding to enquiries, requests, instructions, complaints, feedback, access requests, correction requests and withdrawal-of-consent requests;
12. communicating with you about accounts, orders, holdings, prices, quotes and price locks, confirmations, payments, withdrawals, collection appointments, delivery, customer support, security alerts, service changes, policy updates and legal notices;
13. maintaining internal records, audit trails, compliance files, management reporting, insurance records, business continuity records and operational records;
14. improving, testing, maintaining, personalising and securing our Website, systems, technology, processes, products, services and customer experience;
15. sending marketing, educational materials, service updates, market updates, newsletters, promotions or event invitations where you have consented or where permitted by law;
16. protecting our rights, property, employees, customers, Website, systems, legal position, commercial interests and reputation;
17. enforcing our terms and conditions, transaction terms, payment terms, account rules and legal rights;
18. evaluating or carrying out any merger, acquisition, restructuring, financing, sale of assets, capital-raising, insolvency process, business transfer or similar corporate transaction; and
19. any other purpose that we notify to you, or that is required or permitted by the PDPA or other applicable law.

3.2 We may use aggregated, anonymised or de-identified information for analytics, benchmarking, service improvement, security, reporting, product development and business purposes, provided that such information does not identify you.

4. LEGAL AND REGULATORY DISCLOSURES

4.1 We may disclose personal data where required or permitted by law, regulation, regulatory authority, court order, law-enforcement request, tax authority, customs authority, dispute-resolution body or other competent authority.

4.2 Because FinMet's services involve physical gold, precious metals, sell-back, redemption, delivery, custody-related arrangements and related transaction records, we may collect, verify, retain and disclose personal data for AML/CFT/CPF, sanctions, tax, accounting, audit, fraud-prevention, precious-metals regulatory and other compliance purposes.

4.3 Under the Precious Stones and Precious Metals (Prevention of Money Laundering, Terrorism Financing and Proliferation Financing) Act 2019, the Precious Stones and Precious Metals (Prevention of Money Laundering and Terrorism Financing) Regulations and other applicable laws, we may disclose information to competent authorities without prior notice.

4.4 We may file, support or assist with suspicious transaction reports, cash transaction reports, sanctions reports, fraud reports, police reports, regulatory filings, audit responses or other legally required notifications where required or permitted.

4.5 We may conduct due-diligence checks before, during or after account opening, order placement, payment, withdrawal, sell-back, redemption, collection, delivery or other transaction activity.

4.6 If we are unable to verify your identity, authority, ownership, payment source, source of funds, source of wealth, beneficial ownership, delivery details or transaction purpose to our satisfaction, we may delay, reject, suspend, terminate, reverse or refuse an account, order, delivery, withdrawal, redemption, sell-back, payment or transaction.

4.7 We may be prohibited by law from notifying you about certain checks, reports, disclosures, investigations or actions, including where notification may constitute tipping-off or may prejudice an investigation.

4.8 Some of our verification, fraud-prevention and risk-assessment processes, including sanctions screening, source-of-funds and source-of-wealth checks, and transaction monitoring, may involve automated or algorithm-assisted screening and scoring. Where such a process contributes to a decision under paragraph 4.6 to delay, reject, suspend, terminate, reverse or refuse an account, order or transaction, you may request that the decision be reviewed by a member of our team by contacting our Data Protection Officer using the details in Section 13.

5. DISCLOSURE TO THIRD PARTIES

5.1 We do not sell personal data. We may disclose personal data to third parties where reasonably necessary for the purposes described in this Privacy Policy, including:

1. banks, payment service providers, payment gateways, settlement providers, remittance providers and refund providers;
2. identity-verification, KYC, AML/CFT/CPF, sanctions-screening, fraud-prevention, cybersecurity, analytics and risk-management providers;
3. vaulting, custody, storage, bullion, refinery, supplier, certification, assay, audit, insurance and logistics partners;
4. couriers, delivery companies, collection-point operators, fulfilment providers and proof-of-delivery providers;
5. professional advisers, lawyers, auditors, accountants, tax advisers, compliance consultants, insurers and corporate advisers;
6. regulators, law-enforcement agencies, government agencies, tax authorities, customs authorities, courts, tribunals and dispute-resolution bodies;
7. IT service providers, cloud-hosting providers, database providers, software vendors, email and communications providers, data-storage providers and system vendors;
8. affiliates, related companies, financiers, acquirers, successors, assignees or parties involved in a merger, acquisition, financing, restructuring, sale of assets, business transfer or similar transaction;
9. persons authorised by you, including your representatives, agents, advisers and authorised account users; and
10. any other person to whom disclosure is required or permitted by law, necessary to protect our rights, or necessary to provide our services.

5.2 Third parties engaged by us to process personal data are required to maintain confidentiality and data-protection standards consistent with the PDPA and to use personal data only for authorised purposes, subject to applicable law and contractual obligations.

6. DATA RETENTION

6.1 We retain personal data only for as long as necessary to fulfil the purposes set out in this Privacy Policy, to provide our services, to maintain business and transaction records, to comply with legal and regulatory obligations, to resolve disputes, to enforce agreements, to protect our rights and for audit, tax, accounting, insurance, compliance and security purposes.

6.2 For regulatory compliance, certain customer due-diligence, AML/CFT/CPF, transaction, payment, redemption and handover, delivery, account, tax, accounting and compliance records may be retained for a minimum of five (5) years or such longer period as required or permitted by applicable law, regulator request, investigation, audit, tax requirement, insurance requirement, dispute or legal proceeding.

6.3 If your account is closed, suspended, rejected or terminated, we may continue to retain relevant personal data where necessary for legal, regulatory, compliance, fraud-prevention, dispute-resolution, audit, tax, accounting, enforcement or record-keeping purposes.

6.4 When personal data is no longer required, we will take reasonable steps to securely destroy, delete, anonymise or de-identify it, unless retention is required or permitted by law.

6.5 We do not offer deletion of accounts or account records. A request to delete personal data or account records may be declined where retention is required or permitted by law, including the five (5) year record-keeping obligations under the Precious Stones and Precious Metals (Prevention of Money Laundering, Terrorism Financing and Proliferation Financing) Act 2019.

7. DATA SECURITY

7.1 We implement reasonable administrative, physical, operational and technical safeguards to protect personal data from unauthorised access, collection, use, disclosure, copying, modification, disposal, loss, misuse or similar risks.

7.2 Safeguards may include access controls, authentication, encryption, firewalls, monitoring, audit logs, data minimisation, staff training, vendor due diligence, incident-response procedures, secure document handling, secure payment workflows and physical security measures.

7.3 Despite our safeguards, no internet transmission, website, email, cloud system, payment channel or electronic storage method is completely secure. Customers provide and transmit data at their own risk, subject always to our obligations under applicable law.

7.4 You are responsible for keeping your login credentials, devices, email account, payment credentials, two-factor-authentication tools and account information secure. You must notify us promptly if you know or suspect that your account has been compromised or used without authorisation.

7.5 If a data breach occurs, we will assess without undue delay whether it is notifiable under the PDPA. Where we assess that a breach is notifiable, we will notify the Personal Data Protection Commission within three (3) calendar days of completing that assessment, and will notify affected individuals as soon as reasonably practicable thereafter, where required by law.

8. ACCURACY OF DATA

8.1 Customers are responsible for ensuring that all personal data provided to us is accurate, complete and up to date.

8.2 You must promptly notify us of any change to your name, contact details, residential address, mailing address, delivery address, bank account details, PayNow proxy, source-of-funds information or other information relevant to your account or transactions. Particulars retrieved from Myinfo (including your name, mobile number, email address and registered address) and your PayNow proxy are updated only through a fresh Myinfo retrieval, not by manual edit, as described in our terms and conditions.

8.3 The Company shall not be responsible for consequences arising from inaccurate, incomplete, outdated, misleading or unauthorised information provided by or on behalf of a customer, except to the extent such responsibility cannot be excluded under Singapore law.

8.4 We may rely on the latest personal data provided to us unless and until we receive written notice of any change and have had a reasonable time to process such notice.

9. ACCESS AND CORRECTION

9.1 You may request access to personal data that we hold about you or request correction of personal data that you believe is inaccurate or incomplete by contacting us in writing.

9.2 We may need to verify your identity and authority before processing an access or correction request. We may ask for supporting information or documents to confirm that you are the individual concerned or are authorised to act for that individual.

9.3 We may charge a reasonable administrative fee for access requests where permitted by law. If a fee applies, we will inform you before processing the request.

9.4 We may refuse or limit access or correction where permitted under the PDPA, including where a request is frivolous, vexatious, disproportionate, legally privileged, confidential, commercially sensitive, related to an investigation, related to regulatory reporting, or where disclosure would reveal personal data about another individual.

9.5 We will respond to access and correction requests as soon as reasonably practicable and, in any event, within thirty (30) days, failing which we will inform you in writing of the soonest practicable time by which we can respond.

10. WITHDRAWAL OF CONSENT

10.1 You may withdraw consent to the collection, use or disclosure of your personal data by giving written notice to us.

10.2 Withdrawal of consent may affect our ability to provide or continue providing services to you, including account services, gold purchases, sell-back, withdrawal, redemption, collection, delivery, custody-related records, compliance checks, customer support, notifications and marketing communications.

10.3 Withdrawal of consent does not affect any collection, use, disclosure, processing or retention of personal data that is required or permitted by law, necessary for legal or business purposes, necessary for ongoing transactions, or carried out before the withdrawal takes effect.

10.4 We may require a reasonable period to process a withdrawal request. During that period, we may continue to process personal data as necessary for account administration, transaction processing, legal, regulatory, compliance, security or operational purposes.

11. COOKIES AND WEBSITE DATA

11.1 Our Website may use cookies, pixels, tags, scripts, local storage and similar technologies to operate essential website functions, maintain sessions, remember preferences, secure accounts, prevent fraud, measure performance, analyse usage, improve user experience and support marketing attribution where applicable.

11.2 Cookies and website technologies may collect information such as IP address, device identifier, browser type, operating system, referral source, pages visited, buttons clicked, time spent on the Website, approximate location, session activity and interactions with our price checker or other tools.

11.2A Analytics and website improvement: We use third-party analytics services to understand how visitors find and use the Website and to improve our products, content and user experience. These services use cookies and similar technologies of the kind described in Clause 11.1 and may collect the categories of information described in Clause 11.2, including general usage patterns and device information. We use this information only to measure and improve the Website and our services. We do not use analytics data to decide whether to open, restrict or close your account, to assess your eligibility to transact, or to set the terms on which we deal with you; those matters are governed by Clauses 3 and 4. Analytics providers act as our data intermediaries, are engaged on the terms described in Clause 5.2, and may only use the information for purposes we authorise; we remain responsible under the PDPA for personal data processed on our behalf. Where an analytics provider stores or processes personal data outside Singapore, Clause 12 applies. You may limit this collection by adjusting your browser settings as described in Clause 11.4, or by using any opt-out mechanism the relevant analytics provider makes available. Essential Website, account and security functions will continue to operate if you do so, although some preferences may not be remembered.

11.3 Our price checker may process inputs such as quoted gold price, quantity, dealer pricing, estimated fees, comparison data or other figures entered by you. Where such inputs are linked to your account, enquiry, device, transaction or other identifying information, they may be treated as personal data under this Privacy Policy.

11.4 Users may adjust browser settings to decline or delete cookies. Some Website features, account functions, security features or price-checker functions may not work properly if essential cookies are disabled.

11.5 Where we send marketing messages to Singapore telephone numbers by call, SMS, MMS, fax, or messages sent via messaging applications such as WhatsApp, or similar channels, we will comply with the PDPA's Do Not Call provisions, including checking the applicable Do Not Call Registry where required, unless an exception applies or we have valid consent.

11.6 Marketing emails we send include an unsubscribe facility, which we will honour promptly. Opting out of marketing communications does not affect transactional or security messages, such as order confirmations, one-time passwords and account notices, which we continue to send in connection with your account and transactions.

12. CROSS-BORDER TRANSFER

12.1 We may transfer personal data outside Singapore where our service providers, cloud systems, compliance tools, payment providers, vaulting partners, delivery partners, analytics providers, communications providers, professional advisers, affiliates or other recipients are located outside Singapore.

12.2 Where personal data is transferred outside Singapore, we will take reasonable steps to ensure that the transferred personal data receives a standard of protection comparable to the protection under the PDPA, including through contractual safeguards, due diligence, access controls, transfer terms, certifications or other legally recognised mechanisms where appropriate.

12.3 You acknowledge that certain services, including cloud hosting, cybersecurity, analytics, identity verification, payment processing, communications, vaulting, custody-related services and customer support, may involve overseas processing or storage.

13. CONTACT INFORMATION

13.1 For any queries regarding this Privacy Policy or personal data matters, including access requests, correction requests or withdrawal-of-consent requests, please contact:

FINMET PTE. LTD. (UEN 202022529N)

160 Robinson Road, #14-04 Singapore Business Federation Center, Singapore 068914

Website: finmet.sg

Email: rishi.srinivasan@finmet.io

Attention: Rishi Srinivasan, Data Protection Officer

13.2 Please include your name, contact details and sufficient information for us to identify your account or request. We may request additional information to verify your identity and authority before acting on a request.

13.3 If you are not satisfied with our response to a query, access request, correction request or withdrawal-of-consent request, or believe that we have not complied with the PDPA, you may lodge a complaint with the Personal Data Protection Commission (PDPC) at www.pdpc.gov.sg.

14. POLICY UPDATES

14.1 The Company may update this Privacy Policy from time to time to reflect changes in our services, systems, legal obligations, regulatory expectations, risk controls or business operations.

14.2 The latest version will be published on finmet.sg. Unless otherwise stated, the updated Privacy Policy takes effect from the date of publication. This Privacy Policy is published in English. Where any translated summary or version of this Privacy Policy is made available, it is provided for convenience only and, in the event of any inconsistency, the English version prevails.

14.3 Where changes are material, we may take reasonable steps to notify you, such as through a Website notice, email, account notification or other communication channel.