Privacy Policy

Last updated 26 October 2026. This policy describes what The Dancing Mermaid (“we”, “us”) does with personal data. It covers this website and the classes, courses, workshops, photoshoots and performances we run. It describes what our system actually does today, not what a template says.

We are a Singapore business, registration 53476625X, and we handle personal data under Singapore's Personal Data Protection Act (PDPA).

If you want anything here explained, or you want to see, correct or remove what we hold about you, write to our Data Protection Officer at enquiry@mermaid.sg.

1. Whose data this covers

• Students and account holders: anybody who joins a class or course, or has an account. We may create your record when you join, without sign-in details. You can sign in once we give you them, or, when we open sign-in to students, by setting a password through “Forgot password” or signing in with Google under the same email address.
• Children: whose details come from their parent or guardian.
• Parents, guardians and emergency contacts: whose names and numbers students or parents give us.
• People who contact us: through the contact form or by email.
• Event clients: who book a performance, and the people named on their quotations.
• People in our photos and testimonials.
• Visitors to this website.

2. Students and account holders

Taken from what the system actually stores:

• Who you are: name, email address, contact number, date of birth, and gender and address if you gave them when registering for a course. If you have an account, also a username if you choose one, and a profile photo if one is added. We never ask for your NRIC, FIN or passport number.
• Your course registration: your swimming and mermaiding experience, certifications you already hold, any medical conditions you disclosed and the details you gave, and the consents you agreed to, with when. For a student under 18, the parent or guardian's name, number and consent. When you register online, these are held, encrypted, until your payment goes through; if it does not, they are deleted after seven days.
• Safety contacts: an emergency contact's name and number, which we ask for when you register for a course, and for a child, a parent or guardian's name and contact number.
• Your courses: which courses you are enrolled in.
• Notes: remarks our staff write on your record, such as how a course is going. You can ask to see them.
• If you perform or teach with us: a stage name, your Instagram handle, a short bio, the year you started performing, your skills, a portrait photo, your instructor credentials, and the address of your profile.
• How you sign in: a one-way scrambled version of your password, which cannot be turned back into your password, and your Google account identifier and Google email address if you sign in with Google. If we add you without sign-in details, your record holds a random password that nobody knows.
• Where you signed in from: the network address you used when you signed up and when you last signed in, and when. For staff accounts, every sign-in is recorded with the email address and network address used.
• Email: whether you have unsubscribed from our news, whether you have been sent our latest announcement, and which welcome emails you have been sent.
• Payments: receipts and credit notes we issue to you: your name, email, contact number, what you paid and how. For a card payment online, that is Stripe's reference, the card's brand and its last four digits. Stripe also keeps a customer record of your name and email address, and we keep Stripe's reference to it on your account. With each payment, Stripe receives the course and our booking reference; with a refund, which of our staff made it. We never see or store your full card number. Each receipt is emailed to you with a PDF copy and a private link, as quotations are (section 5).
• Lesson videos and photos: videos and photos of your lessons we send you, while they last, and a record of each link we sent: who it was for (name and email address), any note we added, when it was first opened, and how many times each file was downloaded (section 11).

3. What is public

Nothing about you is public unless we put it there.

• Performers and instructors. If we list you in an event's lineup or on our About page, we show your stage name (or your first name if you have none), your portrait and your Instagram handle. The About page also shows your bio, the year you started performing, and the credentials you hold, such as an MFI or PADI instructor rating. We may later show your skills. We never show a performer's full legal name, contact details, date of birth or anything about their health.
• Authors. The staff who write our guides and blog posts are named in full as their authors.
• Children are never listed. The website never shows anybody under 18 as a performer, in an event's lineup, or on the About page. It lists only people whose date of birth, on our records, shows them to be 18 or over.
• Testimonials show the name you agree to, a line such as the course you took, and your words. If you give us a photo or your Instagram handle, we may show them too. Only with your permission.
• Photos and video from classes and events may appear on this website and our social media. See section 11.

4. People who contact us

The contact form asks for your name, email address and contact number, and lets you tell us which course you are interested in, who it is for, how well they swim, and anything else. It records the page you sent it from and the network address it came from.

We keep each enquiry in the website's database, so that it is not lost if an email goes astray, and we email a copy to ourselves. We note on it when we reply and how it went. If you enquire by phone, message or email, we may record the enquiry the same way. If you already have an account with us under the same email address, the enquiry is linked to it. Emails we receive are kept in our mailbox as correspondence.

When we answer by email, our reply is kept with your enquiry, and so are the replies you send back: our website reads them from our mailbox and adds their text to the enquiry, so the whole conversation is in one place. Files you attach stay in our mailbox only. The conversation is deleted with the enquiry.

5. Event clients and quotations

When you ask us to perform at an event, we may send you a quotation. It holds the name, company, contact person, email address and contact number you give us, what the event is, and the price. We email it to you with a PDF copy and a private link where you can view, print or download it. Only somebody with the link can open it, and search engines are told not to list it. We note when it was sent and how you answered, and if you go ahead, the quotation is linked to your receipt.

6. Visitors to this website

• Our web server's access log records, for each request, the network address it came from, the page, the time, and the browser's description of itself. It is used only to keep the site running and secure. Each month's log is deleted at the end of the following month, so nothing in it is kept longer than about two months.
• Our error log records, when something goes wrong, the page, the network address, which account was signed in, what a form sent and the technical details of the error. What a form sent leaves out passwords, health answers, dates of birth, addresses, family and emergency contacts, and messages and notes, and a failed database save is logged without the values that were being saved. It is deleted after 14 days.
• Google Analytics tells us how many people visit, which pages they read, how they found us, and roughly where they are and what device they use, so we can see which pages help and which do not. It works with cookies (section 13) and sends this to Google. Google Analytics does not log or store your network address. We do not send Google your name, email address or anything else that identifies you, we do not link it to your account, and we do not use it for advertising. You can refuse it: choose Essential only in our cookie message, or change your choice in section 13.
• Google Search Console tells us how our pages appear in Google Search and which searches lead to them. It works from Google's own search records, not from your visit to this site, and sets no cookies here.
• Fonts and the home page film come from Google Fonts and Vimeo, so they receive your network address when the page loads. We ask Vimeo not to track viewing of our film.

7. Our emails

We send you news and offers only if you have not unsubscribed. Every such email has an unsubscribe link, and if you use it we stop. If you unsubscribe, you may tell us why; your reason reaches us by email with your name, number and email address. Messages about your classes, your account and your bookings continue while you are a student. If you create an account yourself, we send a short series of welcome emails over the following days, which stop if you unsubscribe.

Rarely, we send a notice to everybody with an account, including those who have unsubscribed, when it matters to all of them: a change to these terms or this policy, or the website being down for maintenance. Never news or offers.

For each news email we keep a record of who it went to (your name, email address, number and type of account), when it was sent, whether you opened it, whether you followed its link, and whether you unsubscribed from it. Opening is detected by a small image in the email.

8. Why we hold any of it

• To teach you safely. Your health information and emergency contacts are what we rely on if something goes wrong in the water.
• To certify you with MFI or PADI.
• To contact you about your classes, courses and bookings, and to answer your enquiry or quotation.
• To feature our performers at events and on our About page, if you perform with us.
• To send you news, only if you have not unsubscribed.
• To understand which pages of this website help people, unless you refuse analytics.
• To keep the website and your account secure.
• To keep the records the law requires, such as receipts.

9. Who else sees it

We use other organisations for things we do not do ourselves. Each sees only what it needs:

• MFI and PADI: when you are certified, the details they need to issue it, such as your name, date of birth, contact details and the course you completed. Their own privacy policies apply to what they hold.
• Contabo: the company whose server, in Singapore, this website and its database run on. Our emails are sent from that server too. No outside email service sees them.
• Google: Google Analytics, unless you refuse it, and Search Console, as section 6 describes; the fonts this website uses; and your Google account details if you choose to sign in with Google. How Google uses information from sites that use its services is explained at policies.google.com/technologies/partner-sites.
• Vimeo: plays the film on our home page, and sees the network address of everybody who loads that page.
• Stripe: when online payment is available and you pay online: your name, email address and card details, to take the payment, and to refund it if that is needed. You enter your card on Stripe's own page, not ours.
• The authorities: if the law requires it of us.

We do not sell personal data, and we do not pass it to anybody for their own marketing.

10. Data leaving Singapore

Our server, and the database on it, are in Singapore. Some data still leaves: MFI, PADI, Google, Vimeo and Stripe are based outside Singapore and move data between their own locations, including the United States. We choose established providers who publish their own data protection commitments, so that your data is protected to a standard comparable to the PDPA's. We are a small school and are not in a position to audit them.

11. Photos and video

We photograph and film classes, courses and events, and share some of it on this website and our social media. If you do not want to appear, tell us before or during the session. If you change your mind later, ask, and we will remove you from this website and our own social media accounts. We cannot recall copies others have already shared.

We photograph or film a child only with their parent or guardian's consent.

Lesson videos and photos. When we film or photograph your lesson for you, we send you a private link to download the files. They are kept on our own server in Singapore, not on the website, and only someone with the link can download them. We delete each file 7 days after we upload it, and the link stops working. We do not use them anywhere else without asking you first.

12. How long we keep things

• Your record stays while you are a student, or until you ask us to close it.
• Accounts you create yourself and never verify are deleted automatically, currently after 6475 days, unless we already hold something for you, such as an enquiry or a booking.
• Health information stays with your record, and is updated each time you register for a course. Ask us to remove it once you stop training with us.
• Online registrations that are never paid are deleted after seven days.
• Performer listings stay until you ask us to take you off them.
• Receipts, credit notes and quotations are kept with our business records for five years after the year they belong to, as Singapore's tax rules require.
• Enquiries, with any emails between us about them, are deleted automatically two years after we last dealt with them, or sooner if you ask.
• The error log is deleted after 14 days, and the access log within about two months. The record of staff sign-ins is kept.
• Password reset links stop working after 60 minutes, and are deleted within a day.
• Google Analytics keeps its records for 14 months.
• Lesson videos and photos we send you are deleted 7 days after we upload them. The record of the link we sent is kept with your record.
• News email records are kept with the results of that email, until you ask us to remove yours.
• Photos and video stay until you ask us to remove them.
• Backups may hold a copy of something for a while after it is deleted.

13. Cookies and your choice

A cookie is a small file a website keeps in your browser. These are all the cookies this website uses:

The first four are needed for the site to work, and are set whatever you choose. Vimeo may also set its own cookies when the film on our home page plays; they are Vimeo's, under Vimeo's policy. We do not use advertising cookies.

You can also block or delete cookies in your browser's settings, or install Google's opt-out add-on to stop Google Analytics on every website. Blocking the first four will stop you signing in.

14. Keeping it safe

Passwords are stored only in one-way scrambled form. This website is served over an encrypted connection. Each member of staff sees only what their role needs, and private details such as health answers, date of birth, guardian and emergency contacts only those whose role allows it, which today means our administrators. Health answers are kept so the instructor can see them before your lessons; they are never emailed around. To help with a problem on your account, a member of staff whose role allows it may view the website as you; that is not recorded as your sign-in.

If a breach of personal data is likely to cause you significant harm, we will tell you and Singapore's Personal Data Protection Commission, as the law requires.

15. Your rights

Under the PDPA you may:

• Ask what we hold about you, and how it has been used in the past year, and we will tell you.
• Ask us to correct it if it is wrong.
• Withdraw your consent, for news emails, for analytics, for photos and video, and for appearing as a performer. Some things, such as health information for a course you are taking, we cannot teach you safely without, and we will tell you if that is the case.
• Ask us to delete your record, apart from records the law requires us to keep.

Write to enquiry@mermaid.sg. A parent or guardian may do any of this for their child. We will answer as soon as we reasonably can, and within 30 days; if we need longer, we will tell you within that time when to expect it. We do not charge for a request. If you ask for a copy of a large amount of data, we may charge a reasonable fee for the copy, and we will tell you the amount before we start.

If you are not satisfied with our answer, you may contact the Personal Data Protection Commission at pdpc.gov.sg.

16. Children

We teach children. Their details come from a parent or guardian, who gives consent for them. Children are never shown publicly as performers, and are photographed only with a parent or guardian's consent.

17. Changes to this policy

When this policy changes, the new version appears here with a new date at the top. If a change matters, we will tell our students by email rather than expect you to check.

The Dancing Mermaid, 190 Clemenceau Ave, #06-00, Singapore Shopping Centre, Singapore 239924. Business registration 53476625X.