Oumi Privacy Notice

Last updated: 20 May 2026

1. About this Privacy Notice

This Privacy Notice sets out the way in which Oumi (“Oumi”, “we”, “us” or “our”) collects, uses, discloses and otherwise processes personal data relating to you when you engage with us, whether at our venue, on our website at www.oumi.sg, through our reservation systems, by telephone or email, on our social-media channels, or through the 1-Insider loyalty programme. This Privacy Notice has been prepared in compliance with the Personal Data Protection Act 2012 of Singapore (the “PDPA”) together with its subsidiary instruments.

In this Privacy Notice, the expression “personal data” carries the meaning ascribed to it by the PDPA, namely data, whether true or not, about an individual who can be identified from that data, or from that data taken together with other information to which we have, or are likely to have, access.

2. Who We Are

Oumi is operated by 1-Spring Pte Ltd, a private limited company incorporated in Singapore, with UEN 202100939Z, having its registered office at 88 Market Street, #51-01, Singapore 048948. 1-Spring Pte Ltd is the data controller (and, where the term is relevant, the “organisation” for the purposes of the PDPA) in respect of personal data collected in connection with Oumi.

3. Our Data Protection Officer

We have appointed a Data Protection Officer charged with overseeing our compliance with the PDPA. Communications addressed to our Data Protection Officer should be sent to:

Immelia Izalena, Data Protection Officer

1-Spring Pte Ltd

88 Market Street, #51-01

Singapore 048948

Email: marketing@1-group.com.sg

4. Who This Privacy Notice Applies To

This Privacy Notice has effect with respect to all individuals whose personal data we collect or otherwise process in connection with Oumi, including the following:

guests dining at, attending events at, or otherwise visiting Oumi;
persons making reservations, enquiries, purchases or registrations through our website, our reservation systems or the 1-Insider loyalty programme;
persons who contact us by telephone, email, social media or any other means;
individuals whose personal data has been supplied to us by a third party (for instance, by another member of a dining party); and
candidates who apply for employment with Oumi or with 1-Spring Pte Ltd.

5. Personal Data We Collect

The categories of personal data we may collect about you are described below.

Identity and contact information

Information identifying you and enabling us to reach you, including your name, salutation, date of birth (should you elect to provide it), nationality, gender, photograph (where relevant), postal address, email address, telephone number, social-media handles, and any further contact details you may supply.

Reservation and event information

Information relating to your reservations and events, including the date and time, the table or area reserved, the size of your party, the names and contact details of the guests who form your party, dietary requirements, allergies, occasion notes, accessibility needs, special requests, and your booking and attendance history.

1-Insider loyalty programme information

Where you participate in the 1-Insider loyalty programme, the membership identifier, the tier to which you belong, your points balance, your redemption history, your preferences as a member, your marketing-communication preferences, and the record of your interactions across participating venues.

Financial information

Where you complete a payment, purchase a gift voucher, or place a deposit by way of our website or our reservation systems, we (or our payment processor acting on our behalf) may collect billing information, the last four digits of the payment card, the brand of the card, transaction details and any related invoicing data. The full payment-card data is processed by our payment processor and is not held by us in clear text.

Marketing and communication preferences

The channels through which you have given (or declined to give) consent for marketing communications, the categories of content in which you have expressed interest, your engagement with our marketing (for example, opens, clicks and unsubscribes), and any opt-out signals you have indicated to us.

Website, device and cookie information

Information regarding your device and your use of our website, including your IP address (together with geolocation information at city or country level derived from it), device type and model, operating system, browser type and version, language settings, time-zone setting, the pages you have visited on our website, the referring URL, the links you have clicked, the time spent on individual pages, session identifiers and cookie identifiers (including those set by us and by our third-party analytics, advertising and attribution partners).

CCTV and photographic information

Closed-circuit television footage captured at Oumi and at other venues operated by us, together with photographs and video taken at events held at Oumi, as described further in Section 15 (CCTV) and Section 16 (Photography).

Job-applicant information

In respect of job applicants, the information contained in your CV, application form, cover letter and interview notes, including educational background, employment history, professional qualifications, references, immigration status (where relevant to your eligibility to work in Singapore), and any other information you elect to share with us.

Correspondence and feedback

Any correspondence, feedback, review, complaint or other communication you direct to us (and any response we send in return), regardless of the channel through which it is received.

6. How We Collect Personal Data

Personal data is collected through the following channels:

directly from you, for example when you make a reservation, register for the 1-Insider loyalty programme, complete a purchase, send us an enquiry, attend an event, submit a form on our website, communicate with us, or interact with our staff at Oumi;
from third parties acting on your behalf or in your interest, such as another member of your party who books a table for you, an event organiser, a corporate client, a concierge service, or a hotel that books on your behalf;
from third-party reservation, payment and loyalty platforms used to operate Oumi, including SevenRooms (table reservations and guest management), Tripleseat (event enquiries), Stripe (payment processing) and Eber (the 1-Insider loyalty programme);
by automatic means when you visit our website or engage with our digital channels, through cookies, pixels and similar technologies (see Section 13);
from publicly available sources, including professional or media profiles, where we make use of these in the context of due diligence, marketing or recruitment; and
through CCTV cameras installed at Oumi and at venues operated by us (see Section 15).

7. How We Use Personal Data

Personal data may be used for the following purposes:

providing services to you, including the processing of reservations, the fulfilment of event bookings, the processing of payments and refunds, communications regarding your reservation or visit, and any post-visit follow-up;
operating the 1-Insider loyalty programme, including member registration, tracking of points, processing of redemptions and management of tier benefits;
personalising your experience, including by recalling your dietary requirements, preferences, allergies and accessibility needs across visits;
sending you marketing communications about Oumi, 1-Spring Pte Ltd and our other concepts, in cases where you have consented to such communications or where the law otherwise permits;
operating, maintaining, securing and improving our website, our reservation systems and our digital channels, including the diagnosis of technical issues and the analysis of performance;
measuring and improving the performance of our marketing campaigns, by way of analytics, advertising-platform measurement and first-party attribution;
undertaking internal business analysis and improvement, including menu development, service-quality analysis and operational planning;
managing incidents and security, including the investigation of complaints, accidents, disputes and potential misconduct, both at our venue and on our digital channels;
evaluating and selecting job applicants, managing recruitment, and (where you are not hired) retaining your application in accordance with Section 17;
complying with applicable laws and regulations (including the PDPA, accounting and tax laws, food-safety laws and licensing obligations), and responding to lawful requests from regulators or law-enforcement authorities; and
establishing, exercising or defending legal claims, including those connected with reservations, transactions or workplace matters.

8. The Legal Bases on Which We Rely

For the purposes of the PDPA, personal data is collected, used and disclosed on one or more of the following legal bases:

your consent, whether expressly given or, where the PDPA so permits, deemed by virtue of your voluntary provision of personal data for a clearly notified purpose;
the “legitimate interests” exception under the PDPA, where the legitimate interests of Oumi or of another person clearly outweigh the adverse effect on you (relevant, for instance, to venue security, the prevention of fraud and the management of operational risk);
the “business improvement” exception under the PDPA, applicable to purposes such as the improvement of our goods and services, the development of insights about our customers, and the enhancement or development of our offerings;
the performance of a contract to which you are a party (for example, the fulfilment of a reservation or a confirmed event booking); and
compliance with the legal obligations to which we are subject (for example, the retention of accounting records under the Companies Act 1967, the Income Tax Act 1947 and the Goods and Services Tax Act 1993).

Where reliance is placed on your consent, you may withdraw such consent at any time by writing to our Data Protection Officer at the address shown in Section 3. The withdrawal of consent will not affect the lawfulness of any processing already carried out, and it may mean that we are no longer able to provide certain services to you.

9. How We Share Personal Data

Personal data is shared with the following categories of recipient, in each instance only to the extent reasonably necessary for the purposes described in Section 7:

Within the 1-Spring Pte Ltd group

Personal data may be shared with personnel and affiliated entities under common ownership with, or having an operating relationship with, 1-Spring Pte Ltd, including for the purpose of operating the 1-Insider loyalty programme across participating venues.

Service providers and processors

Personal data is shared with service providers engaged to process personal data on our behalf, under written contracts that include PDPA-aligned data-protection terms. Our principal service providers currently include the following:

SevenRooms (the platform we use for table reservations and guest management);
Tripleseat (the platform we use for private-events and event-enquiries management);
Eber (the platform on which the 1-Insider loyalty programme runs);
Stripe (the provider used to process payments);
Google Cloud and Amazon Web Services (used for hosting and infrastructure);
Vercel and Supabase (used for web hosting and managed database services for our digital channels);
Google Workspace (used for productivity, email and document collaboration);
Slack (used for internal communications);
Google Analytics, Google Ads, Meta and TikTok (used for analytics, advertising and attribution); and
Mailchimp and other email-service providers (used for marketing communications).

Other recipients

Personal data may also be shared with our professional advisers (including lawyers, accountants, auditors and tax advisers); with insurers; with banks and payment networks in connection with transactions and chargebacks; with regulatory and law-enforcement authorities, where required by law or where we consider disclosure necessary to protect our rights or the rights of others; and with any successor in interest in the context of a merger, acquisition or sale of business or assets.

We do not sell personal data.

10. Transfers of Personal Data Outside Singapore

Some of our service providers (including SevenRooms, Tripleseat, Eber, Stripe, Google, Amazon Web Services, Vercel, Supabase, Meta and TikTok) are based outside Singapore. Accordingly, personal data may be transferred to, stored in or accessed from countries other than Singapore, including the United States, the European Union, the United Kingdom, Australia and other jurisdictions in which such providers operate.

Where personal data is transferred outside Singapore, we take the steps required by the PDPA to ensure that the recipient is bound by legally enforceable obligations providing a standard of protection comparable to that under the PDPA. Such steps may consist of contractual safeguards (for instance, data-processing agreements incorporating PDPA-aligned data-protection clauses), reliance on the certifications applicable to the recipient, or other measures permitted by the Personal Data Protection (Transfer of Personal Data Outside Singapore) Regulations 2014.

11. How Long We Keep Personal Data

Personal data is retained only for so long as is necessary for the purposes for which it was collected, including in order to satisfy legal, accounting, tax, audit and reporting requirements. By way of illustration:

reservation records and guest profiles are retained while your account or profile remains active, and for a reasonable period thereafter for record-keeping, dispute-handling and audit purposes;
1-Insider loyalty-programme records are retained for so long as you remain a member, and for a reasonable period thereafter, in accordance with the loyalty-programme terms;
financial records (including invoices, deposits and refunds) are retained for the periods required under the Companies Act 1967, the Income Tax Act 1947 and the Goods and Services Tax Act 1993 (generally a minimum of five years);
CCTV recordings are normally held for approximately 30 days from the time of recording, after which they are securely overwritten, save where they are retained for a longer period in connection with an investigation, dispute or legal matter; and
records relating to job applicants are retained for up to twelve (12) months from the close of the relevant recruitment cycle, unless you consent to retention for a longer period.

Where personal data is no longer needed for any legal or business purpose, it will be securely deleted or anonymised.

12. How We Protect Personal Data

We maintain reasonable security arrangements intended to protect personal data against unauthorised access, collection, use, disclosure, copying, modification, disposal and similar risks. Such arrangements include access controls, encryption in transit, role-based access permissions, secure server hosting, periodic reviews of our security practices, training for staff handling personal data, and contractual safeguards in our agreements with service providers.

Notwithstanding these measures, no method of transmission over the internet or of electronic storage is entirely secure. Absolute security cannot be guaranteed, and you provide personal data to us at your own risk.

13. Cookies, Analytics and Marketing Attribution

Cookies and similar tracking technologies are used on our website. Cookies are small text files placed on your device when you access a website. We use them in the following ways:

strictly necessary cookies, required for the functioning of the website;
preference cookies, which retain your settings (for example, language);
analytics cookies, which enable us to understand how visitors make use of our website (for instance, by means of Google Analytics);
advertising and attribution cookies, which allow us to measure the effectiveness of our advertising and to personalise the advertisements you see on third-party platforms (for instance, on Google Ads, Meta and TikTok); and
a first-party attribution cookie known as “_1g_attr”, used to measure the channels through which visitors reach our website and to attribute marketing performance reliably as third-party cookie support continues to decline.

Cookies may be controlled through your browser settings. The disabling of certain cookies may impair the functionality of our website.

14. Marketing Communications, the DNC Registry and the Spam Control Act

Where you have given consent, or where the PDPA otherwise permits us to do so, we may send to you marketing communications by email, SMS, push notification, in-app message, postal mail or other channels concerning Oumi, the 1-Insider loyalty programme, and other concepts operated by 1-Spring Pte Ltd that we consider may be of interest to you.

Marketing communications may be opted out of at any time, by any of the following methods:

clicking the “unsubscribe” link contained within any marketing email;
replying with the indicated stop word to a marketing SMS;
adjusting your marketing preferences within your 1-Insider account; or
writing to our Data Protection Officer using the details provided in Section 3.

Prior to sending marketing messages to a Singapore telephone number by way of voice call, SMS or fax, we check the number concerned against the relevant Do Not Call (“DNC”) registers maintained by the Personal Data Protection Commission, save where an exemption applies (for example, where you have given clear and unambiguous consent in writing or in another accessible form, or where the message is an “ongoing relationship” message). Our commercial electronic messages are dispatched in compliance with the Spam Control Act 2007 of Singapore, including the requirements regarding unsubscribe facilities and sender identification.

15. CCTV at Our Venues

Closed-circuit television cameras are operated by Oumi at the venue for purposes which include safety, security, the investigation of incidents, the prevention of fraud, the prevention of loss, the assurance of service quality and the protection of our property, our staff and our guests. Signage indicating the operation of CCTV is displayed in the relevant areas. CCTV recordings are kept for a limited period (typically around 30 days) and are accessible only to authorised personnel. CCTV is not deployed for the routine monitoring of staff productivity.

16. Photography and Videography at Events

Photographs and video may be taken at events held at Oumi (including private events, media events and brand activations) for the purposes of marketing, communications, social media and editorial use. Where this is to occur, reasonable efforts will be made to give advance notice to guests (for instance, by way of signage at the venue or messaging within the event invitation), and reasonable requests not to be photographed or filmed will be accommodated where operationally practicable. Where photographs or video are used for marketing purposes, we rely on the bases set out in Section 8.

17. Job Applicants

When you submit an application for a position at Oumi or with 1-Spring Pte Ltd, we collect and process the personal data contained in your application (which may include your CV, cover letter, application form, references and any interview notes), for the purposes of assessing your suitability, conducting interviews, undertaking background and reference checks (where applicable and lawful), making employment decisions, and complying with applicable employment, immigration and other laws. Should your application not be successful, we may retain your details for up to twelve (12) months in case other suitable opportunities arise, unless you instruct us to delete them sooner.

18. Your Rights Under the PDPA

Subject to the conditions and exceptions contained within the PDPA, you have the following rights in respect of your personal data:

Access (section 21 of the PDPA): you may request information about the personal data we hold relating to you, and about the manner in which we have used or disclosed that personal data within the year preceding your request.
Correction (section 22 of the PDPA): you may request that we correct an error or omission in the personal data we hold relating to you.
Withdrawal of consent (section 16 of the PDPA): you may withdraw any consent you have previously given to the collection, use or disclosure of your personal data. The withdrawal of consent may mean that we are no longer able to provide certain services to you.
Data portability (sections 26F to 26J of the PDPA, when they come into operation): you may, in respect of certain categories of data, request that we transmit your data to another organisation that has the capacity to receive it.

To exercise any of the above rights, please write to our Data Protection Officer at the address shown in Section 3. We may need to verify your identity before responding to a request. The PDPA permits the charging of a reasonable fee for responding to certain requests; should a fee apply, we will notify you in advance, and the request will not be processed until you confirm your willingness to pay the fee. We will respond to a valid request within the period required by the PDPA (at present, thirty (30) days, so far as reasonably practicable).

19. How to Contact Us

For any question regarding this Privacy Notice or our handling of your personal data, please contact:

Immelia Izalena, Data Protection Officer

1-Spring Pte Ltd

(operator of Oumi)

88 Market Street, #51-01

Singapore 048948

Email: marketing@1-group.com.sg

General enquiries: reservation@oumi.sg

Telephone: +65 9837 8248

20. Complaints to the PDPC

In the event that you are not satisfied with our response to a query or complaint, the matter may be referred to the Personal Data Protection Commission of Singapore (“PDPC”). The PDPC may be contacted at:

Personal Data Protection Commission of Singapore

10 Pasir Panjang Road, #03-01

Mapletree Business City

Singapore 117438

Website: www.pdpc.gov.sg

21. Updates to this Privacy Notice

This Privacy Notice may be updated from time to time in order to reflect changes to our practices, to the services we offer, or to applicable law. The current version is available at www.oumi.sg/privacy, and the date appearing at the top of this Privacy Notice indicates the date on which it was last updated. Where a change is material, reasonable efforts will be made to bring it to your attention (for instance, by way of a notice on our website or, where appropriate, by direct communication).

22. Governing Law

This Privacy Notice shall be governed by, and construed in accordance with, the laws of Singapore.

— End of Privacy Notice —

Privacy Policy