Our Policies

1. Information We Collect

When you place an order or contact us: full name, email address, phone number, delivery address, and order details. When you browse our website: browsing behaviour, device/browser information, and IP address, via cookies/pixels from the advertising and analytics platforms listed below.

We may also store a corrected or standardised version of the delivery details you provide (for example, the state derived from your postcode), together with internal notes where an order requires manual review or payment reconciliation.

2. How We Use Your Information

To process and fulfil your order, arrange payment, arrange delivery, send order/shipping confirmations, respond to enquiries, and — for marketing and ad measurement purposes — across social media and advertising platforms including but not limited to Meta (Facebook/Instagram), TikTok, and Google, and other similar platforms we may use from time to time.

We also use your information to verify and reconcile the amount received against your order total, to correct or standardise delivery details so our courier can accept the parcel, and to investigate and resolve order, payment, and delivery issues.

3. Sharing With Third-Party Service Providers

We do not sell your personal data. We share the minimum necessary data with the following independent service providers, each operating under its own privacy policy and terms of service:

• Billplz (payment gateway) — name, email, phone, order amount/reference, delivery address, to process payment. We never receive or store your card/bank/e-wallet credentials.
• Pos Laju / Pos Malaysia Berhad (delivery partner) — name, phone, email, delivery address, parcel weight/value, for delivery and tracking, including WhatsApp delivery-status updates sent by Pos Laju using the phone number provided.
• Resend (email service) — name, email, order details, for order/shipping notification emails.
• Meta, TikTok, Google, and other advertising/analytics platforms — browsing data via cookies/pixels, for analytics, retargeting, and ad performance measurement.
• Other service providers, direct or indirect — we may integrate additional tools or providers for site operation, marketing, fulfilment, or customer communication (now or in future) not individually named above. The same principles in this section apply to them.

Each provider is independent of us and governed by its own terms and privacy policy — by using that part of our service (e.g. paying via Billplz, or interacting with our ads on Meta/TikTok/Google) you also agree to be bound by that provider’s own terms, where applicable. We select reputable providers and share only what each service requires, but we do not control, and are not liable for, their independent processing, retention, security practices, downtime, or errors, whether the provider is engaged directly or indirectly by us.

4. Cross-Border Data Transfer

Some of our service providers (including Meta, TikTok, and Google) may process or store data on servers located outside Malaysia. By using our website and its advertising features, you consent to this transfer, which occurs solely for the purposes described in this Policy.

5. Data Storage & Retention

Order data is stored in our secured database, retained for order fulfilment and accounting/tax obligations under Malaysian law, then deleted or anonymised.

Records relating to payment reconciliation, orders placed on hold, cancellations, refunds, and disputes are retained for longer than routine order data, for accounting, tax, and dispute-resolution purposes as permitted under Malaysian law.

6. Cookies

We use cookies/pixels from the platforms listed above. You may disable cookies via your browser settings or adjust ad preferences via your Meta, TikTok, or Google account settings; this may affect site functionality.

7. Security

We apply reasonable technical and organisational measures to protect your data. No method of transmission or storage is 100% secure, and we are not liable for events outside our reasonable control, including a breach at a third-party provider’s system.

8. Your Rights

Under the PDPA, you may request access to, correction of, or withdrawal of consent for processing of your personal data by emailing us. You may also lodge a complaint with the Department of Personal Data Protection Malaysia if you believe your data has been mishandled.

9. Children

Not directed at or intended for use by individuals under 18.

10. Changes

We may update this Policy; the revised version will be posted here with a new effective date.