Privacy Notice

1. What we collect

• Contact and delivery details — your name, phone number, email address and delivery address, when you place an order, open an account or send an enquiry.
• Order details — what you ordered, the amount paid, the delivery method and the status of the order.
• Account details — your email address and a password, which is stored only in hashed form. If you sign in with Google, we receive your name and email address from Google; we never see your Google password.
• Messages — what you write to us through the enquiry form, by email or on WhatsApp.
• Technical data — the IP address and browser details every website receives, used for security and to prevent abuse.

We do not collect or store card numbers or online-banking logins. Payments are handled by our payment provider, described below.

2. Why we collect it

• To process, deliver and invoice your order, and to contact you about it.
• To answer your enquiries and requests for quotation.
• To keep your account and order history available to you.
• To keep the records the law requires, such as invoices for tax and accounting.
• To protect the website and our customers against fraud and misuse.

We do not send marketing messages unless you have asked for them, and you can ask us to stop at any time.

3. What is compulsory

The details marked as required at checkout are needed to complete and deliver an order; without them we cannot process it. Everything else is voluntary.

4. Who we share it with

• Our payment provider, HitPay, which processes card, FPX online banking and e-wallet payments. Your payment details go directly to HitPay and do not pass through our servers.
• Delivery — our own delivery team, and courier companies for orders outside Kuala Lumpur and Selangor, receive the name, phone number and address needed to deliver your order.
• Service providers that run the website for us: hosting and security (Cloudflare), delivery of order emails (Resend), and Google if you choose to sign in with Google.
• Authorities, where the law requires us to.

We do not sell or rent your personal data. Some of these providers process data on servers outside Malaysia; where they do, it is only for the purposes listed above.

5. Cookies

The site uses only the cookies it needs to work: one to remember your cart and one to keep you signed in. The security check on our forms (Cloudflare Turnstile) may set its own. We do not use advertising cookies or third-party tracking.

6. How long we keep it

Order and invoice records are kept for seven years, as tax and accounting rules require. Account details are kept until you ask us to close the account. Enquiries are kept for as long as it takes to deal with them.

7. How we protect it

The site is served over encrypted connections, passwords are stored in hashed form, payment details never reach our servers, and access to order records is limited to the staff who need it to fulfil your order.

8. Your rights

You may ask to see the personal data we hold about you, ask us to correct it, withdraw your consent, or ask us to stop using it for a particular purpose. Write to us using the details below and we will reply within 21 days. If you withdraw consent for data we need to complete an order, we may not be able to fulfil that order.

9. Changes to this notice

We update this page when our practices change. The date at the top shows when it was last revised.