KIWISHSTORE
Legal Document

Privacy Policy

Last updated: 18 June 2026 · Applies to kiwishstore.com and all purchases made through Kiwish Store, operated by KLCCHEALTHY SDN. BHD. (202101040297)

Text marked like this is a placeholder. Confirm the exact detail with your team, then remove the highlight before publishing.
01

Who We Are

This Privacy Policy explains how KLCCHEALTHY SDN. BHD. (SSM Registration No. 202101040297 / 1440597-P), operating the online store "Kiwish Store" at kiwish.store, collects, uses, discloses, and protects personal data in accordance with the Personal Data Protection Act 2010 ("PDPA"). For the purposes of the PDPA, KLCCHEALTHY SDN. BHD. is the data controller responsible for your personal data.

02

Personal Data We Collect

  • Identity and contact details — name, email address, phone number, delivery and billing address
  • Order details — items purchased, order value, order history, special delivery instructions
  • Payment-related information — your payment is processed directly by our payment gateway/bank; we do not store full card numbers on our servers
  • Communications — messages you send us via email, phone, WhatsApp, or contact forms
  • Technical data — IP address, browser type, device type, and pages viewed, collected automatically via cookies and similar technologies
03

How We Collect It

We collect personal data directly from you when you place an order, create an account, sign up for marketing updates, or contact our customer support. We also collect technical data automatically when you browse our website, through cookies, web beacons, and similar tracking technologies.

04

Why We Use Your Data

  • To process, fulfil, and deliver your orders
  • To provide customer support and respond to enquiries
  • To send order confirmations, shipping updates, and service messages
  • To send marketing communications about products, offers, or promotions, where you have consented to receive these
  • To understand how visitors use our website and improve its content and performance
  • To detect and prevent fraud, abuse, or unauthorised transactions
  • To comply with our legal, tax, and accounting obligations under Malaysian law
05

Cookies & Tracking Technologies

Our website uses cookies and similar technologies, grouped as follows:

  • Essential cookies — required for the website and checkout to function correctly
  • Analytics cookies (Google Analytics) — help us understand traffic patterns and how visitors use our site, using aggregated and pseudonymised data
  • Advertising cookies (Meta Pixel) — help us measure the effectiveness of our Facebook and Instagram advertising and show relevant ads to past visitors

You can disable cookies through your browser settings at any time, though some parts of the site may not function as intended if you do. [Confirm whether a cookie consent banner/preference centre is implemented — if so, link it here.] Data collected via Google Analytics and Meta Pixel is also governed by Google's and Meta's own privacy policies.

06

Marketing Communications & Your Choices

We will only send you marketing emails, SMS, or WhatsApp messages if you have opted in to receive them — for example, by subscribing to our newsletter or checking a consent box at checkout. You may withdraw your consent at any time by using the unsubscribe link in our emails, replying "STOP" to SMS/WhatsApp messages, or contacting us directly using the details in Section 14. Withdrawing marketing consent does not affect order confirmations or service messages related to a purchase you have made.

07

Who We Share Your Data With

We share personal data only as needed to operate our business, including with:

  • Courier and logistics partners, to deliver your order
  • Payment gateways and banks, to process your payment
  • IT, hosting, and website service providers
  • Google and Meta, for analytics and advertising as described in Section 5
  • Government authorities and regulators, where required by law

We do not sell your personal data to third parties. Some of these service providers (including Google and Meta) may process data outside Malaysia. Where this occurs, we rely on the safeguards permitted under Section 129 of the PDPA, such as your consent, contractual protections, or transferring only to recipients with a comparable level of data protection.

08

How Long We Keep Your Data

We retain order and transaction records for [7 years — confirm with your accountant] to meet Malaysian tax and accounting record-keeping obligations. Marketing data is retained until you withdraw consent or request deletion. Once data is no longer needed for these purposes, we securely delete or anonymise it.

09

Keeping Your Data Secure

We apply reasonable technical and organisational measures — including encrypted connections, restricted access, and secure storage — to protect your personal data from loss, misuse, or unauthorised access, in line with the Security Principle under the PDPA.

10

Your Rights Under the PDPA

Subject to the PDPA, you have the right to:

  • Access the personal data we hold about you
  • Request correction of inaccurate or outdated personal data
  • Withdraw your consent to processing, including for marketing
  • Request that your personal data be transferred to another service provider, where technically feasible (data portability)
  • Lodge a complaint with the Personal Data Protection Department (Jabatan Pelindungan Data Peribadi) of Malaysia

To exercise any of these rights, contact our Data Protection Officer using the details in Section 14.

11

Data Breach Notification

If a personal data breach occurs that is likely to cause significant harm to affected individuals, we will notify the Personal Data Protection Commissioner and the affected individuals as required under the PDPA.

12

Children's Privacy

Our website and products are intended for individuals aged 18 and above. We do not knowingly collect personal data from minors without the consent of a parent or guardian.

13

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or in the law. The "Last updated" date at the top of this page will be revised accordingly. Continued use of our website after changes take effect constitutes acceptance of the updated policy.

14

Contact Us / Data Protection Officer

For any questions about this Privacy Policy, or to exercise your rights under the PDPA, please contact:

KLCCHEALTHY SDN. BHD. (202101040297)
No. 22, Jalan Usahawan 2, Kawasan Perindustrian Setapak, 53200 Kuala Lumpur, Malaysia
Email: kiwish.store@gmail.com
Phone: 016-779 8138
Data Protection Officer: [Insert name/email — required under PDPA Section 12 from 1 June 2025]