Privacy Policy

Introduction

This Privacy Policy explains how giftoo (“we”, “our”, “us”) collects, uses, discloses, and protects your personal data when you visit our website or place an order. We are committed to protecting your privacy in accordance with the Personal Data Protection Act 2010 (PDPA) of Malaysia and other applicable laws.

Personal Data We Collect

We may collect the following categories of personal data about you:

• Identity and contact data — your name, email address, phone number, shipping address, and billing address.
• Transaction data — details of the products you purchase, your order history, and delivery details.
• Payment data — payment method and transaction reference. We do not store your full card number; payments are processed securely by HitPay.
• Technical data — IP address, browser type, device information, and pages visited, collected through cookies and similar technologies.
• Communication data — any messages, feedback, or support requests you send to us.

How We Use Your Personal Data

We use your personal data for the following purposes:

• To process, fulfil, and deliver your orders, including arranging shipment with our courier partners.
• To send order confirmations, delivery updates, and customer service communications.
• To respond to your enquiries, complaints, and after-sales support requests.
• To improve our website, products, and services.
• To send marketing communications, where you have given your consent (you may opt out at any time).
• To comply with legal, regulatory, and accounting obligations, and to prevent fraud.

Legal Basis for Processing

We process your personal data on the following legal grounds under the PDPA:

• Your consent — which you provide when you create an account or place an order.
• Performance of a contract — to fulfil and deliver your order.
• Legitimate interests — to improve our services and protect our business.
• Legal obligations — to keep records and comply with applicable laws.

Payment Information

All payments are processed through HitPay, our third-party payment gateway. When you make a payment, your card details are entered directly on HitPay’s secure, PCI-DSS compliant checkout. giftoo never receives or stores your full card number, CVV, or card expiry date. We only receive confirmation of the transaction and a payment reference.

Disclosure of Your Personal Data

We do not sell or rent your personal data. We may disclose your personal data to the following third parties, strictly for the purposes described in this policy:

• Courier and delivery partners — to ship your order to your address.
• Payment processors (HitPay) — to process your payment securely.
• Service providers — hosting (Supabase), email delivery, and other vendors who support our operations.
• Authorities — where required by law or to protect our legal rights.

All third parties are contractually required to protect your personal data and to use it only for the purposes we specify.

Cookies & Tracking

We use essential cookies to keep your cart working and to remember your language preference. We do not use advertising or third-party tracking cookies. You can control or disable cookies through your browser settings, though some parts of the website may not function properly without them.

Data Security

We take reasonable and appropriate technical and organisational measures to protect your personal data from unauthorised access, alteration, disclosure, or destruction. These include encrypted transmission (TLS), access controls, and secure storage. While we work hard to protect your data, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes described in this policy, including satisfying legal, accounting, and reporting requirements. When your data is no longer required, we securely delete or anonymise it.

Your Rights

Under the PDPA, you have the right to:

• Access the personal data we hold about you.
• Request correction of any inaccurate or incomplete personal data.
• Withdraw your consent to the processing of your personal data at any time.
• Request deletion of your personal data, subject to our legal obligations to retain certain records.
• Restrict or object to processing in certain circumstances.

To exercise any of these rights, contact us using the details below. We will respond within a reasonable time and may ask you to verify your identity before processing your request.

International Data Transfers

Your personal data may be stored or processed on servers located outside Malaysia, including by our cloud service providers. Where this occurs, we take steps to ensure your data receives a standard of protection consistent with the PDPA.

Children’s Privacy

Our website is not directed at children under the age of 18, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated revision date. We encourage you to review this page periodically. Continued use of our website after changes are posted constitutes acceptance of the updated policy.

Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

• Email: [email protected]
• Phone: +60 11-2175 1992
• Address: 18, Jalan Sasa 2, Taman Gaya, 81800 Ulu Tiram, Johor Bahru, Johor, Malaysia