1. Introduction
This Privacy Policy explains how HERBA PLUS HOLDING SDN. BHD. (Company No. 202101008639 (1408938-V)), trading as HERBA PLUS HOLDING SDN. BHD. (“we”, “us”, “our”), collects, uses, discloses, transfers and protects your personal data when you visit our website at https://minyakkuda.com (the “Website”), create an account, place an order, or otherwise interact with us in connection with the sale and delivery of physical goods.
We respect the privacy of your personal data and we strive to maintain its confidentiality. We process your personal data in accordance with the Personal Data Protection Act 2010 (“PDPA”) and its principles, including the General Principle, the Notice and Choice Principle, the Disclosure Principle, the Security Principle, the Retention Principle, the Data Integrity Principle and the Access Principle.
This Policy should be read together with our Terms and Conditions, our Refund Policy and our Cookie Policy, each of which forms part of the agreement between you and us.
1.1 Role of the Payment Processor
Payments made on the Website are processed by Bayarcash Sdn. Bhd. (Company No. 202201040365) of Kota Bharu, Kelantan, Malaysia, a payment gateway regulated under Malaysian law (the “Payment Processor”). The Payment Processor acts solely as an independent third-party provider of payment-processing services. It is not the seller, supplier, merchant of record or counterparty to any purchase, and it does not own, control or operate the Website.
HERBA PLUS HOLDING SDN. BHD., and not the Payment Processor, is the seller of record and your sole counterparty in respect of any purchase and the supply of physical goods. All questions concerning your order, shipment, delivery, refunds, disputes or your personal data held by us must be directed to HERBA PLUS HOLDING SDN. BHD. in the first instance.
When you pay for an order, the personal data necessary to complete and secure that payment is shared with the Payment Processor so that it may process the transaction. That data is handled by the Payment Processor as an independent party under its own privacy notice and the PDPA, as described in Section 5.
2. Personal Data We Collect
We collect the following categories of personal data, depending on how you interact with us:
Category | Examples |
|---|---|
Identity and contact data | Name, email address, telephone number, and account login details. |
Delivery and billing data | Shipping address, billing address, recipient name and contact number for delivery. |
Order and transaction data | Products ordered, order value, order history, and the date and status of your orders. |
Payment data | Payment method and the confirmation, reference and status of a payment. Full card numbers are entered with and handled by the Payment Processor; we do not store complete card details. |
Technical and usage data | IP address, browser type, device information, and pages viewed on the Website, collected largely through cookies (see our Cookie Policy). |
Communications data | Enquiries, feedback, reviews and correspondence you send to us. |
We collect this data directly from you when you create an account, place an order, contact us or use the Website, and automatically through cookies and similar technologies.
3. How and Why We Use Your Personal Data
The primary objective of collecting your personal data is to deliver the products and services you request, to process and fulfil your orders, and to improve our services to you. Only our authorised personnel and service providers acting on our behalf have access to your personal data.
We use your personal data for the following purposes:
Purpose | Description |
|---|---|
Order fulfilment | To process, pack, ship and deliver your orders, arrange returns and exchanges, and keep you informed of your order status. |
Payments | To take payment for your orders and process refunds, including by sharing the necessary data with the Payment Processor (see Section 5). |
Customer service | To respond to your enquiries, feedback and complaints, and to manage your account. |
Service improvement | To understand how the Website is used, conduct customer research and profiling, and improve our products, services and Website. |
Marketing | To send you updates on our products, news and offers, where you have not opted out (see Section 4). |
Legal and security | To detect and prevent fraud, to maintain the security of the Website, and to comply with our legal and regulatory obligations. |
In accordance with the Notice and Choice Principle under the PDPA, where any item of personal data is mandatory for us to provide a product or service to you, we will indicate this at the point of collection; if you do not provide it, we may be unable to process your order.
4. Marketing and Your Choices
If you have made a purchase from us or registered an account, we may occasionally update you on our latest products, news and special offers by email, post or telephone. We will not sell your name, address, email address, payment information or other personal data to any third party for that party’s own marketing purposes without your permission.
You may opt out of marketing communications at any time by updating the preferences in your account, by clicking the “unsubscribe” link in any marketing email, or by contacting us using the details in Section 11. Opting out of marketing will not affect communications that are necessary to fulfil your orders.
5. Disclosure and Sharing of Your Personal Data
We will not disclose your personal data to third parties except where it is part of providing a service to you, where you have given your permission, or where we are permitted or required to do so by law. In particular, we may disclose your personal data to:
Recipient | Reason for disclosure |
|---|---|
Payment Processor | Bayarcash Sdn. Bhd. and its banking and acquiring partners, to process your payment, confirm and reconcile transactions, and process refunds. |
Delivery and logistics providers | Couriers and fulfilment partners, to ship and deliver your order to the address you provide. |
Service providers | Hosting, IT, analytics, marketing and customer-support providers who process data on our behalf under appropriate confidentiality and data-protection obligations. |
Professional advisers and authorities | Auditors, lawyers, regulators and law-enforcement or government authorities, where required to comply with a legal obligation, enforce our terms, or protect the rights, property or safety of HERBA PLUS HOLDING SDN. BHD., our customers or others. |
Business successors | A buyer or successor in the event that we sell or transfer all or part of our business or assets, in which case customer personal data may be one of the transferred assets. |
By placing an order and paying on the Website, you acknowledge and consent that the personal data necessary to complete and secure your payment will be shared with the Payment Processor for the purposes described in this Policy. The Payment Processor processes that data as an independent party under its own privacy notice and the PDPA.
6. Cross-Border Transfer
Some of our service providers, including hosting, analytics and payment partners, may operate or store data outside Malaysia. Where personal data is transferred outside Malaysia, we take reasonable steps to ensure it is protected to a standard consistent with the PDPA. By using the Website and placing an order, you consent to such transfer for the purposes described in this Policy.
7. Cookies and Tracking Technologies
We and our service providers use cookies and similar technologies on the Website to make it work, to remember your preferences, to gather aggregated and anonymised statistics about visits to the Website, and to help us improve our services. You can change your browser settings to refuse or delete cookies, although some features of the Website may not function correctly as a result. Full details of the cookies we use and how to manage them are set out in our Cookie Policy.
8. Data Security and Retention
In line with the Security Principle under the PDPA, we take reasonable technical and organisational measures to protect your personal data against loss, misuse, unauthorised access, disclosure, alteration or destruction. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.
In line with the Retention Principle, we retain your personal data only for as long as is necessary to fulfil the purposes for which it was collected, including to complete your orders, provide support, and meet our accounting, tax, legal and regulatory obligations. When personal data is no longer required, we will take reasonable steps to delete or anonymise it.
We strongly recommend that you keep your account email address and password confidential, as you are responsible for activity carried out using your login credentials. We may request proof of identity before disclosing personal data to you.
9. Your Rights Under the PDPA
In accordance with the Access Principle and the Data Integrity Principle, and subject to the conditions and exceptions in the PDPA, you have the right to:
Request access to the personal data we hold about you;
Request correction of personal data that is inaccurate, incomplete or out of date;
Withdraw your consent to our processing of your personal data, or limit the processing of your personal data, including for marketing purposes; and
Make a complaint to us about how we handle your personal data.
To exercise any of these rights, please contact us using the details in Section 11. Our security procedures mean that we may request proof of identity before we act on your request. We may charge a prescribed fee for an access request as permitted under the PDPA.
10. Third-Party Sites
The Website may contain links to and from third-party websites, including those of our partners and payment providers. Those websites have their own privacy policies and we do not accept responsibility or liability for them. Please review the relevant policy before submitting any personal data to a third-party website.
11. Contact Information
If you have any questions, requests or concerns about this Privacy Policy or how we handle your personal data, please contact us:
Field | Detail |
|---|---|
Merchant | HERBA PLUS HOLDING SDN. BHD. (trading as HERBA PLUS HOLDING SDN. BHD.) |
Registration No. | 202101008639 (1408938-V) |
Address | LOT 11165-5 KG DANGAR , 17000 PASIR MAS, KELANTAN |
Website | https://minyakkuda.com |
Support Email |
For matters relating specifically to payment processing, the Website’s payments are handled by the Payment Processor:
Field | Detail |
|---|---|
Payment Processor | Bayarcash Sdn. Bhd. (Company No. 202201040365) |
Address | Kota Bharu, Kelantan, Malaysia |
For all questions concerning your order, shipment, delivery, refunds, disputes or your personal data held by us, you must contact HERBA PLUS HOLDING SDN. BHD. in the first instance using the contact details above. HERBA PLUS HOLDING SDN. BHD. is the seller of record and your sole counterparty, and the Payment Processor is an independent third party that provides payment-processing services only and is not responsible for the goods, their delivery, or any dispute between you and HERBA PLUS HOLDING SDN. BHD..