Personal Data Protection Policy
Mommy Cat Homey (“MCH”) is committed to protecting the privacy and security of your Personal Data. This Personal Data Protection Policy describes our practices in accordance with the Personal Data Protection Act 2010 (PDPA) of Malaysia, applicable to our operations in Malaysia.
- Definitions
- “Controller”/“Processor” have their ordinary meanings under PDPA.
- “Personal Data” means any information about an identified or identifiable individual.
- “Sensitive Personal Data” means Personal Data revealing health, medical records, disability status, biometric data, religion, race, or financial hardship. “Processing” means any collection, use, storage, retrieval, disclosure, erasure or other operation performed on Personal Data.
- Collection of Personal Data
We collect Personal Data necessary to provide products and services, manage customer relationships, process orders, operate membership and rewards programs, and comply with legal obligations. Types of Personal Data we may collect include:
a) Name;
b) Contact information (telephone number, email address, postal/delivery address);
c) Identification details (where required for verification or legal compliance);
d) Financial information (payment details required for transactions);
e) Photographs and images (for photography services, user-submitted content, or product imagery);
f) Purchase history, preferences, and feedback;
g) Delivery and logistics information; and
h) Membership information, loyalty points, rewards redemption history and related account activity. Sensitive Personal Data will only be collected where necessary and with explicit consent.
- Lawful Basis and Consent
We process Personal Data on the basis of informed consent. For Sensitive Personal Data, we obtain explicit consent specifying categories and purposes. We may process Personal Data without consent where necessary for contractual performance, legal compliance, or to protect vital interests in an emergency, and we will document the lawful basis.
- Purpose of Processing Personal Data
We process Personal Data for purposes including:
a) To sell, fulfil and deliver products and digital content;
b) To operate, manage and administer membership and rewards programs (enrolment, account management, points accrual, rewards issuance and redemption, tiering, and related communications);
c) To communicate order, delivery, appointment and customer service updates;
d) To manage billing, refunds, payment processing and retainers;
e) To operate and improve online platforms, marketplaces and accounts with third-party agencies that host or sell our images and products;
f) To manage marketing, promotions, newsletters and community engagement (with consent for direct marketing), including targeted offers for members and reward holders;
g) To process contests, returns, warranties, or custom orders;
h) To prevent and detect fraud, misuse or unlawful activities;
i) To monitor, evaluate and report on service delivery (with anonymized data where possible); and
j) To comply with legal and regulatory requirements and for administrative and financial record-keeping.
- Disclosure of Personal Data
We may disclose Personal Data to:
a) Government agencies, regulatory or enforcement authorities where required by law;
b) Courts, tribunals, or legal representatives;
c) Payment processors, banks and financial institutions for transaction processing;
d) Logistics and courier providers for delivery of physical goods;
e) Third-party marketplaces, photography agencies and platforms that host or sell our images/products;
f) Service providers who support membership, loyalty and customer relationship management (CRM) systems;
g) Cloud hosting, email, IT, and other service providers who assist in our operations (e.g., Google Workspace or similar);
h) External legal, accounting or professional advisors; and i) Other parties with your consent or where required by law.
- Sources of Personal Data
We collect Personal Data directly from you when you place orders, register, subscribe, join membership or rewards programs, submit content, or otherwise interact with us. We may also collect Personal Data from third parties such as payment providers, logistics partners, marketplace platforms, photography agencies, or authorities involved in a transaction.
- Use of Google Workspace and Third-Party Processors
We use third-party processors (e.g., Google Workspace or similar services) for email, document storage, collaboration and related services. These processors act as data processors and may store data inside or outside Malaysia. We use reputable processors and, where applicable, take contractual and technical measures to protect data.
- Security of Personal Data
We implement appropriate administrative, technical and physical security measures to safeguard Personal Data against unauthorized access, disclosure, alteration or destruction. While we strive to protect Personal Data, no system is completely secure; you should take care when transmitting information to us.
- Access, Correction and Withdrawal of Consent
You have the right to access, correct, or update your Personal Data held by us, and to withdraw consent where processing is based on consent (subject to legal or contractual restrictions). To make a request, contact us using the details in Clause 16. We may require verification and reasonable time to respond.
- Retention of Personal Data
We retain Personal Data only as long as necessary to fulfil the purposes for which it was collected or as required by law. Personal Data related to membership and rewards (including account activity, points history and redemption records) will be retained for as long as the membership account is active and for a reasonable period thereafter to address disputes, comply with legal obligations or enforce our terms. After retention periods expire, Personal Data will be securely destroyed or anonymized.
- Minors and Incapacitated Persons
If a customer or user is a minor or legally incapacitated, we will obtain verifiable parental or guardian consent and any necessary documentation before processing their Personal Data.
- International Transfers
Where Personal Data is transferred outside Malaysia (for example, to cloud service providers or international payment platforms), we will ensure an adequate level of protection through contractual safeguards or other measures required under PDPA.
- Changes to This Policy
We may update this policy to reflect legal, operational or business changes. Updated versions will be posted on our website. Material changes will be communicated as appropriate.
- English Version
This policy is provided in English. In case of any translated versions, the English version shall prevail.
- Applicable Laws
This policy shall be construed and interpreted in accordance with the laws of Malaysia.
- Contact Us
If you have questions or wish to exercise your rights (access, correction, withdrawal of consent), please contact us at:
Email:
Phone Number:
Consent
By engaging with MCH’s services, purchasing products, joining membership or rewards programs, submitting content, or providing your Personal Data to us, you consent to the processing of your Personal Data in accordance with this policy. For Sensitive Personal Data, you confirm that you have given explicit consent for the stated purposes.