Privacy Policy

Privacy Policy

Last updated: 29 May 2026 Effective date: 29 May 2026

Mipos Sdn Bhd (Company No. 202201032890) (“Mipos”, “we”, “us”, or “our”) respects your privacy and is committed to protecting the personal data of every visitor and customer of our online store at shop.mipos.my (the “Site”).

This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, who we share it with, and your rights under the Personal Data Protection Act 2010 of Malaysia (“PDPA”). It forms part of our Terms and Conditions and Return and Refund Policy.

By using the Site, providing your personal data to us, or making a purchase, you consent to the collection, use, and disclosure of your personal data as described in this Privacy Policy.

1. About Us (Data Controller)

For the purposes of the PDPA, Mipos Sdn Bhd is the data user (data controller) responsible for your personal data collected through shop.mipos.my.

Platform notice: shop.mipos.my is built and hosted on the SiteGiant e-commerce platform. SiteGiant acts as a data processor on our behalf for the technical operation of the webstore, including hosting, order processing, customer account management, and payment gateway integration. SiteGiant processes your personal data only as instructed by Mipos and in accordance with the SiteGiant Terms of Service and Privacy Policy, which together govern the processing of customer and personal data on our behalf. You may review SiteGiant’s policies at:

Privacy Policy: https://sitegiant.sg/privacy-policy/

Terms of Service: https://sitegiant.sg/terms-of-service/

2. Personal Data We Collect

We may collect and process the following categories of personal data:

2.1 Information you provide directly

Identity data — full name, gender, date of birth (where requested);

Contact data — email address, mobile and landline phone numbers, WhatsApp number;

Address data — billing address, shipping address, business address;

Account data — username, password (encrypted), account preferences;

Business data (where you purchase as a business) — company name, business registration number, SST number, contact person;

Order data — Products ordered, order history, invoices, delivery instructions;

Communications data — messages, enquiries, complaints, feedback, reviews, and any other content you send to us via email, WhatsApp, or the Site;

Marketing preferences — your consent or opt-out for newsletters and marketing communications.

2.2 Payment data

Payment method type (e.g., Visa, MasterCard, FPX bank, e-wallet provider);

Last 4 digits and expiry date of cards (for reference and customer support only);

Transaction reference numbers.

Important: Full card numbers, CVV codes, and bank login credentials are never collected, stored, or accessed by Mipos. These are entered directly on the secure portals of our authorised, PCI-DSS compliant payment gateway partners and are processed solely by them.

2.3 Information collected automatically

When you visit the Site, we automatically collect:

Technical data — IP address, browser type and version, device type, operating system, screen resolution, time-zone setting;

Usage data — pages viewed, links clicked, time spent on pages, referring URL, search terms used on the Site;

Location data — approximate geographic location derived from your IP address;

Cookie data — see Section 8 below.

2.4 Information from third parties

We may receive personal data about you from:

Payment gateway partners — transaction status, fraud risk indicators;

Courier and logistics partners — delivery status, signature on receipt;

Marketing platforms (e.g., Meta, Google) — where you interact with our ads with your permission;

Public sources — business registry data when verifying a corporate customer.

3. How We Collect Your Personal Data

We collect personal data when you:

Browse, register, or place an Order on shop.mipos.my;

Create or update an account;

Make a payment;

Subscribe to our newsletter;

Contact us by email, WhatsApp, phone, or social media;

Submit a review, comment, or feedback;

Participate in a promotion, survey, or campaign;

Visit our physical premises (e.g., showroom) and provide your details;

Interact with our ads or content on third-party platforms.

4. Purposes of Collection and Processing

We collect and process your personal data for the following purposes:

4.1 To provide our services

To process and fulfil your Orders;

To verify your identity and prevent fraud;

To arrange shipping and delivery;

To handle returns, refunds, and warranty claims;

To provide customer service and respond to your enquiries;

To manage your account and preferences.

4.2 To improve our services

To analyse Site usage and improve user experience;

To develop new products, features, and services;

To conduct internal research and statistical analysis (in aggregated, non-identifiable form where possible).

4.3 For marketing (with your consent)

To send you newsletters, promotional offers, and product updates;

To personalise the content and offers you see;

To run remarketing or lookalike audience campaigns on platforms like Meta and Google;

To invite you to participate in surveys, events, or loyalty programmes.

4.4 For legal and compliance purposes

To comply with applicable laws, regulations, and lawful requests from authorities;

To enforce our Terms and Conditions and Return and Refund Policy;

To protect our rights, property, and the safety of our customers, staff, and the public;

To detect, prevent, and address fraud, security, or technical issues;

To maintain tax, accounting, and statutory records.

5. Legal Basis for Processing

Under the PDPA, we process your personal data on one or more of the following bases:

Where we rely on your consent, you may withdraw your consent at any time (see Section 12).

6. Disclosure of Personal Data to Third Parties

We do not sell your personal data. We may disclose your personal data to the following classes of third parties, strictly for the purposes set out in this Policy:

6.1 Service providers and business partners

E-commerce platform provider — SiteGiant Sdn Bhd, our webstore platform and hosting partner, which processes customer accounts, orders, and related data on our behalf. Customer and order data hosted through SiteGiant is stored within Malaysia.

Payment gateway provider — Billplz Sdn Bhd, our authorised payment gateway integrated through the SiteGiant platform, which processes credit/debit card transactions (Visa, MasterCard), FPX online banking, DuitNow QR (where enabled), and Buy Now Pay Later transactions (via GrabPayLater and Atome) on our behalf. Billplz is a Malaysian-licensed payment service provider.

Couriers, logistics partners, and pickup arrangements — including GDex, Lalamove, J&T Express, and self-pickup from our premises. We may engage additional courier partners (e.g., Pos Laju, DHL, Skynet) as required for delivery and return shipping;

Cloud hosting and infrastructure providers (e.g., used by SiteGiant for Site hosting and by us for backup, email, storage);

Email and messaging service providers (e.g., for transactional and marketing emails, WhatsApp Business);

Analytics and advertising platforms (e.g., Google, Meta — with your cookie consent where required);

IT, software, and security service providers (e.g., for customer relationship management, anti-fraud screening);

Professional advisers (e.g., lawyers, auditors, accountants) under a duty of confidentiality.

6.2 Authorised brand partners

Where required for warranty processing, technical support, or order fulfilment, we may share necessary order details with our authorised brand partners (e.g., Sunmi, Posmac, Zywell, Henex, FeedMe POS, EzyRetail).

6.3 Government, regulators, and law enforcement

Where required by law, court order, or to protect our legal rights, the safety of our staff or customers, or to prevent fraud or crime.

6.4 Business transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of our business, your personal data may be transferred to the relevant party, subject to confidentiality undertakings and continued protection under this Policy.

All third parties acting as data processors on our behalf are required to safeguard your personal data in accordance with the PDPA and our written instructions.

7. Cross-Border Data Transfers

Your customer account, order data, and webstore content are hosted by SiteGiant within Malaysia, and payment transactions are processed by Billplz, a Malaysian-licensed gateway.

However, some other service providers we use (e.g., analytics platforms such as Google Analytics, marketing platforms such as Meta, email service providers, and cloud backup providers) may be located outside Malaysia. Where we transfer your personal data outside Malaysia, we will:

Ensure the receiving country provides an adequate level of personal data protection; or

Put in place appropriate contractual safeguards with the receiving party; or

Rely on one of the permitted grounds for cross-border transfer under Section 129 of the PDPA (including your consent or that the transfer is necessary to perform a contract with you).

8. Cookies and Tracking Technologies

8.1 What are cookies

Cookies are small text files placed on your device when you visit a website. They help the Site function and allow us to recognise you on return visits.

8.2 Types of cookies we use

8.3 Managing cookies

The cookie banner and consent mechanisms on shop.mipos.my are provided through the SiteGiant platform.

Most browsers allow you to refuse or delete cookies through their settings.

Where required, we will request your consent via a cookie banner before placing non-essential cookies.

Disabling certain cookies may affect Site functionality.

9. Marketing Communications

We will only send you marketing communications if you have opted in during checkout, registration, or via a separate sign-up form.

Every marketing email contains an unsubscribe link. You may also opt out by emailing [email protected].

We will continue to send transactional messages (e.g., order confirmations, delivery updates, refund notifications) regardless of marketing preferences, as these are necessary for fulfilling your Orders.

We do not share your contact details with third parties for their own marketing purposes.

10. Data Retention

We retain your personal data only for as long as necessary for the purposes set out in this Policy or as required by law:

When personal data is no longer needed, it will be securely deleted or anonymised.

11. Data Security

We take appropriate technical and organisational measures, both directly and through our platform provider SiteGiant, to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

Encryption of data in transit (HTTPS / TLS) across the entire Site, provided by the SiteGiant platform;

PCI-DSS compliant payment processing by our integrated gateway partners — full card numbers, CVV codes, and bank credentials are never stored on Mipos or SiteGiant systems and are processed solely by the gateway;

Platform-level security maintained by SiteGiant as our hosting and e-commerce provider, including server security, network protection, and patching;

Access controls — only authorised Mipos personnel can access personal data, on a need-to-know basis;

Secure password storage using industry-standard hashing (managed by the SiteGiant platform);

Regular reviews of our service providers’ security practices;

Staff training on data protection and confidentiality;

Backup and disaster recovery procedures.

While we take reasonable steps to protect your personal data, no method of transmission or storage is 100% secure. You are also responsible for keeping your account credentials confidential.

12. Your Rights Under the PDPA

Under the PDPA, you have the following rights in respect of your personal data:

12.1 Right of access

You may request a copy of the personal data we hold about you.

12.2 Right of correction

You may request that we correct any inaccurate, incomplete, or out-of-date personal data we hold about you.

12.3 Right to withdraw consent

You may withdraw your consent for us to process your personal data at any time. Please note that withdrawal may affect our ability to provide certain services (e.g., processing future Orders, sending marketing communications). Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

12.4 Right to limit processing

You may request that we limit the processing of your personal data for specified purposes (e.g., direct marketing).

12.5 Right to data portability

You may request a copy of your personal data in a structured, commonly used format where technically feasible.

12.6 Right to lodge a complaint

If you are unsatisfied with how we handle your personal data, you may lodge a complaint with the Personal Data Protection Department (Jabatan Perlindungan Data Peribadi, JPDP) under the Ministry of Digital Malaysia:

Website: https://www.pdp.gov.my

Email: [email protected]

12.7 How to exercise your rights

To exercise any of the above rights, please contact us at [email protected] with:

Your full name and contact details;

A description of the personal data and right you wish to exercise;

Verification of your identity (we may request supporting documents).

We will respond to your request within 21 days of receipt, as required under the PDPA. A small administrative fee may be charged for repeated or excessive requests, as permitted by law.

13. Children’s Personal Data

The Site is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from minors. If you are under 18, please do not submit any personal data to us without the consent and supervision of a parent or legal guardian.

If we become aware that we have inadvertently collected personal data from a minor without parental consent, we will take steps to delete that data as soon as reasonably possible.

14. Third-Party Links

The Site may contain links to third-party websites, plugins, or services (e.g., social media, partner brand sites). This Privacy Policy applies only to shop.mipos.my. We are not responsible for the privacy practices of third-party sites. We encourage you to review the privacy policies of any third-party site you visit.

15. Data Breach Notification

In the unlikely event of a personal data breach that is likely to result in a significant risk to your rights and interests, we will:

Take immediate steps to contain and remedy the breach;

Notify affected customers without undue delay, with information about the nature of the breach and the steps we are taking;

Notify the relevant regulatory authorities where required by law.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or services. The “Last updated” date at the top of this page will indicate when changes take effect.

For material changes, we will notify you by email (if you have an account or have subscribed) or by posting a prominent notice on the Site. Your continued use of the Site after the changes take effect constitutes acceptance of the updated Policy.

17. Language

This Privacy Policy is published in English and Bahasa Malaysia in accordance with Section 7(3) of the PDPA. In the event of any inconsistency between the two versions, the English version shall prevail unless otherwise required by law.

18. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

Mipos Sdn Bhd (Company No. 202201032890) Trading as: Mipos ShopTech Data Protection Contact

No. 29, Jalan 2, Taman Len Seng, 56000 Cheras, Wilayah Persekutuan Kuala Lumpur, Malaysia

Email: [email protected] Phone / WhatsApp: 010-3167 320 Business Hours: Monday to Friday, 9:00 AM – 5:00 PM (lunch break 12:30 PM – 1:30 PM); Saturday, 9:00 AM – 2:00 PM. Closed on Sundays and public holidays.

By using shop.mipos.my, you acknowledge that you have read, understood, and agreed to this Privacy Policy.