Privacy Notice

At a glance (summary only, the full notice below governs)

• What we collect and why: the data needed to run your account, orders, rewards and support.
• We never sell your personal data.
• You control your marketing, location and analytics choices.
• Contact our DPO at privacy@gratzels.com.my.

Gratzels(M) Sdn Bhd (Company No: 1561927-X) (“Gratzels”, “we”, “us”, or “our”) values your privacy. This Personal Data Protection Notice (“Notice”) is issued to all users of the Gratzels mobile application (Android and iOS) pursuant to the Notice and Choice Principle under Section 6 of the Malaysian Personal Data Protection Act 2010 (PDPA 2010).

This Notice informs you of your rights regarding the collection, usage, storage, disclosure, and retention of your personal data processed by us or on our behalf.

1. Description and Categories of Personal Data Processed

We process personal data that you provide directly to us, as well as data generated automatically during your commercial interactions with the Gratzels mobile application:

Identification Data:

Your full name and date of birth (collected exclusively for age verification or the administration of birthday rewards).

Contact Data:

Your email address, mobile phone number, delivery address, and billing address.

Account Credentials:

Your username and account password (which are strictly stored in a cryptographically hashed, non-plaintext form).

Demographic Data:

Information such as age range, gender, race, occupation, geographic location and other demographic information voluntarily provided by the customer.

Transactional Data:

Order history, transaction references, and secure payment tokens. Note: Gratzels does NOT collect or store full payment card details; all financial transactions are processed directly by an external, PCI-DSS compliant payment gateway.

Loyalty Programme Data:

Membership ID, points balance, tier status, and reward redemption history.

Device and Technical Data:

Unique device identifier, operating system and version, application version, IP address, and push notification tokens.

Behavioural/Usage Data:

In-app activity, screen views, search and browse history within the app, and interaction with promotional content.

Location Data:

Precise device location. This is captured only if you grant explicit, OS-level permission, and is exclusively used when specific app features (such as locating the nearest outlet or checking delivery serviceability) are active.

Marketing Preference Data:

Opt-in and opt-out preference flags across our communication channels (Email, SMS, Push notifications). Where permitted by applicable law and subject to your marketing preferences, we may use customer segmentation, profiling and analytics techniques to determine which products, promotions, rewards, offers and communications may be most relevant to you.

Customer Service Data:

Communications, complaints, feedback, and supporting attachments submitted during customer support inquiries.

Exclusions: We do not collect "sensitive personal data" (such as health conditions, religious beliefs, or political opinions) under Section 4 of the PDPA 2010. The application is strictly not directed at, and does not knowingly collect personal data from, children under the age of 13.

2. Sources of Personal Data

We obtain your personal data from the following legitimate sources:

• Directly from you: Data provided during account registration, profile updates, order placement, reward redemptions, and customer service communications.
• Automated Collection: Technical data, device logs, and usage analytics generated automatically when you download, open, or interact with the mobile application.

3. Purposes of Processing Personal Data

Your personal data is collected, used, and further processed for the following necessary business and commercial purposes:

• To process your account registration, identity verification, authentication, and ongoing account management.
• To process, prepare, and fulfill your orders across our in-store, self-service kiosk, and home-delivery channels.
• To process payments, execute refunds, and mitigate transactional fraud via our third-party payment service providers.
• To administer the Gratzels loyalty programme, including points accrual, tier tracking, and reward redemptions.
• To provide customer support, manage feedback, and resolve complaints or technical disputes.
• To deliver automated transactional notifications, including order confirmations, real-time delivery status updates, and digital receipts.
• To deliver personalized in-app layouts, customized offers, and menu recommendations tailored to your usage behavior.
• To maintain application security, perform internal system logging, detect network abuses, and execute regular platform audits.
• To conduct application data analytics, track stability metrics (such as crash reporting), and optimize service performance.
• To comply with applicable legal, tax, statutory accounting, and regulatory obligations in Malaysia, and to respond to lawful requests from law enforcement or public authorities.
• To analyse customer demographics, purchasing behaviour, loyalty programme activity, spending patterns, preferences, engagement trends and other customer insights for the purposes of customer segmentation, audience profiling, business intelligence, service improvement, campaign planning, targeted marketing, customer retention initiatives and measurement of marketing effectiveness.

Direct Marketing and Promotional Communications

Subject to your separate, explicit opt-in selection, we may use your contact details to send you marketing communications regarding Gratzels' special offers, seasonal menus, and brand campaigns via Email, SMS, or Push notifications. If you choose to opt out of marketing communications, the opt-out will be processed completely free of charge and will not alter, restrict, or degrade any of our core, non-marketing services.

4. Disclosure and Classes of Third Parties

To facilitate our operations and provide you with our services, Gratzels may disclose your personal data to specific classes of third parties on a strict need-to-know basis, governed by binding contractual protections:

• Dynectus Sdn Bhd: Our principal data processor responsible for developing, hosting, maintaining, and supporting the application infrastructure under a legally binding Data Processing Agreement.
• Payment Gateways & Financial Institutions: Disclosed strictly for processing your financial transactions and managing electronic refunds safely.
• Delivery and Logistics Partners: Third-party couriers or riders tasked with fulfilling and delivering your physical food orders.
• Cloud Infrastructure Providers: Secure cloud computing entities hosting the application backend databases and technical server architecture.
• Analytics and Crash-Reporting Entities: Third-party performance monitoring services used exclusively for maintaining mobile app stability.
• Communication Gateway Providers: Services that transmit our transactional automated text messages, emails, or push notifications.
• Professional Advisors: Our external legal counsel, financial auditors, and corporate accountants on a confidential basis.
• Corporate Group Companies: Related entities within the Gratzels corporate group for legitimate, internal intra-group operational purposes.
• Law Enforcement and Public Regulators: Courts, public safety agencies, or government bodies where mandatory disclosure is dictated by law or judicial order.
• Corporate Successors: Prospective or actual buyers in the event of a merger, corporate acquisition, asset restructuring, or sale of business assets, strictly conditional on the recipient honoring this Notice.

We do not sell your personal data to third parties under any circumstances.

5. Choice and Voluntary vs. Mandatory Data Supply

• Mandatory Data Supply: The provision of personal data relating to your name, contact phone number, email address, password, and transaction inputs is obligatory. Failure to provide this information will make it impossible for us to register your account, process your orders, or deliver products to you.
• Voluntary Data Supply: The provision of personal data for direct marketing, precise location services, and analytical tracking is completely voluntary. You may opt out or decline permissions at any time without restricting your primary ability to use the application.

6. Your Rights under the PDPA 2010

A. Right to Access and Correct Your Personal Data

You have the right to request access to your personal data profile, request a copy of it, or request that any inaccurate, misleading, or out-of-date personal data be corrected.

• How to exercise: You can view and edit your profile info, addresses, and download a basic file of your account data directly through the in-app self-service settings. For broader, structured inquiries, you may contact our DPO via email or post.
• Our Timeline: In accordance with Sections 30 to 37 of the PDPA 2010, we will fulfil requests within twenty-one (21) calendar days of receipt, extending to a maximum of thirty (30) days. If a delay occurs due to identity verification, we will notify you in writing with the reasons and extended timeline.

Note: We reserve the right to securely verify your identity before releasing data and may charge a prescribed administrative fee where permitted under Malaysian law.

B. Right to Withdraw Consent and Limit Processing

You have the right to withdraw your consent or place limitations on how we process your personal data (including stopping direct marketing completely).

• How to exercise: You can adjust the in-app preference toggles, use the "Unsubscribe" links located at the bottom of our emails, or communicate a formal request directly to our DPO.
• Our Timeline: Gratzels will process your withdrawal of consent within ten (10) business days from the date the request is received. We will notify you once the change is active.

C. Right to Data Portability (Section 43A)

You have the right to request that we transmit the personal data you provided directly to us (such as your account profile information) to another data controller of your choice in a structured, commonly used, and machine-readable electronic format.

• Our Timeline: We will complete this transmission within twenty-one (21) days from receiving your written electronic request, provided the request is technically feasible and the destination data format is compatible with our application ecosystem.

7. Data Security and Technical Safeguards

To comply with the statutory Security Principle under Section 6 of the PDPA 2010, Gratzels and its data processor, Dynectus Sdn Bhd, enforce comprehensive security mechanisms:

• Cryptographic protection using Transport Layer Security (TLS 1.2 or higher) for data in transit and advanced encryption standard (AES-256) for data at rest.
• Isolation of full payment information via gateway-level tokenization.
• Strict Role-Based Access Control (RBAC) governed by least-privilege principles, requiring mandatory multi-factor authentication (MFA) for administrative platform access.
• Continuous application hardening, security firewalls, intrusion prevention architectures, and pre-launch third-party penetration testing to identify vulnerabilities.

Pursuant to the 2024-2026 statutory amendments, Dynectus Sdn Bhd, acting as our Data Processor, faces direct statutory liability under the law to maintain these security standards alongside Gratzels.

8. International Cross-Border Data Transfers

Your personal data is primarily stored on AWS cloud infrastructure located within the Malaysia region. However, certain global sub processors (such as cross-border analytics tools or international communication API gateways) may process a limited portion of your technical data outside of Malaysia.

Where cross-border transfers occur, Gratzels will implement appropriate safeguards which includes but not limited to Transfer Impact Assessments (TIAs) and undertake the necessary assessments required under applicable data protection laws

9. Data Retention and Destruction

We retain your personal data for the duration necessary to satisfy the specific purposes detailed in Section 3, or to comply with overarching legal obligations:

• Active Customer Accounts: Retained for the active duration of your customer relationship with us.
• Financial and Transactional Logs: Retained for a mandatory baseline period of at least seven (7) years from the end of the relevant assessment year, satisfying compliance standards under the Income Tax Act 1967 and the Companies Act 2016.
• Legal Defence Records: Data required to establish or defend legal claims, or address regulatory inquiries, is preserved for the duration of the statutory limitation window or until the dispute is resolved.

Once these retention milestones expire, all personal data is permanently deleted, securely overwritten, or fully anonymized using irreversible methods.

10. Inquiries, Access Requests, or Complaints

If you wish to ask a question, request access or correction, change your communication limits, or lodge a formal privacy complaint under Section 12A of the PDPA, please contact our designated coordinator:

Versi Bahasa Malaysia akan datang.

The Bahasa Malaysia version of this notice is being prepared and will appear here once reviewed. For now, please refer to the English version.