Privacy Notice: Ibn Zelt online store

Ibn Zelt (trading as Ibn Zelt), SSM registration no. 201403253913, No. 8, Kampung Tengku Hussien Lama, 30020 Ipoh, Perak, Malaysia ("we") is the data user for the personal data you give when you shop on this store. Privacy contact: [email protected] / 1-700-81-9747.

This store runs on the SaudaCart platform provided by Ibn Zelt (SSM 201403253913 / IP0418148-M). Ibn Zelt processes your personal data only on our instructions and on our behalf, to host the store, record your order, send order emails and keep backups. Ibn Zelt does not use your data for its own purposes and does not sell it. Ibn Zelt's own privacy policy covers its merchant customers, not you; this notice is the one that applies to you.

We collect it from you, through the checkout and payment pages: - Contact details: email address (required), name and phone number (optional). - Order details: items, prices, order number and order status. - Payment details: the amount you transferred, any transfer reference or note you give, and any payment proof you upload (a receipt image or PDF). We do not collect your card details or online-banking login. - When you pay online, CHIP IN Sdn Bhd, our payment processor, receives your name, email, the amount and your order reference to process the payment. - Record of acceptance: which version of our Terms and of this notice you accepted, when, the language (English), and the returns policy shown to you at the time. - Technical data: your IP address, recorded in our security logs when you place an order or submit a payment. - Sales agent referral: if you opened this store through one of our sales agents' links, your browser keeps that agent's code for 30 days, and your order records which agent referred you. Nothing about you is stored with the code, and it does not change your price. - Orders placed by a sales agent: if one of our sales agents places an order for you, the agent gives us your name, phone number and the items you want (and your email, only if you choose to share it). We use them only for that order, and the order records which agent placed it. - Applying to become a sales agent: if you apply on our "Become an agent" page, you give us your name and phone number, and your email and a short note only if you choose to. We record that you agreed to this notice and when.

If you later give us delivery details (for example, by email or phone when we arrange delivery), we use them only to deliver your order.

- To process, confirm, deliver and support your order, and to contact you about it. - To verify your payment and, where needed, to refund you. - To issue invoices and keep the accounting and tax records we are required to keep. - To handle complaints, returns and your statutory rights. - To prevent fraud and keep the store secure. - To pay commission to the sales agent who referred you, if any. - To review an application to become one of our sales agents, and to contact you about it. - To comply with the law and with requests from authorities.

We do not use your data for marketing.

Your email address is required: without it we cannot send you your payment link and order updates, so we cannot take your order. If a sales agent places the order for you, your name and phone number are required instead and your email is optional; the agent passes you the payment link. A payment reference or payment proof is required for us to verify your payment. Your name and phone number are optional; leaving them out may make delivery or contact slower.

| Recipient | Role | |---|---| | Ibn Zelt | Our software provider (processor) | | Supabase | Database and file hosting for the platform (sub-processor); hosted in Singapore (AWS ap-southeast-1 region) | | Dynamail | Delivers order and payment emails (sub-processor) | | CHIP IN Sdn Bhd | Processes your online payment when you choose to pay online (receives your name, email, amount and order reference) | | Hetzner | Stores encrypted database backups (sub-processor); in the European Union | | Cloudflare | Network security and delivery; your connection to the store passes through it (sub-processor) | | LHDN / MyInvois | Receives e-Invoices, only where we are required to issue one for your purchase | | Our accounting integration (only if we use one) | Receives customer and invoice records for our books | | Our delivery provider (only if your order is delivered) | Delivers your order | | Authorities, courts, our professional advisers | Where the law requires, or to protect our legal rights |

We do not sell your personal data.

Some of the providers above store or process your data outside Malaysia, including in Singapore (database and file hosting) and the European Union (backups). Cloudflare operates a global network. We use these providers only to run this store for the purposes in section 4.

- Order, invoice and payment records, including payment-proof files: for as long as the law requires us to keep business, accounting and tax records, unless you ask us to erase your data (section 9). - Backups: copies of the platform's database are kept in encrypted backups for up to about six months and then deleted on a rolling basis. Data we erase from our live systems may remain in those backups until they expire. - Applications to become a sales agent: deleted as soon as we decide. If we approve you, your name and phone number become your agent record. An application we have not decided is deleted after 90 days. - Everything else: only as long as needed for the purposes in section 4.

When you ask us to erase your data, we erase or irreversibly pseudonymise your name, contact details, billing and delivery addresses, tax identifiers, order-delivery details, payment-reference notes, uploaded payment-proof files, staff notes about you and quotation notes. A few items cannot be, or are not yet, fully erased:

1. e-Invoices already filed with LHDN/MyInvois (if any) are kept. LHDN holds its own copy, and changing ours would misrepresent a filed document and break its validation link. 2. Evidence of any e-Invoice consent you gave (email, IP address and browser identifier at that time) is kept, to show we had a lawful basis for that processing. 3. A copy already sent to our accounting integration (if we use one) cannot be recalled from that system; we redact our own copy. A copy not yet sent is deleted. 4. Rejection messages from the tax authority's system (if any) are kept for now, while we check whether they can contain personal data. 5. An application error log might, in a rare and unconfirmed technical case, contain your email address. We disclose this out of caution. 6. Emails already sent to you (or by you) are outside our systems and cannot be recalled. 7. Product reviews you wrote (if any) stay visible, attached to your anonymised profile; we do not scan their text, so any personal detail you typed into a review stays. Any saved-items list is also kept, anonymised.

Backup copies are covered by section 8.

You may ask us to: give you access to your personal data; correct it; stop or limit processing (including withdrawing consent where we rely on it); and erase it (subject to section 9).

Because you shop as a guest, email [email protected] from the email address you used to order, with your order number and your request. If you write from a different address, we may ask you to confirm your identity before we act. We reply within the time the law requires. We may ask Ibn Zelt, our processor, to help carry out your request. If you are not satisfied, you may complain to the Personal Data Protection Commissioner.

If you applied to become a sales agent, contact us at [email protected] or 1-700-81-9747 with the phone number you applied with; we will delete your application.

We and our providers protect your data with access controls, encryption in transit and encrypted backups. If a personal data breach is likely to cause you significant harm, we will notify you and the Personal Data Protection Commissioner as the law requires, and tell you what we are doing about it and what you can do.

We will post changes here with a new version and date. The version you accepted is recorded with your order.