01Who we are
Squeeeshies is run by [registered business name] (SSM [registration number]), [business address].
We decide how your personal data is used, which makes us the data controller under Malaysia's Personal Data Protection Act 2010 (PDPA). Contact us at [your email] or [your phone].
02What we collect
| What | Example | Why | Needed? |
|---|---|---|---|
| Contact details | Name, email, mobile number | Order confirmation, tracking SMS, help with your order | Yes to order |
| Delivery address | Street, postcode, city, state | So the courier can deliver | Yes to order |
| Order details | What you bought, price, date | To send it, handle returns and keep accounts | Yes to order |
| Payment status | "FPX, paid" | To confirm you paid. Card and bank details go straight to our payment provider. We never see full card numbers. | Yes to order |
| Gift note | The message you write | To include it with the parcel | Optional |
| Messages to us | Emails, WhatsApp, photos of a damaged item | To answer you and fix problems | Only if you contact us |
| Newsletter email | Your email | To send news and new drops | Only if you sign up |
| Device and usage data | Pages viewed, device type, rough location from IP address, cookie IDs | To keep the shop working and, if you agree, to measure and show ads | Essential parts yes; analytics and ads only with your OK |
03Why we use it
- To take, pack and deliver your order.
- To send order and delivery updates by email and SMS.
- To help with problems, returns and refunds.
- To keep the shop safe and stop fraud.
- To keep the accounting records the law requires.
- To send newsletters and offers, only if you (or your parent or guardian) agreed.
- To measure and improve our ads, only if you accepted analytics or ad cookies.
We don't sell your personal data.
04Under 18? A note for parents
Our squishies are made for kids and teens. Under Malaysian law, when someone is under 18, a parent or guardian gives consent for how their personal data is used.
- If you're under 18, ask a parent or guardian to place the order or sign up with you. We ask for this at newsletter signup and checkout.
- Parents and guardians can contact us to see, correct or delete their child's data, or to stop marketing emails.
- If we learn we've collected a child's data without a parent or guardian's OK, we'll delete it.
- Ad cookies are off unless someone chooses to turn them on, and we follow Meta, TikTok and Google's rules on advertising to young people.
05Cookies and ad tracking
Cookies and similar tools (like the "pixels" ad platforms provide) are small pieces of data saved in your browser. Here's what we use:
| Type | What it does | Tools | On? |
|---|---|---|---|
| Essential | Remembers your bag, language and cookie choice | Our site, Shopify | Always (the shop can't work without them) |
| Analytics | Counts visits and shows which pages are popular | Shopify Analytics, Google Analytics | Only if you say yes |
| Advertising | Measures our ads and shows our squishies on other apps and sites | Meta Pixel (Facebook, Instagram), TikTok Pixel, Google Ads | Only if you say yes |
You choose on your first visit. You can change your choice any time:
06Who we share it with
We only share what each one needs to do their job:
- The seller who packs your order. We work with partner sellers in Malaysia who ship straight to you, so they receive your name, phone number, delivery address and what you ordered.
- Couriers (such as J&T Express, Ninja Van and Pos Laju) get your name, phone number and address to deliver.
- Shopify runs our online shop and stores order data.
- Our payment provider takes your payment securely.
- Meta, TikTok and Google receive device and usage data, only if you accepted those cookies.
- Authorities, when the law requires it, for example a court order.
07Where it's stored
Shopify, our payment provider and ad platforms may store data on servers outside Malaysia. When data leaves Malaysia, we only use providers that protect it to a standard similar to the PDPA.
08How long we keep it
- Orders and payments: as long as Malaysian tax and company law requires (often 7 years).
- Messages to us: up to 2 years after we last hear from you.
- Newsletter: until you unsubscribe.
- Analytics and ad data: as set by each platform, usually up to 2 years.
09How we protect it
- Our shop uses a secure (HTTPS) connection.
- Only people who need your details to handle your order can see them.
- Our accounts use strong passwords and two-step login.
- Payments go through a provider that meets card-industry security standards.
- We ask our sellers and couriers to use your details only for your order.
10Your rights
- Email [your email] from the address you used with us, with the subject "Privacy request".
- Say what you'd like us to do. Parents: tell us your child's name and order number.
- We may ask a question to check it's really you. We reply within 21 days.
11Data breaches
If your data is leaked or stolen and it could cause you serious harm, we'll tell the Personal Data Protection Commissioner and you as soon as we can, and explain what we're doing about it.
12Changes and complaints
We may update this policy. We'll change the date at the top, and email you if the change is a big one.
Questions or complaints? Contact us first at [your email]. If you're not happy with our answer, you can complain to the Personal Data Protection Commissioner (Jabatan Perlindungan Data Peribadi) at www.pdp.gov.my.