1. Introduction

At www.thldna.com(hereinafter referred to as “we”, “us”, or “our”), we respect and are committed to protecting your privacy and personal data.

This Privacy Policy explains how we collect, use, process, store, disclose, and protect your personal data when you visit or use www.thldna.com (the “Platform”) and when you purchase our products or use our services.

We process personal data in accordance with applicable laws and regulations, including the Personal Data Protection Act 2010 of Malaysia (Act 709), as amended from time to time (“PDPA”), where applicable. The Malaysian Personal Data Protection Commissioner identifies the PDPA as the principal framework governing the processing of personal data in connection with commercial transactions.

Please read this Privacy Policy carefully before using our Platform or providing us with your personal data.

2. Scope of This Privacy Policy

This Privacy Policy applies to personal data collected through:

• thldna.com;
• Our online store and related services;
• Orders and transactions made through the Platform;
• Customer service communications;
• Email communications; and
• Other interactions between you and us relating to our products and services.

By using our Platform or providing your personal data to us, you acknowledge that you have read and understood this Privacy Policy.

3. Personal Data We Collect

Depending on how you interact with us, we may collect the following categories of personal data:

3.1 Identity and Contact Information

This may include:

• Full name;
• Email address;
• Telephone or mobile number;
• Billing address;
• Shipping or delivery address; and
• Other information necessary to process your order.

3.2 Transaction and Order Information

We may collect information relating to your transactions, including:

• Order number;
• Products purchased;
• Purchase history;
• Order value;
• Delivery information;
• Refund or return information; and
• Customer service records relating to your orders.

3.3 Payment-Related Information

Where necessary to process a transaction, we may collect or receive payment-related information, such as:

• Payment method;
• Payment transaction reference;
• Payment status;
• Transaction amount;
• Currency;
• Payment authorization or confirmation information; and
• Other information required to verify or process a payment.

Where payment is processed by a third-party payment service provider, we may not directly collect or store your complete payment card details. Instead, such information may be collected and processed directly by the applicable payment service provider in accordance with its own privacy policy and applicable legal and security requirements.

4. Device and Technical Information

When you access our Platform, we may automatically collect certain technical information, including:

• IP address;
• Browser type;
• Operating system;
• Device type;
• Device identifiers;
• Approximate geographic information;
• Referring URLs;
• Pages viewed;
• Access time and date; and
• Other technical information relating to your use of the Platform.

5. How We Use Personal Data

We may use your personal data for purposes including:

• Processing and fulfilling orders;
• Processing payments and verifying transactions;
• Arranging shipping and delivery;
• Processing returns, refunds, and exchanges;
• Providing customer service and responding to inquiries;
• Managing customer accounts;
• Communicating with you regarding your orders and transactions;
• Sending important service-related notices;
• Detecting and preventing fraud, unauthorized transactions, and other security risks;
• Improving our products, services, website functionality, and customer experience;
• Conducting business, operational, statistical, and market analysis;
• Complying with applicable laws, regulations, legal processes, or lawful requests; and
• Sending marketing or promotional communications where permitted by applicable law and, where required, with your consent.

6. Sharing Personal Data with Payment Service Providers

To process payments and complete transactions, your personal data may be shared with payment service providers, payment processors, acquiring banks, card networks, financial institutions, fraud prevention providers, and other payment-related service providers, to the extent reasonably necessary and permitted or required under applicable law, including the PDPA.

Such information may include, where necessary:

• Name;
• Email address;
• Billing or transaction information;
• Order number;
• Transaction amount;
• Currency;
• Payment status;
• IP address or device information;
• Payment transaction references; and
• Other information reasonably necessary to authorize, process, verify, secure, or reconcile a payment.

These payment service providers may process your personal data for purposes including:

• Authorizing and processing payments;
• Verifying transactions;
• Detecting and preventing fraudulent or unauthorized transactions;
• Managing chargebacks and payment disputes;
• Meeting applicable financial, regulatory, anti-fraud, and security requirements; and
• Providing payment-related customer support.

We do not share more personal data than is reasonably necessary for the relevant payment or transaction purpose.

Where payment services are provided by third parties, those providers may process your personal data independently in accordance with their own privacy policies and applicable legal requirements.

7. Other Disclosure of Personal Data

In addition to payment service providers, we may disclose personal data to third parties where reasonably necessary for the purposes described in this Privacy Policy, including:

• Shipping and logistics providers;
• Technology and hosting service providers;
• Customer service providers;
• Fraud prevention and security service providers;
• Professional advisers, auditors, or consultants;
• Business partners and service providers supporting our operations;
• Government authorities, regulators, courts, law enforcement agencies, or other parties where required or permitted by law; and
• Potential or actual buyers, investors, successors, or other parties in connection with a merger, acquisition, restructuring, sale, or transfer of all or part of our business or assets.

Any disclosure will be made in accordance with applicable legal requirements.

8. Cross-Border Transfers

Some of our service providers, including payment service providers, technology providers, hosting providers, or other business partners, may be located outside Malaysia.

Where personal data is transferred outside Malaysia, we will take reasonable steps to ensure that such transfers and processing are carried out in accordance with applicable Malaysian data protection laws and requirements.

The Malaysian Personal Data Protection Commissioner has issued guidance specifically addressing cross-border transfers of personal data, and applicable requirements may depend on the circumstances of the transfer.

9. Cookies and Tracking Technologies

We may use cookies, web beacons, pixels, analytics tools, and similar technologies to:

• Maintain and improve the functionality of our Platform;
• Remember user preferences;
• Analyze website traffic and usage;
• Improve our products and services;
• Understand customer behavior;
• Detect security threats and fraudulent activity; and
• Provide relevant advertising or marketing where permitted by applicable law.

You may be able to control or disable certain cookies through your browser settings. However, disabling certain cookies may affect the functionality of the Platform.

10. Third-Party Websites and Services

Our Platform may contain links to third-party websites, applications, payment services, or other external services.

Third-party services may have their own privacy policies and terms of use. We recommend reviewing the privacy policies of those third parties before providing them with your personal data.

We are not responsible for the privacy practices of third-party websites or services that are not controlled by us.

11. Security of Personal Data

We take reasonable technical and organizational measures to protect personal data against unauthorized access, collection, use, disclosure, alteration, loss, misuse, or destruction.

Depending on the circumstances, security measures may include:

• Access controls;
• Authentication mechanisms;
• Encryption or secure transmission technologies;
• Security monitoring;
• Internal access restrictions; and
• Other appropriate technical and organizational safeguards.

However, no method of electronic transmission or storage can be guaranteed to be completely secure.

12. Retention of Personal Data

We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, including to:

• Fulfil contractual and transactional obligations;
• Provide customer support;
• Process refunds and resolve disputes;
• Meet legal, regulatory, accounting, tax, and reporting requirements;
• Prevent fraud and maintain security; and
• Establish, exercise, or defend legal claims.

When personal data is no longer required, we will take reasonable steps to delete, anonymize, or otherwise dispose of it in accordance with applicable requirements.

13. Your Rights

Subject to applicable law and any applicable conditions or limitations, you may have rights relating to your personal data, including the right to:

• Request access to personal data held by us;
• Request correction of inaccurate, incomplete, or outdated personal data;
• Request that we stop or limit certain processing where applicable;
• Withdraw consent where processing is based on consent;
• Object to certain processing, including certain direct marketing activities; and
• Make inquiries or complaints regarding our handling of personal data.

The Malaysian Personal Data Protection Commissioner identifies access, correction, withdrawal of consent, and prevention of processing among relevant data-subject rights under the PDPA.

Some requests may be subject to applicable legal requirements, exceptions, or limitations.

To exercise your rights or make an inquiry, please contact us using the contact information provided below.

14. Personal Data You Provide to Us

Where personal data is required for us to process an order, provide a service, complete a payment, arrange delivery, or comply with applicable legal requirements, failure to provide the requested information may prevent us from providing the relevant service or completing the transaction.

You are responsible for ensuring that personal data provided to us is accurate, complete, and up to date.

15. Marketing Communications

Where permitted by applicable law, we may send you marketing or promotional communications regarding our products, services, promotions, or other relevant information.

Where consent is required, we will obtain the appropriate consent before sending such communications.

You may opt out of marketing communications by following the unsubscribe instructions included in the relevant communication or by contacting us directly.

16. Data Breach and Security Incidents

If we become aware of a personal data breach that is subject to notification requirements under applicable law, we will take appropriate steps to investigate, contain, and address the incident and make any required notifications in accordance with applicable legal requirements.

The Malaysian Personal Data Protection framework includes specific guidance concerning personal data breach notification.

17. Changes to This Privacy Policy

We may update or amend this Privacy Policy from time to time to reflect changes in:

• Our business practices;
• Products or services;
• Technology;
• Applicable laws and regulations; or
• Data protection requirements.

Where appropriate, material changes will be posted on the Platform and may be communicated to you through available contact information.

The updated Privacy Policy will become effective when posted unless otherwise stated.

18. Contact Us

If you have any questions, requests, complaints, or concerns regarding this Privacy Policy or our handling of personal data, please contact us at:

Email: [email protected]

Please include sufficient information in your request to allow us to identify the relevant account, order, or personal data request.

19. Applicable Law

This Privacy Policy shall be interpreted and applied in accordance with applicable laws and regulations governing personal data protection and privacy, including the Personal Data Protection Act 2010 (Act 709) of Malaysia, as applicable to our processing activities.

Where applicable, we will comply with amendments, regulations, standards, guidelines, and other requirements issued under the Malaysian personal data protection framework.

20. Acknowledgement

By using www.thldna.com, you acknowledge that you have read and understood this Privacy Policy.

Where consent is required by applicable law, your consent will be obtained through appropriate means before processing your personal data for the relevant purpose.

We encourage you to review this Privacy Policy periodically to remain informed about how we collect, use, disclose, and protect your personal data.