Privacy Policy

Overview

KARDON COMMERCE ENTERPRISE (SSM Registration No. 202403164862 (PG0557784-P)), trading as Cats Play Toy, respects your privacy. This policy explains what personal data we collect when you shop with us, why we collect it, who we share it with, and the rights you have over it under Malaysia's Personal Data Protection Act 2010 (PDPA), as amended by the Personal Data Protection (Amendment) Act 2024. It applies to our website and any orders placed through it. For the specific cookies and browser storage we use, see our Cookie Policy.

Information we collect

• Contact details — your name, email address, and phone number.
• Delivery address — the address you ask us to deliver to, and, where relevant, a separate billing address.
• Order history— the items you've purchased, order value, and order status.
• Account information — if you create an account, your login email and a securely hashed password.
• Payment information — handled directly by our payment gateway; we never see or store your full card number.
• Newsletter signups — if you subscribe to our newsletter, your email address, the date you subscribed, and which page you subscribed from. We keep a record of when you gave consent so we can show it was given. Every newsletter email includes an unsubscribe link, and unsubscribing stops the newsletter without affecting order or delivery emails.
• Product reviews— if you leave a review, the name you give, your rating, your words, and any photos you attach. Reviews are published on the site once approved, so please don't include anything you'd rather keep private.
• Technical data — such as IP address, browser type, and site usage, collected automatically to keep the site secure and working properly.
• Visitor statistics — we count visits ourselves, on our own server, without cookies and without keeping anything that identifies you. We record the page you viewed, and when; the website or app you arrived from, if any — the site's name only, never the address of the page you were on; the campaign tag on the link you clicked, if it had one; your country, worked out from your network — never your town or your location; whether you are on a phone, tablet or computer, and which browser you use; whether a visit included viewing a product, adding one to the cart, starting checkout, or a completed order. We do not keep your IP address. See Visitor statistics below for how the counting works.

Why we collect it, and our lawful basis

We process your personal data for the following purposes:

• To fulfil your order — processing payment, packing, and delivering your items, and sending order confirmations and shipping updates. This is necessary to perform our contract with you.
• To respond to enquiries — answering questions you send us, including returns and refund requests. This is necessary to perform our contract with you or, where no order is involved, based on your consent in contacting us.
• To prevent fraud and keep our store secure — based on our legitimate interest in protecting our business and customers.
• To meet legal obligations — such as keeping accounting and tax records as required under Malaysian law.
• To send marketing updates— our newsletter about new arrivals, restocks and promotions, only where you've opted in; based on your consent, which you can withdraw at any time using the unsubscribe link in any newsletter email or by emailing us.
• To measure and advertise — understanding how the store is used and, where those trackers are switched on, measuring our advertising. This happens only with your consent, given through the cookie banner, and you can withdraw it at any time from the Cookie settings link in our footer.
• To count visits ourselves — our own anonymous visitor statistics, which use no cookies and no personal data, based on our legitimate interest in knowing how many people the store reaches. See Visitor statistics below.

Who we share it with, and what each one gets

We do not sell your personal data. We share the minimum necessary with the service providers (data processors) below, each of which may only use it to provide that service to us:

• CHIP and Billplz — our payment gateways. Whichever is handling a given payment receives your name, email address, order number and order amount, and collects your payment details directly on its own secure page. Your full card number never reaches us.
• Our couriers (J&T Express, Ninja Van, Pos Laju, SPX Express, City-Link, DHL eCommerce, Flash Express, Lalamove, Grab Express) — the courier carrying your parcel receives your name, delivery address and phone number, so it can deliver and contact you about the delivery.
• Resend — our email provider. Receives your email address and the contents of the order, account, review-request and newsletter emails we send you.
• Supabase — our database, authentication and file storage provider. Holds your account, order, address and review data, including any review photos you upload.
• Vercel — hosts this website. Processes the requests your browser makes, including your IP address and browser type, in server logs.
• Sentry — our error monitoring service. Receives technical details of errors that happen on the site, which can include the page you were on and limited request data. We use it to find and fix faults, on the basis of our legitimate interest in keeping the store working.
• Google Analytics 4 (Google) — an analytics tracker. Measures how visitors find and use the store — pages viewed, products viewed, and whether a visit ends in an order. Loads only with your consent, and receives your device and usage data — not your name, address or payment details. See our Cookie Policy.

Our site is also built to work with Meta Pixel and TikTok Pixel as advertising trackers. They are currently not enabled and send nothing about you anywhere. If we switch one on, it will appear in the list above and in our Cookie Policy, and will only load for visitors who have consented to marketing cookies.

Our own visitor statistics are not in this list, because they are not shared with anyone: they are collected by our own website code, stored in our own database, and read only by us. No analytics company receives them.

We may also disclose personal data where we are required to by Malaysian law, or to establish or defend a legal claim.

Transfers outside Malaysia

Some of the providers above operate outside Malaysia, so your personal data is transferred and stored abroad. Supabase, Vercel, Resend, Sentry and the analytics and advertising providers listed above process data on servers outside Malaysia — depending on the provider, that may include Singapore, the European Union or the United States. Our payment gateways and couriers operate within Malaysia.

Where personal data leaves Malaysia, we rely on the transfer conditions permitted under Section 129 of the PDPA — in particular, that the transfer is necessary to perform our contract with you (so that your order can be hosted, paid for and emailed to you), and that we have taken reasonable steps, through each provider's standard data processing terms, to ensure your data is protected to a standard comparable with the PDPA.

Data retention

We keep order records for as long as needed to meet accounting, tax, and other legal obligations in Malaysia. Account data is kept until you ask us to delete it, subject to any records we're required to retain by law. Newsletter records are kept until you unsubscribe, plus a record of the unsubscribe itself so we don't email you again.

Individual visit records are deleted after 90 days. What remains is daily totals — visitor counts, popular pages, countries, devices — which hold no visitor codes and describe nobody in particular.

Cookies, analytics & advertising

We use a first-party cookie to remember your cookie preferences, and other essential browser storage to keep your cart, favourites and sign-in working. Analytics and marketing cookies are separate choices, and neither loads until you agree on the banner shown on your first visit.

You can change or withdraw your choice at any time using the Cookie settings link in our footer. Our Cookie Policy lists every cookie and storage key we use, its purpose, its category, and how long it lasts.

Visitor statistics

Separately from the services above, we keep our own count of how many people visit the store and which pages they look at. It runs on our own website and our own database. It sets no cookies, stores nothing on your device, and sends nothing to any other company.

To count a returning page view as one visitor rather than several, we turn your IP address and browser description into a short scrambled code using a secret that changes every day, and keep only that code. The code cannot be turned back into your IP address, and because the secret is thrown away after two days, the code from one day cannot be matched to the code from any other day. The effect is that we can see how many people visited today, and never who they were or whether they came back next week.

What we record for each visit:

• the page you viewed, and when
• the website or app you arrived from, if any — the site's name only, never the address of the page you were on
• the campaign tag on the link you clicked, if it had one
• your country, worked out from your network — never your town or your location
• whether you are on a phone, tablet or computer, and which browser you use
• whether a visit included viewing a product, adding one to the cart, starting checkout, or a completed order

What we never record:

• your IP address — it is never written to our records
• your name, email address or phone number
• anything stored on your device: no cookies, no local storage
• your activity on any other website

Individual visit records are deleted after 90 days, leaving only daily totals that describe nobody in particular. Our lawful basis is our legitimate interest in understanding how the store is used so we can improve it — a purpose we can only pursue with figures this plain because they cannot identify anyone.

Because it sets no cookies and collects no personal data, these statistics are gathered on every visit, including when you decline analytics cookies. What declining switches off is the trackers that do store things on your device and do report to other companies: Google Analytics under analytics, and the Facebook and TikTok advertising pixels under marketing. Our own counts cannot identify you, so there is nothing in them to withdraw — but if you would still rather not be counted, write to us using the details on our contact page and we will explain your options.

Your rights under the PDPA

Under the PDPA, you have the right to:

• Request access to the personal data we hold about you.
• Request correction of inaccurate or incomplete personal data.
• Withdraw your consent to marketing communications at any time.
• Limit or object to the processing of your personal data for purposes you haven't consented to.
• Request that we delete personal data we no longer have a lawful reason to keep.
• Data portability — introduced by the 2024 amendments: ask us to transmit the personal data you have given us to another data controller of your choice, where this is technically feasible and compatible with the format in which we hold it. We will provide it in a structured, commonly used, machine-readable format.

To exercise any of these rights, contact us using the details below. We'll respond within 21 days, as required under the PDPA. There is no charge for a reasonable request.

Security and data breaches

We use industry-standard safeguards — including encrypted connections, access controls, and providers who maintain their own security certifications — to protect your personal data from unauthorised access, loss, or misuse.

If a personal data breach occurs, we will notify the Personal Data Protection Commissioner as soon as practicable and in any event within the period required under the PDPA and its breach notification regulations. Where the breach causes or is likely to cause significant harm to you, we will also notify you directly, without unnecessary delay, telling you what happened, what data was involved, and what you can do about it.

Children's privacy

While our products are for children, our website and checkout are intended to be used by parents or guardians. We do not knowingly collect personal data directly from children.

Changes to this policy

We may update this policy as our services or the law change. The current version is always on this page, with the date it was last updated shown at the top.

Contact us

For any privacy question, PDPA data request, or data breach concern, email our privacy contact at playera9600@gmail.com, write to us at No. 21, Jalan BS 3/3, Taman Bukit Serdang, 43300 Seri Kembangan, Selangor, Malaysia, or use our contact page. Please mark privacy requests clearly so we can route them quickly.