Privacy Policy.

1. Who we are

Chriszen Malaysia Sdn Bhd (Company No. 938581-M) is the data user under the Personal Data Protection Act 2010. Our registered office and headquarters is in Kuala Lumpur, Malaysia. Write to us for the full postal address, or find it on our contact page.

Where this policy says we, us or Chriszen, it means that company. Where it says you, it means anyone who visits this website, buys from it, subscribes to our emails or contacts us.

Questions about this policy go to [email protected], or to our data protection contact at [insert DPO name and email].

2. What personal data we collect

We collect three kinds of data.

Data you give us

• Name, email address, phone number and delivery address when you place an order or create an account.
• Billing address and the last four digits of your payment card. We never see or store your full card number; that stays with our payment processor.
• Your email address when you subscribe to our mailing list.
• Anything you write to us: enquiries, complaints, product feedback, and messages sent through social media or messaging apps.
• Skin type, tone preference or product concerns, where you choose to tell us so that we can recommend a shade or formula.

Data we collect automatically

• IP address, approximate location derived from it, browser and device type, operating system and screen size.
• Pages you viewed, how you arrived at the site, what you searched for, and how long you stayed.
• Cookie identifiers and similar technologies, as described in section 4.

Data we receive from others

• Order and delivery information from the marketplaces we sell through, where you buy from us there rather than here.
• Payment confirmation and fraud signals from our payment processor.
• Delivery status from our courier partners.
• Aggregated audience statistics from advertising and analytics platforms. These do not identify you individually.

We do not collect sensitive personal data as defined by the Act, and we ask that you do not send us any. If you describe a medical condition in a message to us so that we can advise on a product, we will use that information only to answer you and will delete it once the matter is closed.

3. How we use your personal data

We use personal data for the following purposes, and no others.

• Fulfilling your order. Taking payment, packing, arranging delivery, and dealing with returns and refunds.
• Servicing your account. Letting you sign in, see your order history and save an address.
• Customer support. Answering questions, investigating complaints and handling product safety enquiries.
• Product safety and recall. Contacting buyers of a specific batch if a quality issue is identified.
• Marketing, where you have agreed to it. Telling you about new shades, restocks and offers.
• Improving the site and the range. Understanding which products and pages people use, and which they abandon.
• Fraud prevention and security. Detecting fraudulent orders, abuse and attacks on the site.
• Meeting legal obligations. Keeping tax and accounting records, and responding to lawful requests from authorities.

We process your data on the basis of your consent, or because it is necessary to perform a contract with you, or because we are required to by law, or for our legitimate interest in running and securing the business. Where we rely on consent, you can withdraw it at any time.

4. Cookies and similar technologies

Cookies are small files a website stores on your device. We use four categories.

Strictly necessary

Keep you signed in, remember what is in your bag, and protect against fraud. The site does not work without them, so they cannot be switched off.

Preference

Remember your language, currency and any display settings you have chosen.

Analytics

Tell us which pages are visited and where people leave, so we can fix what is not working. Set only if you accept them.

Marketing

Used by advertising platforms to measure campaigns and show you relevant advertising elsewhere. Set only if you accept them.

You can change your choice at any time through the cookie settings link in the footer, and you can block or delete cookies in your browser settings. Blocking strictly necessary cookies will stop checkout from working.

5. Marketing communications

We send marketing email only to people who have asked for it. Every message we send includes an unsubscribe link that works immediately, and you can also reply to any marketing email with the word stop. Unsubscribing from marketing does not stop transactional messages such as order confirmations, dispatch notices and safety notices, which we must send you.

Under section 43 of the Personal Data Protection Act 2010 you have the right to require us, in writing, to stop processing your personal data for direct marketing. We will act on that request without charge.

6. Who we share your data with

We do not sell personal data. We share it only with the parties below, only to the extent they need it, and only under contracts that require them to protect it.

• Payment processors to take and verify payment. [Insert processor names.]
• Courier and logistics partners to deliver your order. They receive your name, address and phone number.
• Marketplace operators where you bought from us on their platform.
• Technology providers who host the site, send our email, or provide analytics and customer support tools. [Insert provider names.]
• Professional advisers such as accountants and lawyers, where necessary.
• Authorities and regulators where we are required by law to disclose, or where disclosure is necessary to protect our rights or someone's safety.
• A buyer or successor if the business is sold or restructured, in which case we will tell you before your data is transferred.

7. Transferring data outside Malaysia

Some of the providers we use store data on servers outside Malaysia, typically in Singapore, the European Union or the United States. Where that happens we satisfy ourselves that the data will receive protection comparable to that required by the Personal Data Protection Act 2010, through the provider's contractual commitments and their own compliance obligations. If you want to know where a specific category of your data is held, ask us and we will tell you.

8. How long we keep your data

Order and transaction records

Seven years from the end of the financial year, to meet Malaysian tax and accounting requirements.

Account details

For as long as the account is open, and twelve months after you close it.

Marketing subscriptions

Until you unsubscribe, then a suppression record so that we do not email you again by mistake.

Support correspondence

Twenty-four months from the date the matter is closed.

Website analytics

Twenty-six months, in aggregated form wherever possible.

When a retention period ends we delete the data or irreversibly anonymise it.

9. How we protect your data

The site runs over TLS, so information you send us is encrypted in transit. Access to personal data inside the company is limited to staff who need it for their role, and is logged. Payment card details are handled entirely by our payment processor and never touch our servers.

No system is perfectly secure. If a breach occurs that is likely to cause you significant harm, we will notify you and the Personal Data Protection Commissioner as required by law and by the timelines set out in the Act.

10. Your rights

Under the Personal Data Protection Act 2010, as amended, you have the right to:

• Access the personal data we hold about you, and be told how it is being processed.
• Correct data that is inaccurate, incomplete, misleading or out of date.
• Withdraw consent to any processing that relies on your consent.
• Stop direct marketing at any time.
• Limit processing that is causing, or is likely to cause, you damage or distress.
• Receive your data in a portable form, or have it transmitted to another data user, where technically feasible.

To exercise any of these, write to [email protected] with enough detail for us to identify you and locate the data. We will respond within twenty-one days. A small fee may apply to a data access request, as permitted by the Act. If you are not satisfied with our response you may complain to the Personal Data Protection Commissioner (Jabatan Perlindungan Data Peribadi).

11. Children

This website is not directed at children under 13, and we do not knowingly collect their personal data. Customers under 18 should have a parent or guardian read this policy and place any order on their behalf. If you believe a child has given us personal data, write to us and we will delete it.

12. Third-party sites and marketplaces

This site links to social media profiles, marketplace listings and mapping services operated by other companies. Once you follow one of those links you are on their platform, governed by their privacy policy and terms, not ours. We have no control over what they collect. Read their policies before providing personal data.

13. Changes to this policy

We update this policy when our practices change or the law changes. The version number and effective date at the top of this page always reflect the current version. If a change materially affects your rights we will tell you by email or by a notice on the site before it takes effect.

14. Contact us

For anything relating to privacy or a data access request, write to [email protected]. Postal correspondence should be addressed to the Data Protection Officer at our registered office in Kuala Lumpur.

We aim to acknowledge every enquiry within two working days and to resolve it within twenty-one days. Our Terms of Service cover orders, delivery, returns and use of this website.