PesanLagi Privacy Policy
Full transparency regarding collection, processing, and protection of customer & merchant data in compliance with Malaysia Personal Data Protection Act 2010 (PDPA).
1. Introduction & Scope
PesanLagi ("we", "us", or "platform") is strictly dedicated to safeguarding the privacy and integrity of our users’ personal data. This document outlines our practices regarding the collection, handling, and security of personal information when using our digital loyalty stamp system and merchant management portal.
This policy applies to both physical retail customers ("Customers") scanning QR stands to earn digital loyalty stamps, and business owners, store managers, and cashiers ("Merchants") operating via the PesanLagi Portal.
2. Information We Collect
We strictly abide by the principle of Data Minimization. We do not require customer app downloads, passwords, or intrusive personal background info.
A. Customer Data (End-Users):
Mobile Phone Number (E.164 format, e.g., +60123456789): Used exclusively as your unique wallet identifier to keep track of loyalty stamps and unlocked reward vouchers across stores.
First Name / Display Name (Optional): If voluntarily supplied by the customer for friendly personalization on their PWA loyalty pass.
Stamp Audit & Transaction History: Timestamps, store location identifier, stamps earned, and reward redemption verification records.
B. Merchant & Business Data:
Business Profile: Store trading name, business registration number (if provided), contact email, phone number, and store branding logo.
Authentication Credentials: Email address and cryptographically hashed passwords (via BCrypt) for portal dashboard login.
Billing Records: Transaction metadata for one-time customer quota purchases fulfilled via authorized gateways (HitPay / FPX). PesanLagi never stores credit card or sensitive banking data on its servers.
3. How We Use Collected Data
All personal data is processed solely for explicit operational and loyalty service delivery:
• Accurately maintaining and displaying stamp counters on customer smartphone browser passes.
• Validating cashier confirmation queues to prevent fraudulent double-stamping.
• Sending automated WhatsApp or SMS notifications when rewards are earned or near expiry (strictly subject to opt-in marketing consent).
• Supplying merchants with aggregate return customer retention metrics and daily audit logs.
4. Zero Advertising Resale Commitment
PesanLagi NEVER sells, rents, leases, or trades user phone numbers, spending habits, or store rosters to third-party ad networks, telemarketers, or data brokers.
We only transmit data to accredited infrastructure partners bound by rigorous confidentiality agreements:
• Cloud Infrastructure: Google Cloud Platform (GCP) for secure container orchestration and encrypted PostgreSQL storage.
• Messaging Gateway: Licensed telecom aggregators for instant transactional WhatsApp & SMS voucher delivery.
• Regulated Payment Gateways: HitPay Payment Gateway adhering to Bank Negara Malaysia regulatory requirements for secure FPX / DuitNow settlement.
5. Security & Data Retention
We utilize enterprise-grade technical safeguards to prevent unauthorized access, alteration, or disclosure of user data.
• Transit Encryption: TLS 1.3 encryption across all public web and API endpoints.
• Storage Encryption: Persistent databases encrypted at rest using AES-256.
• Multi-Tenant Isolation: Complete cryptographic and logical separation between store tenants.
6. Your Rights Under Malaysian PDPA 2010
Under Malaysia’s Personal Data Protection Act 2010 (Act 709), you hold guaranteed rights:
• Right of Access: You may request confirmation of personal records held by PesanLagi.
• Right of Rectification: You may request immediate correction of inaccurate or outdated contact info.
• Right to Withdraw Consent: You can opt out of promotional WhatsApp/SMS communications at any time.
• Right to Erasure: You may request complete permanent deletion of your phone number and associated loyalty balances by emailing our privacy team.
7. Policy Amendments
We may periodically update this Privacy Policy to reflect technical enhancements or statutory updates. Material revisions will be highlighted on this website alongside an updated effective date.
Questions Regarding Your Personal Data?
Our Data Protection Officer (DPO) is available to handle any access, rectification, or deletion requests for your records.