Skip to content

Privacy Policy

This Privacy Policy explains how BUNGACEMPAKA SIGNATURE (202603193681 (AS0518760-A)) ("we", "us") handles your personal data when you use https://bungacempaka-signature.com (the "Site"), buy from us or contact us. It is our notice to you under Malaysia's Personal Data Protection Act 2010 ("PDPA"), and it is available in English and Bahasa Melayu.

We are the data user responsible for your personal data. You can contact us about it at hello@bungacempaka.com or at No 22, Jalan Perdana 1/3, Taman Serai Perdana, 34300 Bagan Serai, Perak, Malaysia.

1. The personal data we collect

Information you give us

  • Account and contact details: name, email address, phone number, language preference and password (stored only in a securely hashed form).
  • Delivery details: recipient name, phone number and delivery address, including saved addresses.
  • Order details: the items you buy, amounts, vouchers used, delivery choice and order, return and refund history.
  • Refund details: the bank details you give us so that we can pay a refund.
  • Your messages and content: chat messages, emails, reviews, return requests and any photos you send. We remove embedded photo data (EXIF), such as location, from images uploaded through the Site.
  • Newsletter: your email address, language and sign-up source.
  • Telegram (optional): if you link Telegram, your Telegram chat ID and username.

Information from other parties

  • Payment status from our payment provider, Billplz, such as your bill reference, the amount and whether payment succeeded. We do not receive your online banking password or full card details.
  • Delivery status from Delyva and its couriers, such as tracking numbers and delivery events.

Information collected automatically

  • Security logs: when a request is refused or looks suspicious, such as a failed sign-in, we record the IP address, browser details, page and time.
  • Visitor statistics: we count page views, referring websites and device types. Visitors are counted using a scrambled value made from the IP address and browser details, and neither that value nor the IP address is stored for these statistics.

2. Is providing your data compulsory?

Your name, email, phone number and delivery address (or pickup choice) are required to process and deliver an order. If you do not provide them, we cannot complete it. Saved addresses, reviews, chat, photos, Telegram linking and the newsletter are optional.

3. How we use your personal data

We use your personal data to:

  • process, deliver and support your orders, returns and refunds;
  • create and manage your account, including sign-in codes and password resets;
  • send service messages such as order confirmations, shipping updates, delivery updates, return updates and chat replies;
  • ask you to review a purchase after delivery;
  • answer your questions and complaints;
  • publish reviews you submit;
  • send you newsletters and offers, as explained in section 4;
  • keep the Site secure, and prevent and investigate fraud and misuse;
  • understand how the Site is used and improve it;
  • meet our legal, tax, accounting and regulatory obligations, and establish or defend legal claims.

By using the Site, placing an order or giving us your data, you consent to this processing, as far as the PDPA requires consent. You may withdraw consent as explained in section 9, although we may then be unable to provide some services.

4. Marketing

  • Newsletter: you join by confirming through the link in our confirmation email. Each newsletter has a one-click unsubscribe link.
  • Emails to customers: we may occasionally send customers news and offers. You can switch these off at any time under My account → Profile by unticking "Email me about my orders".
  • Service messages: you will still receive essential messages, such as order confirmations and shipping notices, because they are needed to fulfil your order.

We do not sell your personal data.

5. Who we share your personal data with

We share only what each party needs for the purpose stated:

  • Billplz (payment processing) and the banks and payment networks involved: your name, email, phone number, order reference and amount.
  • Delyva and its couriers, such as SPX, J&T, Pos Laju, Ninja Van, DHL eCommerce, Teleport and City-Link: the recipient's name, phone number and address, and parcel details.
  • Amazon Web Services (Amazon SES): email delivery, including your email address and the content of the message.
  • Hostinger: email mailboxes that hold the messages you send us and our replies.
  • Telegram: if you choose to link it, the updates we send you.
  • Our hosting and technical service providers, who keep the Site running and backed up.
  • Google Fonts and Cloudflare (cdnjs): the Site loads fonts and a small script from these services, so they receive your IP address and browser details as part of a normal web request.
  • Authorities, advisers and others: where required by law or a lawful request, where needed to protect our rights or prevent fraud, or as part of a transfer of our business.

Public reviews may show your first name, initials and city, and the product you bought.

6. Transfers outside Malaysia

Some of our service providers process data outside Malaysia. Email delivery through Amazon Web Services, for example, takes place in the United States. If you order for delivery to Singapore, your delivery details are sent to our courier there. Where data is transferred abroad, we take the steps the PDPA requires, including using established providers, so that it remains protected.

7. Cookies and browser storage

We do not use advertising cookies, third-party analytics or tracking pixels. To make the Site work, your browser stores a small amount of information on your own device:

  • your sign-in session, bag, wishlist and language;
  • your preferred bank, whether you have seen the welcome message, and the details you typed at checkout until you pay.

You can clear these through your browser settings at any time, but your bag and sign-in will be reset. Staff who preview the Site use a separate technical cookie.

8. How long we keep your personal data

We keep personal data only for as long as it is needed for the purposes above or required by law:

  • Orders, payments and refunds: at least 7 years, for tax and accounting purposes.
  • Account details, addresses and messages: while your account is active. When you ask us to close it, we delete or anonymise what we no longer need.
  • Reviews: while they remain published, or until you delete them.
  • Newsletter records: while you are subscribed, and a record of your unsubscribing afterwards so that your choice is respected.
  • Email delivery logs and read notifications: about 90 days.
  • Security logs: up to 90 days.
  • Sign-in codes: deleted within about a day after they expire.

9. Your rights

Under the PDPA, you have the right to:

  • access the personal data we hold about you and receive a copy;
  • correct data that is inaccurate, incomplete, misleading or out of date;
  • withdraw consent to our processing of your personal data;
  • ask us to stop direct marketing to you;
  • ask us to stop processing that is causing you substantial and unwarranted damage or distress;
  • ask for your data to be transferred, where the PDPA gives you this right and it applies.

You can update most details yourself under My account. For anything else, or to close your account, email hello@bungacempaka.com. We may need to confirm your identity, and we may charge a fee for access requests where the PDPA allows. We respond within the time the PDPA requires, generally 21 days.

If you are in Singapore, you have similar rights under Singapore's Personal Data Protection Act 2012.

10. How we protect your data

We use encrypted connections (HTTPS), store passwords only in hashed form, restrict staff access according to their roles and log suspicious activity. No online service can be completely secure. Please use a strong password and keep it private.

If a personal data breach occurs that is likely to cause you significant harm, we will notify you and the authorities as the law requires.

11. Children

The Site is intended for adults. If you are under 18, please use it only with the permission and supervision of a parent or guardian.

12. Other websites

Links to courier, payment and social media websites are governed by those websites' own privacy policies.

13. Changes to this policy

We may update this policy from time to time. The date at the top of this page shows the latest version. We will tell you about significant changes on the Site or by email.

14. Questions and complaints

Please contact us first at hello@bungacempaka.com or +60 137432493, or write to BUNGACEMPAKA SIGNATURE, No 22, Jalan Perdana 1/3, Taman Serai Perdana, 34300 Bagan Serai, Perak, Malaysia.

If you are not satisfied with our response, you may complain to the Department of Personal Data Protection Malaysia (Jabatan Perlindungan Data Peribadi).

If there is any inconsistency between the English and Bahasa Melayu versions of this policy, the English version applies, to the extent the law allows.