Store policies
Privacy Policy
Last updated 13 November 2026
MagicFlawless runs the MagicFlawless online store and looks after the personal data you give us, in line with Malaysia's Personal Data Protection Act 2010 (PDPA). This policy explains what we collect, why, and the choices you have.
What we collect
- Order details: your name, phone number, email, delivery address, the products you buy and what you paid.
- Account details: if you create an account, your name, email, phone and password. Your password is stored in encrypted (hashed) form, so we can't read it.
- Messages: what you send us through the contact form, email or WhatsApp.
- Technical data: your IP address, used briefly to protect the website against abuse such as repeated wrong logins.
We don't receive your card number or online banking login. Payments are handled by our payment provider, CHIP.
How we use it
- To process, pack and deliver your order, and to send your receipt and order updates.
- To run your account and show your order history.
- To answer your questions and handle returns or refunds.
- To keep the website secure and prevent fraud.
- To keep business and tax records as Malaysian law requires.
We only send marketing messages if you have agreed to receive them, and you can stop them at any time.
Who we share it with
We share only what each service needs to do its job:
- CHIP, our payment provider, to take your payment (your name, email and the order amount).
- J&T Express, our courier, to deliver your parcel (your name, phone and delivery address).
- Our email, hosting and storage providers, which run the website and send its emails.
- Government or law enforcement bodies, only when the law requires it.
We never sell your personal data.
Cookies and browser storage
- Your cart is saved in your own browser, so it is still there when you come back.
- When you sign in to your account, a cookie keeps you signed in for up to 30 days.
- We don't use advertising or tracking cookies.
How long we keep it
We keep order records for as long as Malaysian law requires us to keep business records. Account details are kept until you ask us to delete your account. Contact form messages are kept only as long as needed to answer you.
Keeping it safe
The website uses an encrypted connection (HTTPS), passwords are hashed, and only authorised staff can see customer details in our admin system.
Your rights
Under the PDPA you can ask us to:
- tell you what personal data we hold about you and give you a copy,
- correct data that is wrong or out of date,
- stop using your data for marketing, or delete your account.
Contact us to make a request. We reply within 21 days. You can also update your name and phone yourself on your account page.
Changes to this policy
We may update this policy from time to time. The date at the top shows the latest version.
Contact us
Questions about this policy? Contact us:
MagicFlawless