Legal
Privacy Policy
Data controller: COMMONFOLK COMMERCE SDN. BHD. (Reg. No. 202601039570 (1701665-H))
This Privacy Policy explains how COMMONFOLK COMMERCE SDN. BHD. (“COMMONFOLK COMMERCE”, “we”, “us”, “our”) collects, uses, discloses and protects personal data in the course of our business, in accordance with the Personal Data Protection Act 2010 of Malaysia (“PDPA”). It applies to retail customers, bulk, corporate and wholesale buyers, suppliers’ and trading partners’ contact persons and website visitors who provide us with personal data.
01 Data Controller
The data controller responsible for personal data described in this policy is COMMONFOLK COMMERCE SDN. BHD., registered in Malaysia (Registration No. 202601039570 (1701665-H)), with its registered address at 03-05-06, REVO AURORA PLACE, 1, PERSIARAN JALIL 1, BUKIT JALIL, 57000 KUALA LUMPUR.
02 Personal Data We Collect
Depending on how you interact with us, we may collect: your full name; business name (for corporate and bulk buyers); email address; phone number; delivery address; order details including product codes, variant selections, quantities, any logo, artwork or customisation details you provide for custom orders, and fulfilment preference; and any other information you choose to include in an enquiry, cart, checkout submission or order note.
03 How We Collect Data
We collect personal data directly from you when you build a cart and submit a checkout on this website, submit our contact form, email or call us, or otherwise communicate with us in the course of placing or discussing an order. We do not purchase personal data from third-party data brokers or list vendors.
04 Purpose of Processing
We use personal data to: prepare and send quotations; confirm stock, pricing, variants, customisation and delivery or collection arrangements; process, pack and fulfil orders; issue invoices and coordinate payment; respond to enquiries and provide customer support; and, where you have given consent, share updates about new stock or product ranges.
05 Legal Basis Under the PDPA
We process personal data on the basis that you have provided it voluntarily for the purpose of obtaining a quotation, placing an order, or otherwise engaging our services, which constitutes consent under the Personal Data Protection Act 2010 of Malaysia (“PDPA”), and because processing is necessary to perform a contract with you or to take steps at your request before entering into one. Where we rely on consent for optional communications, such as marketing updates, you may withdraw that consent at any time as described in Clause 10.
07 Cart, Checkout & Order Data
This website’s cart is stored in your own browser’s local storage and is not transmitted to us until you submit the checkout form. When you submit checkout, your name, email, phone number, order description and total are sent to our payment provider so that your payment can be processed; card, bank and e-wallet details are entered on our payment provider’s pages and are never stored by us. The contact form generates an enquiry reference and a plain-text summary on your device, which you then choose to send to us by email or phone.
08 Data Retention
We retain personal data for as long as necessary to fulfil the purpose it was collected for, to satisfy accounting and tax record-keeping obligations under Malaysian law (generally seven years from the relevant transaction), and to resolve any dispute or defend a legal claim. Enquiry data that does not result in an order is retained for a reasonable period to allow follow-up, after which it is deleted or anonymized if no further engagement occurs.
09 Data Security
We apply reasonable administrative and technical safeguards to protect personal data against unauthorized access, alteration, disclosure or destruction, including restricting access to customer records to staff who need it to perform their role. No method of transmission or storage is completely secure, and while we work to protect personal data, we cannot guarantee its absolute security.
10 Your Rights
Under the PDPA, you have the right to request access to the personal data we hold about you, to request correction of inaccurate data, and to withdraw any consent you previously gave for us to process your data for a particular purpose, including marketing communications. To exercise any of these rights, contact us using the details in Clause 14. We will respond within a reasonable time and in accordance with the requirements of the PDPA, noting that withdrawing consent may affect our ability to continue providing services that depend on that data.
12 Children’s Privacy
Our services are directed at adult individuals and businesses, such as online buyers, companies, event organisers, resellers and retailers. We do not knowingly collect personal data from children, and any personal data submitted to us is expected to belong to an adult, or to be submitted by an adult authorized to act on behalf of their organization.
13 Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our data practices or legal obligations. We encourage you to review this page periodically.
14 Contact
Questions, access requests or complaints about how we handle personal data can be directed to commonfolkcommerce@outlook.com or by phone at +6017-414 3199. Our registered address is 03-05-06, REVO AURORA PLACE, 1, PERSIARAN JALIL 1, BUKIT JALIL, 57000 KUALA LUMPUR.