This Privacy Policy and Personal Data Protection Notice ("Notice") is issued by Home Apothecary Sdn Bhd (Company Registration No. 2024401015953 (1561803-K)) ("homeApothec", "we", "us", "our") pursuant to the Personal Data Protection Act 2010 (PDPA), as amended. It explains how we collect, use, store, protect, and disclose your personal data when you use www.homeapothec.com, contact us via WhatsApp, or purchase our products.
1. Personal Data We Collect
| Category | Examples | When collected | |---|---|---| | Identity & contact | Name, email, phone number, delivery address, postcode | Checkout, account creation, lead capture forms | | Order & transaction | Products purchased, order value, payment method, payment status | Checkout (note: payment is processed by HitPay — we never receive or store your full bank or card credentials) | | Skin & consultation data | Skin type, skin concerns, sensitivities you choose to share | Skin quiz on the Website, WhatsApp consultation with our team | | Communications | Messages sent via WhatsApp, email, or contact forms | When you contact us | | Technical | IP address, device type, browser, pages visited, referral source | Automatically, via cookies and analytics (see Cookie Policy) | | Marketing preferences | Email subscription status, sequence tags | Newsletter signup, post-purchase |
Sensitive personal data: Information about skin conditions you share during a consultation may constitute health-related sensitive personal data under the PDPA. We collect this only with your explicit consent, only to recommend suitable products, and we do not share it with third parties for marketing.
2. How We Use Your Personal Data
We process your personal data to:
- Process and fulfil your orders, payments, and deliveries
- Provide skincare consultations and product recommendations you request
- Send transactional emails — order confirmation, shipping updates, delivery notices
- Send marketing emails and replenishment reminders where you have consented (you may unsubscribe at any time via the link in every email)
- Recover abandoned carts where you have provided your email during checkout
- Respond to enquiries, feedback, and complaints
- Detect and prevent fraud, coupon abuse, and unauthorised access
- Comply with legal and regulatory obligations (tax, accounting, NPRA product safety reporting)
- Improve our Website, products, and services through aggregated, de-identified analytics
We do not sell or rent your personal data to any third party.
3. Legal Basis & Consent
We process your data on the basis of: (a) your consent; (b) performance of a contract (your order); (c) compliance with legal obligations; and (d) our legitimate interests in operating and securing our business. You may withdraw consent for marketing at any time without affecting the lawfulness of processing carried out before withdrawal.
4. Disclosure to Third Parties (Data Processors)
We disclose personal data only to service providers who need it to deliver our services, each bound by contractual and statutory confidentiality and security obligations:
| Provider | Purpose | Data shared | |---|---|---| | HitPay | Payment processing | Name, email, order amount (payment credentials are entered directly with HitPay) | | EasyParcel & appointed courier | Shipping and delivery | Name, phone, delivery address, order reference | | Supabase | Secure database hosting | Order, account, and lead records | | Resend | Transactional and marketing email delivery | Name, email, marketing tags | | Vercel | Website hosting | Technical/log data | | Meta Platforms (if you arrived via our ads) | Ad measurement | Hashed/technical identifiers via pixel — see Cookie Policy |
We may also disclose data where required by Malaysian law, court order, or a regulator (e.g. NPRA, the Personal Data Protection Commissioner, or tax authorities).
5. Cross-Border Transfer
Some of our service providers (Supabase, Vercel, Resend, HitPay) store or process data on servers located outside Malaysia. Where personal data is transferred outside Malaysia, we take steps to ensure it receives a standard of protection comparable to the PDPA, including contractual safeguards with each provider.
6. Data Security
We protect your personal data through: encrypted connections (HTTPS/TLS) across the entire Website; access-controlled databases with row-level security; authentication-gated admin access limited to authorised personnel only; unique single-use discount codes bound to your email; and no storage of payment credentials on our systems. While no system is completely secure, we review our safeguards regularly.
Data breach notification: In the event of a personal data breach that causes or is likely to cause significant harm, we will notify the Personal Data Protection Commissioner and affected individuals as required under the PDPA (as amended).
7. Data Retention
| Data type | Retention period | |---|---| | Order and transaction records | 7 years (tax and accounting requirements) | | Account data | Until you request deletion | | Consultation/skin data | Until consultation purpose is fulfilled or you request deletion | | Marketing data | Until you unsubscribe or request deletion | | Abandoned cart data | 90 days, then deleted | | Technical logs | 12 months |
Data no longer required is securely deleted or anonymised.
8. Your Rights Under the PDPA
You have the right to:
- Access the personal data we hold about you
- Correct inaccurate or incomplete data
- Withdraw consent to processing (including marketing)
- Limit processing of your data, including for direct marketing
- Request deletion of your data, subject to legal retention requirements
- Data portability — request a copy of your data in a structured, machine-readable format (per the 2024 PDPA amendments, where technically feasible)
To exercise any right, contact us at homeapothec@gmail.com or WhatsApp +601116284782. We will respond within 21 days as required under the PDPA. We may charge a prescribed fee for access requests and will verify your identity before acting on any request.
9. Children
Our Website and products are intended for adults. We do not knowingly collect personal data from individuals under 18. Parents purchasing family-safe products do so on their own behalf.
10. Cookies
See our separate Cookie Policy for details of cookies and similar technologies used on this Website and how to manage them.
11. Changes to This Notice
We may update this Notice from time to time. Material changes will be flagged on this page with a revised "Last updated" date. Continued use of the Website after changes constitutes acceptance.
12. Contact / Data Protection Contact
Home Apothecary Sdn Bhd Attn: Data Protection Contact — [NAME, e.g. Michael] No 176 Jalan KIP 5, Taman Perindustrian KIP, 52200 Kuala Lumpur, Malaysia Email: homeapothec@gmail.com · WhatsApp: +601116284782
If you are not satisfied with our response, you may lodge a complaint with the Personal Data Protection Department (JPDP) / Personal Data Protection Commissioner, Malaysia.