PDPA

Personal Data Protection Act 2010 (Act 709)

Last updated: February 2026

This notice is issued by Gulsanco Sdn Bhd (Company No: 1092767-P), operating as Mahnaz Food ("we", "us", "our"), in accordance with the Personal Data Protection Act 2010 ("PDPA") to inform you of how we collect, use, and protect your personal data.

1. Personal Data We Collect

We may collect the following personal data from you:

(a) Full name

(b) Phone number

(d) Shipping and billing address

(e) Purchase history and product preferences

(f) Interaction data via WhatsApp, Instagram, Facebook Messenger

(g) IP address and website browsing data (cookies)

(h) Payment information (securely processed by third-party payment gateways)

2. Purpose of Data Collection

Your personal data is collected and used for the following purposes:

• Processing and delivering your orders

• Providing customer service and responding to your inquiries

• Sending promotions, special offers, and updates via WhatsApp, SMS, and email (with your consent)

• Managing customer loyalty and rewards programs (with your consent)

• Improving our products, services, and your shopping experience

• Complying with legal and regulatory requirements

• Conducting market research and internal analytics

• Sending transactional notifications (order confirmations, delivery status, invoices)

3. Your Consent

By registering an account, making a purchase, or interacting with us via WhatsApp, you consent to us collecting and processing your personal data for the purposes stated above.

For marketing communications (promotions, offers, news), we will seek separate consent from you. You may choose not to receive marketing communications at any time.

4. Disclosure to Third Parties

We may share your personal data with the following categories of third parties, solely for the purposes stated above:

• Courier and logistics companies (for order delivery)

• Payment gateways (for payment processing)

• Customer communication platforms (such as Respond.io, for WhatsApp management)

• E-commerce platforms (such as Shopify, Shopee, Lazada, TikTok Shop)

• Digital advertising platforms (Meta/Facebook, Google, TikTok - for marketing)

• Professional advisors (auditors, lawyers - where required by law)

5. Your Rights

Under the PDPA, you have the following rights:

• Right to access your personal data that we hold

• Right to correct personal data that is inaccurate, incomplete, or not up-to-date

• Right to withdraw your consent at any time

• Right to stop the processing of your data for direct marketing purposes

• Right to lodge a complaint with the Personal Data Protection Commissioner

6. Withdrawal of Consent & Unsubscribing

You may withdraw your consent or stop receiving marketing communications at any time through the following methods:

• WhatsApp: Reply "STOP" to any of our promotional messages

• Email: Click the "Unsubscribe" link at the bottom of our emails

• Contact us directly at the address below

Please note that withdrawing consent for marketing will not affect the processing of your data for order fulfillment, delivery, and customer service purposes.

7. Data Retention & Security

We retain your personal data for as long as it is necessary to fulfill the purposes stated in this notice, or as required by law. We implement appropriate technical and organizational security measures to protect your data from loss, misuse, unauthorized access, or disclosure.

8. Cross-Border Data Transfers

Some of our service providers may operate outside of Malaysia. In such cases, we ensure that an equivalent level of data protection is provided in accordance with the PDPA requirements.