Privacy Policy
Last updated: 25 September 2026
apopofjoy operates this store and website, including all related information, content, features, tools, products and services, in order to provide you, the customer, with a curated shopping experience (the “Services”). apopofjoy is powered by Shopify, which enables us to provide the Services to you. This Privacy Policy describes how we collect, use, and disclose your personal information when you visit, use, or make a purchase or other transaction using the Services, or otherwise communicate with us. As a Malaysia-based business, our handling of personal data is governed by Malaysia's Personal Data Protection Act 2010 (PDPA). If there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy prevails with respect to the collection, processing, and disclosure of your personal information.
Please read this Privacy Policy carefully. By providing and continuing to provide your personal information to us and using and/or accessing any of the Services, you acknowledge that you have read, understood and accepted the statements and terms in this Privacy Policy and consent to the collection, use, processing and disclosure of your personal information as described here.
Personal Information We Collect or Process
When we use the terms “personal information” or “personal data”, we mean any information, including any sensitive personal data (e.g. information about an individual’s physical, mental health or condition, political opinions, religious or similar beliefs, offences committed or alleged, biometric data, or other personal data as may be prescribed by law), in electronic or non-electronic form, that relates directly or indirectly to an identifiable individual, and includes any expression of opinion about that individual. We may collect or process the following categories of personal information, depending on how you interact with the Services, where you live, and as permitted or required by applicable law:
· Contact details including your name, address, billing address, shipping address, phone number, and email address.
· Personalisation details including any text, names, dates, colours or design choices you provide for embroidery, patches, engraved zip pulls, or other custom order details, so that we can produce your order accurately.
· Financial information including payment card information, financial account information, transaction details, form of payment, payment confirmation and other payment details processed by our payment providers (see Relationship with Shopify below).
· Account information including your username, password, security questions, preferences and settings, if you create an account with us.
· Transaction information including the items you view, put in your cart, add to your wishlist, or purchase, return, exchange or cancel, and your past transactions.
· Communications with us including the information you include in communications with us, for example when sending a customer support enquiry.
· Device information including information about your device, browser, or network connection, your IP address, and other unique identifiers.
· Usage information including information regarding your interaction with the Services, including how and when you interact with or navigate the Services.
Legal Basis for Processing Personal Information
We process your personal information in accordance with this Privacy Policy based on the following legal bases:
(a) your consent;
(b) necessary for the performance of a contract to which you are a party;
(c) for the taking of steps at your request with a view to entering into a contract;
(d) for compliance with any legal obligation to which we are subject, other than an obligation imposed by a contract;
(e) in order to protect your vital interests;
(f) for the administration of justice; or
(g) for the exercise of any functions conferred on any person by or under any applicable law.
By providing and continuing to provide your personal information to us, accessing and using the Services, you have read, understood and accepted the statements and terms in this Privacy Policy and consent to our processing of your personal information.
Personal Information Sources
We may collect personal information from the following sources:
· Directly from you, including when you create an account, place a custom or ready-made order, visit or use the Services, or communicate with us;
· Automatically through the Services, including from your device when you visit or use our website, and through cookies and similar technologies (see Cookies below);
· From our service providers, including Shopify (our e-commerce platform) and HitPay (our payment processor), when we engage them to enable certain technology or when they collect or process your personal information on our behalf;
· From our partners or other third parties.
How We Use Your Personal Information
Depending on how you interact with us, we may use your personal information for the following purposes:
· Provide, Tailor, and Improve the Services. To perform our contract with you, process your payments, produce and fulfil your orders (including personalised items), remember your preferences, send account-related notifications, process returns and exchanges, manage your account, arrange shipping, and create a customised shopping experience.
· Marketing and Advertising. Where you have consented, to send marketing emails about our store, new products and other updates. [Confirm: if you use Shopify's targeted or cross-merchant advertising features (e.g. Shopify Audiences), this section should also disclose that, and note customers' right to opt out — see Your Rights and Choices below.]
· Security and Fraud Prevention. To authenticate your account, provide a secure payment and shopping experience, detect and investigate possible fraudulent or unsafe activity, and secure our Services.
· Communicating with You. To provide customer support and respond to your enquiries.
· Legal Reasons. To comply with applicable law (including the PDPA) or valid legal process, and to enforce or investigate potential violations of our Terms of Service.
How We Disclose Personal Information
We may disclose your personal information to third parties for the following purposes:
· With Shopify, HitPay, and other vendors who perform services on our behalf (e.g. platform hosting, payment processing, order fulfilment, customer support, cloud storage).
· With business and marketing partners to provide marketing services, where applicable and with your consent. Our partners will use your information in accordance with their own privacy notices.
· When you direct or consent to our disclosure of certain information to third parties, such as to ship you products.
· In connection with a business transaction such as a merger, sale, or other transfer of our business.
· Where required by law, including under the PDPA, to enforce our Terms of Service, or to protect the rights, property or safety of apopofjoy, our customers, or others.
Relationship with Shopify
The Services are hosted by Shopify, which collects and processes personal information about your access to and use of the Services in order to provide and improve the Services for you. Information you submit will be transmitted to and shared with Shopify, as well as third parties such as our payment processor HitPay, which may be located in countries other than where you reside. To learn more about how Shopify uses your personal information and any rights you may have, you can visit Shopify's Consumer Privacy Policy (https://www.shopify.com/legal/privacy/app-users) and, depending on where you live, the Shopify Privacy Portal (https://privacy.shopify.com/en).
Cookies
Our store uses cookies as part of the device and usage information described above, including standard Shopify cookies such as _session_id (your session), cart (contents of your shopping cart, kept for 2 weeks), _shopify_visit and _shopify_uniq (visit counters), and _secure_session_id. Our product customisation tools may also set their own cookies to remember your design choices as you shop.
Third-Party Websites and Links
The Services may provide links to websites or other online platforms operated by third parties. If you follow links to sites not affiliated with us, you should review their own privacy and security policies. We are not responsible for the privacy or security practices of such sites.
Children's Data
The Services are not intended for use by children. By using this site, you represent that you are at least the age of majority in your country of residence (in Malaysia, this is 18 years of age), or that you have given us your consent to allow any of your minor dependents to use this site. We do not knowingly collect personal information from children, and as of the date of this Privacy Policy, we do not have actual knowledge that we share or sell personal information of individuals under 18 years of age. If you are the parent or guardian of a child who has provided us with personal information, please contact us using the details below to request that it be deleted.
Security and Retention of Your Information
We take reasonable precautions and follow industry best practices, consistent with our obligations under the PDPA, to protect your personal information from being inappropriately lost, misused, accessed, disclosed, altered or destroyed. Payment information is encrypted using secure socket layer (SSL) technology and processed in line with the Payment Card Industry Data Security Standard (PCI-DSS). No method of transmission over the internet is 100% secure. How long we retain your personal information depends on factors such as whether we need it to maintain your account, provide the Services, comply with legal obligations, or resolve disputes.
Your Rights and Choices
Under the PDPA, and depending on where you live, you may have some or all of the following rights in relation to your personal information, subject to exceptions permitted by law:
(a) Right to Access. You may request access to the personal information we hold about you. We may refuse to comply with your request for access to your personal information in accordance with applicable laws under the following circumstances:
(i) we are not supplied with such information as we may reasonably require: (1) to satisfy ourselves as to your identity; or (2) where you claim to be a relevant person: to satisfy ourselves as to the identity of the data subject in relation to whom you claim to be the relevant person and that you are the relevant person in relation to the data subject;
(ii) we are not supplied with such information as we may reasonably require to locate the personal information to which the data access request relates;
(iii) the burden or expense of providing access is disproportionate to the risks to your privacy in relation to the personal information;
(iv) we cannot comply with the data access request without disclosing personal information relating to another individual who can be identified from that information, unless: (1) that other individual has consented to the disclosure of the information to the requestor; or (2) it is reasonable in all the circumstances to comply with the data access request without the consent of the other individual;
(v) subject to applicable laws, any other data controller controls the processing of the personal information to which the data access request relates in such a way as to prohibit us from complying, whether in whole or in part, with the data access request;
(vi) providing access would constitute a violation of an order of a court or disclose confidential commercial information; or
(vii) such access to personal information is regulated by another law.
(b) Right to Correct. You may request that we correct inaccurate personal information we hold about you. We may refuse to comply with your request for correction to your personal information in accordance with applicable laws under the following circumstances:
(i) we are not supplied with such information as we may reasonably require: (1) to satisfy ourselves as to your identity; or (2) where you claim to be a relevant person: in order to satisfy ourselves as to the identity of the data subject in relation to whom you claim to be the relevant person and that you are the relevant person in relation to the data subject;
(ii) we are not supplied with such information as we may reasonably require to ascertain in what way the personal information to which the data correction request relates is inaccurate, incomplete, misleading or not up-to-date;
(iii) we are not satisfied that the personal information to which the data correction request relates is inaccurate, incomplete, misleading or not up-to-date;
(iv) we are not satisfied that the correction which is the subject of the data correction request is accurate, complete, not misleading or up-to-date; or
(v) subject to applicable laws, any other data controller controls the processing of the personal information to which the data correction request relates in such a way as to prohibit us from complying, whether in whole or in part, with the data correction request.
(c) Right to Restrict Processing: You have the right to request that we restrict the processing of your personal information in which case we will restrict processing to the extent permitted unless we are able to rely on one of the permitted legal grounds for processing under the PDPA. Please note that if we limit or stop processing the personal information, we may use it again if there are valid grounds under applicable data protection law for us to do so.
(d) Right to Withdraw Consent / Delete. You may withdraw your consent to our processing of your personal information, or request that we delete it, at any time.
(e) Right of Portability. Where applicable law provides for it, you may request a copy of your personal information in a portable format.
(f) Managing Communication Preferences. You may opt out of promotional emails at any time using the unsubscribe link in our emails. You may still receive non-promotional emails, such as order updates.
You may exercise any of these rights by contacting us using the details below. We may need to verify your identity before processing your request, and we will respond within a reasonable time as required by law. To learn more about rights related to data processed directly by Shopify, visit https://privacy.shopify.com/en.
Failure to Provide Personal Information
While the provision of personal information is voluntary, failure to provide certain personal information when requested may, as applicable, prevent us from providing specific services which require your information in order to provide.
Complaints
If you have concerns about how we handle your personal information, please contact us using the details below. You may also lodge a complaint with Malaysia's Department of Personal Data Protection (Jabatan Perlindungan Data Peribadi).
International Transfers
We may transfer, store and process your personal information outside Malaysia, including through Shopify's and HitPay's infrastructure. These countries may have data protection rules that are different from Malaysia. Where we do so, we take steps to ensure the transfer is consistent with the PDPA. If we transfer personal information out of the European Economic Area or the United Kingdom, we rely on recognised transfer mechanisms such as the European Union Standard Contractual Clauses, unless the destination country is deemed to provide an adequate level of protection. By agreeing to this Privacy Policy, you hereby consent to the transfer of your personal data to jurisdictions outside of Malaysia.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or for legal or operational reasons. We will post the revised Privacy Policy on this website and update the “Last updated” date above. You are encouraged to check back regularly to stay informed of updates or changes to this Privacy Policy. By continuing to access or use the Services subsequent to any amendments, modifications and/or updates to this Privacy Policy, you confirm your acceptance of such amendments, modifications and/or updates.
Language of Privacy Policy
This Privacy Policy is issued in both Bahasa Malaysia and English. In the event of any conflict between the two versions, the English version shall prevail.
Contact
Should you have any questions about our privacy practices or this Privacy Policy, or wish to exercise any of the rights available to you, please contact us:
Email: hello@apopofjoy.co
A POP OF JOY ENTERPRISE
Registration no: 202403013795 (LA0064735-K)
Kuala Lumpur, Malaysia