APP USER PRIVACY POLICY

Effective Date: 10 April 2026 Last Updated: 10 April 2026

This Privacy Policy is issued in compliance with the Personal Data Protection Act 2010 of Malaysia ("PDPA") and applies to how [Company Name] ("Company", "we", "us", or "our") collects, uses, discloses, stores, and protects your personal data when you use our mobile application ("App").

By downloading, installing, or using the App, you acknowledge that you have read, understood, and agree to the terms of this Privacy Policy. If you do not agree, please discontinue use of the App immediately.

1. INFORMATION WE COLLECT

When you use the App, we may collect the following categories of personal data:

1.1 Account Information

Name, phone number, email address, username, profile picture, and membership details.

1.2 Transaction Information

Order history, spending amount, loyalty points, rewards, and coupon or voucher usage.

1.3 Payment Information

Payment method, stored value balance, and transaction records. We do not store your full bank card or credit card details.

1.4 Device and Technical Information

IP address, device model, unique device identifiers, operating system, browser type, App version, and App usage data (e.g., pages visited, features used, session duration).

1.5 Cookies and Tracking Technologies

The App may use cookies, software development kits (SDKs), and similar tracking technologies to collect usage data and improve your experience. Cookies do not identify you personally but identify the device used. You may configure your device to reject cookies; however, doing so may affect your use of certain App features.

1.6 Communications Data

Records of your communications with us, including customer service inquiries, feedback, and complaints.

1.7 Sensitive Personal Data

We do not intentionally collect sensitive personal data (such as information relating to your religious beliefs, health, political opinions, or criminal convictions) through the App. In the event such data is collected, we will obtain your explicit consent and process it strictly in accordance with the PDPA.

2. HOW WE USE YOUR INFORMATION

We process your personal data for the following purposes:

2.1 Service Provision

To process orders, manage your account, facilitate payments, administer membership and loyalty programmes, and provide customer support.

2.2 Personalisation

To provide personalised content, product recommendations, and promotional offers tailored to your preferences and usage patterns.

2.3 Communication

To communicate with you regarding your account, orders, transactions, service updates, and to respond to your enquiries or complaints.

2.4 Marketing and Promotions

To send you promotional communications, birthday greetings, offers, free gifts, vouchers, and information about our products, services, and events via SMS, push notification, email, in-app messages, or other appropriate channels. You may opt out of marketing communications at any time (see Section 7 below).

2.5 Security and Fraud Prevention

To detect, investigate, and prevent fraudulent, unauthorised, or illegal activity, and to protect the security of your account and our App.

2.6 Legal and Regulatory Compliance

To comply with applicable laws, regulations, court orders, government directives, or lawful requests by public authorities.

2.7 Analytics and Improvement

To monitor, review, analyse, and improve the App's functionality, performance, user experience, and our products and services.

2.8 Internal Administration

For audit, risk management, compliance, record-keeping, and other internal administrative purposes including compliance with our obligations to licensors, franchisors, or brand owners.

3. DISCLOSURE OF PERSONAL DATA

We may disclose your personal data to the following categories of third parties, within and/or outside Malaysia, for the purposes described above:

3.1 Service Providers

Payment service providers, IT and system service providers, cloud hosting and data storage providers, analytics providers, and other third parties engaged to provide technical, operational, or support services on our behalf.

3.2 Business Partners

Co-marketing partners, strategic partners, licensors, franchisors, brand owners, and third-party product or service providers in connection with joint promotions, campaigns, or services, brand management, operational oversight, reporting, and compliance with contractual obligations.

3.3 Group Companies

Our parent company, subsidiaries, related companies, and associated companies.

3.4 Professional Advisers

Auditors, consultants, lawyers, accountants, and other professional advisers on a strictly confidential basis.

3.5 Regulatory and Government Authorities

Law enforcement agencies, courts, tribunals, regulatory bodies, government agencies, and statutory bodies, where required or authorised by law.

3.6 Corporate Transactions

Any third party in connection with any proposed or actual reorganisation, merger, acquisition, sale, consolidation, joint venture, assignment, or transfer relating to any portion of the Company.

We do not sell your personal data to any third party.

All third parties receiving your personal data are required to process it only for the purposes set out in this Policy and in accordance with applicable data protection laws.

4. CROSS-BORDER DATA TRANSFER

Your personal data may be transferred to, stored in, and processed in locations outside Malaysia where necessary for the purposes described in this Policy, including transfers to our service providers, business partners, licensors, franchisors, brand owners, and related parties located outside Malaysia. Where such transfer occurs, we will take reasonable steps to ensure that your personal data receives a standard of protection comparable to the protection afforded under the PDPA and applicable Malaysian laws.

5. DATA SECURITY

5.1 Security Measures

We are committed to protecting your personal data. We implement appropriate technical, physical, electronic, and procedural security measures, including but not limited to:

• Data encryption (in transit and at rest);
• Access controls and authentication mechanisms;
• Regular security assessments and vulnerability testing;
• Restricting access to personal data on a strict "need-to-know" basis;
• Using updated cyber-security software to protect data and IT infrastructure;
• Ensuring company data is backed up with recovery systems in place.

5.2 Limitation of Liability

While we take reasonable measures to protect your personal data, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security. Communications over the Internet (such as emails) are not secure unless encrypted, and we do not accept responsibility for any unauthorised access or loss of personal data beyond our reasonable control.

6. DATA RETENTION

6.1 Retention Period

Your personal data will be retained only for as long as necessary to fulfil the purposes for which it was collected, or as required to meet our legal, regulatory, tax, or accounting obligations.

6.2 Disposal

When your personal data is no longer required, it will be securely destroyed, deleted, or anonymised from our records and systems in accordance with our data retention policy.

7. YOUR RIGHTS

Under the PDPA, you have the following rights:

7.1 Right of Access

You have the right to request access to your personal data held by us and to request a copy of such data.

7.2 Right of Correction

You have the right to request that we update or correct any inaccurate, incomplete, or out-of-date personal data.

7.3 Right to Withdraw Consent

You have the right, by notice in writing, to withdraw your consent (in full or in part) for the processing of your personal data, subject to any applicable legal restrictions and contractual conditions. Please note that withdrawal of consent may affect our ability to continue providing you with our products, services, or the use of certain App features, and may result in the termination of your account.

7.4 Right to Limit Processing

You have the right to request that we limit the processing of your personal data, including the right to opt out of receiving marketing communications.

7.5 Right to Request Deletion

You may request deletion of your personal data where applicable, subject to any overriding legal or regulatory obligations.

7.6 How to Exercise Your Rights

All requests must be submitted in writing for security and verification purposes. In accordance with the PDPA, we may charge a reasonable fee for processing any data access request. You will be notified of the applicable fee prior to the retrieval of your personal data.

If we are unable to comply with your request (for example, where the information requested is of a confidential commercial nature), we will inform you of the reasons for such refusal.

8. CONSEQUENCES OF NOT PROVIDING PERSONAL DATA

If you choose not to provide the required personal data, or if the personal data you provide is insufficient, inaccurate, incomplete, or misleading, we may not be able to:

• Process your orders or transactions;
• Provide you with the full range of services and features available on the App;
• Administer your membership or loyalty programme; or
• Respond to your enquiries or complaints.

9. THIRD-PARTY WEBSITES AND SERVICES

The App may contain links to third-party websites or services that are not operated or controlled by us. This Privacy Policy does not apply to such third-party websites or services. We encourage you to review the privacy policies of any third-party websites or services before providing your personal data.

10. MINORS

The App is not intended for use by individuals under the age of 18. If you are under 18 years of age, you must obtain consent from your parent or legal guardian before using the App and providing any personal data. By permitting a minor to use the App, the parent or legal guardian agrees to be bound by this Privacy Policy on behalf of the minor and accepts responsibility for the minor's use of the App.

11. POLICY UPDATES

We reserve the right to review, update, or amend this Privacy Policy from time to time to reflect changes in our practices, the PDPA, or other applicable laws. Any updates will be published within the App and/or on our website. By continuing to use the App after such modifications, you signify your acceptance of the updated Privacy Policy.

We encourage you to review this Privacy Policy periodically.

12. GOVERNING LAW

This Privacy Policy shall be governed by and construed in accordance with the laws of Malaysia, including the Personal Data Protection Act 2010.

13. CONTACT US

If you have any questions about this Privacy Policy, wish to exercise your rights, or wish to make any inquiries or complaints regarding the processing of your personal data, please contact us:

Company Name: Reveillon Champ Sdn Bhd

Address: 152-4-1A, Kompleks Maluri, Jalan Jejaka, Taman Maluri, Kuala Lumpur, Wilayah Persekutuan, Malaysia

Email: [Email Address]

Contact Number: [Phone Number]