MR. D.I.Y. GROUP (M) BERHAD – PERSONAL DATA PROTECTION POLICY (“Personal Data Protection Policy”)
1. Introduction
1.1. MR D.I.Y. Group (M) Berhad (“MRDIY”) is committed to protecting the privacy and confidentiality of Personal Data (as hereinafter defined) by observing applicable data protection laws, including the Personal Data Protection Act (“PDPA”) 2010 in Malaysia and other international best practices. This policy sets out our approach to data protection, ensuring that Personal Data is handled responsibly and in compliance with legal, regulatory, and ethical standards.
1.2. The protection of Personal Data is essential to maintaining trust with our customers, employees, suppliers, and stakeholders. This Personal Data Protection Policy established how Personal Data is collected, processed, disclosed and retained by MRDIY.
2. Personal Data MRDIY Collects from You
2.1. Before your Personal Data is collected or process, we will obtain for your consent, which will be recorded and maintained properly by MRDIY, to such collection and processing. However, in certain scenarios, consent is not required such as when the processing of Personal Data is necessary for the performance of contract or is required under the law.
2.2. For the processing of Sensitive Personal Data, MRDIY is required to obtain explicit consent to such collection and processing. For avoidance of doubt, such consent, when collecting Sensitive Personal Data, cannot be obtained by inferring from your actions, such explicit consent must be expressly confirmed in words.
2.3. At MRDIY, we strive to collect only the Personal Data that we need that is deemed adequate, relevant and not excessive to the purpose for which Personal Data is processed by us within this Personal Data Protection Policy, when:
2.3.1. you submit any form, including but not limited to application forms, sign up for an account, joining a contest;
2.3.2. you enter into any agreement or provide other documentation or information in respect of your interactions with us, or when you use our services;
2.3.3. you are browsing through our e-commerce platform;
2.3.4. you interact and/ or contacted with our staff such as via telephone calls, emails, letters, Short Message Service (SMS), social media platforms or meetings; or
2.3.5. your images are captured by us via CCTVs while you are within our premises:
2.4. The following Personal Data MRDIY collects depends on how you interact with MRDIY such as if you are our:
2.4.1. Customer – we collect Customer Data:
Personal Data such as name, address, phone number, email (“Contact Details”) may be collected from customers will only be used for purposes such as processing transactions, marketing communications (with consent), customer support, and service improvements.
2.4.2. Employee – we collect Employee Data:
Personal Data such as employees name, image, employment number, tax number, government-issued identification numbers/ passport numbers, Contact Details. For the purpose of employee verification, MRDIY will collect employee sensitive Personal Data, such as religion, health condition, biometrics of employees will be collected and used for employment-related purposes, including payroll processing, benefits administration, performance evaluations, and compliance with legal obligations.
2.4.3. Partners – we collect Supplier and Business (“MRDIY Partner”) Partner Data:
Contact Details collected from suppliers and business partners will be used for contractual relationships, procurement processes, and performance monitoring.
(collectively referred to as “Personal Data”)
2.5. You are not required to provide the Personal Data that we have requested. However, if you choose not to do so, in many cases we will not be able to provide with our products or services or respond to your requests you may have.
2.6. MRDIY will not collect the Personal Data involves individuals of age of eighteen (18) years (the “Minor”).
2.7. In the event the collection of Personal Data of a Minor, such consent shall be obtained from the parent, guardian or person who has parental responsibility on the Minor.
3. MRDIY Use of Personal Data
3.1. MRDIY uses your Personal Data only when we have a valid legal basis. Depending on the circumstances, MRDIY may rely on your consent or the fact that the processing is necessary to:
3.1.1. Fulfil a contract with you. MRDIY collects Personal Data necessary to facilitate your order, which may include Personal Data collected to improve our offerings, carry out our contractual obligation, for internal purposes such as auditing, or for troubleshooting.
For example, if you are our customer and would like to arrange for delivery, MRDIY will collect your Contact Details to process your order.
3.1.2. Communicate with you. To respond to communications, reach out to you about your transactions or account, market our products and services, notify you on prizes, provide other relevant information or request information or feedback.
3.1.3. Security and Fraud Prevention. To protect individuals, employees and MRDIY and for loss prevention and to prevent fraud, including to protect individuals, employees and MRDIY for the benefit of all our users, and pre-screening or scanning uploaded content for potentially illegal content.
3.1.4. Comply with the law. To comply with applicable law – for example, to satisfy tax, for the purpose of issuing e-invoice and reporting obligations, or to comply with a lawful governmental request.
3.2. We may also process your Personal Data where we believe it is in our or others’ legitimate interests, taking into consideration your interests, rights, expectations, security and fraud prevention. if you have question about the legal basis, you can contact us through our contact details set out in the section at Paragraph 9 (Contact Us) below.
4. Personal Data MRDIY Receives From Other Sources
4.1. MRDIY may receive Personal Data about you from other individuals, from businesses or third parties acting at your direction, from our partners who work with us to provide our products and services and assist us in security and fraud prevention, and from other lawful sources.
4.1.1. Individuals. MRDIY may collect data about you from other individuals – for example, if that individual has sent you a product or gift card, invited you to participate in MRDIY service, contest or forum, or shared content with you.
4.1.2. At Your Direction. You may direct other individuals or third parties to share data with MRDIY to fulfil a contact with MRDIY.
4.1.3. MRDIY Partners. We may also validate the information you provide – for example, when creating an account with MRDIY, with a third party for security, and for fraud-prevention purposes.
4.2. Generally, MRDIY shall not disclose your Personal Data to any third party. In the event disclosure is necessary, it shall be limited to the purpose and related purposes for which the original consent was obtained.
5. The Rights You Have Towards Your Personal Data.
5.1. In accordance with applicable laws, MRDIY allows you the following rights, upon request via our contact details set out in the section at Paragraph 9 (Contact Us) below, to:
5.1.1. ask us what Personal Data we have of you, including to be provided with a copy of your Personal Data;
5.1.2. correct or update your Personal Data where the personal data is inaccurate, incomplete, misleading or not up-to-date;
5.1.3. withdraw your consent to the processing of your Personal Data;
5.1.4. prevent processing likely to cause damages or distress; and
5.1.5. request that MRDIY transmits your Personal Data directly to another data controller.
5.2. If you request for a copy of your Personal Data and we are able to accede to your request, a fee may be charged for providing the copy. In such an event, we will inform you of the fee to be charged for the requested copy.
5.3. There will be instances where MRDIY is unable to comply with your request, such as when the burden or expense of providing access to Persona Data is disproportionate to the risk to others Personal Data or such access to Personal Data is regulated by another law, and in such circumstances MRDIY shall refuse your request.
6. How MRDIY Retains Your Personal Data.
6.1. MRDIY retains Personal Data only for so long as necessary to fulfil the purposes for which it was collected, including as described in this Personal Data Protection Policy or in our service-specific privacy notices, or as required by law.
6.2. MRDIY retains your Personal Data for a period that is reasonably necessary to fulfill our internal operational, legal, or regulatory requirements. Where no longer required, such data will be securely disposed of in accordance with our data retention and disposal practice.
6.3. MRDIY takes practical steps and established security standard to protect the Personal Data from any loss, misuse, modification, unauthorised or accidental access or disclosure, alternation or destruction.
6.4. MRDIY takes reasonable steps to ensure that Personal Data is accurate, complete, not misleading and kept up-to-date by having regard to the purpose, including any direct related purpose, for which the Personal Data was collected and further process.
7. Cookies
7.1. Cookies are small pieces of data that the site transfers to the user’s computer hard drive when the user visits the website. Our website uses only session cookies which are erased when the user closes the Web browser. The session cookie is stored in temporary memory and is not retained after the browser is closed. Session cookies do not collect information from the user’s computer. They will typically store information in the form of a session identification that does not personally identify the user.
8. Data Breach Notification
8.1. In the event of a data breach involving Personal Data, MRDIY will promptly access the nature and scope of the breach and take appropriate remedial actions. Where required by applicable laws and regulations, MRDIY will notify the affected individuals and relevant authorities without undue delay, providing information on the breach, its potential impact, and any steps taken to mitigate the risks.
8.2. Should you become aware of any actual or suspected breach, you are required to notify MRDIY without delay. Reports can be made through Paragraph 9 below, and should include relevant details of the breach to facilitate investigation and remedial action.
9. Contact Us
9.1. You may reach out to our Data Protection Officer at the following contact details:
Email: [email protected]
Tel.: +60(3) 8961 1338
10. Policy Review and Updates
10.1. This policy will be reviewed periodically and updated as necessary to ensure its continued effectiveness and compliance with evolving legal, regulatory, and industry standards. Any changes to the policy will be communicated to all employees, contractors, and relevant stakeholders.