Last updated 6 August 2026
This notice explains what personal data Loyalty Cards handles, why, and what you can do about it. It is written to meet Malaysia's Personal Data Protection Act 2010 (PDPA) and its 2024 amendments.
The short version. If you run a shop, your customer list belongs to you. We store it so the app works, and we do not market to your customers, sell your data, or take a cut of your sales.
If you're a customer collecting stamps, the shop decides what happens to your details — we just hold them on the shop's behalf.
Data protection law treats these separately, and it matters for who you should contact:
You are the data user for your customers' details. You decide what to collect and how long to keep it. We are your data processor — we only act on your instructions.
The shop whose card you joined is responsible for your details. Contact them first. We'll always help them action your request.
We do not collect payment details, identity-card numbers, addresses or dates of birth from loyalty customers. A loyalty card never needs them.
When a customer joins a card they are asked, in plain words, whether it's alright to message them about rewards. That answer is recorded against their record. If they say no, they still get their card — they simply don't get reminders. They can change their mind by telling the shop.
We do not sell personal data, ever. We share it only with the services needed to run the product:
Each business's data is kept logically separate. One business cannot see another's customers.
Data is stored on servers operated by our hosting provider and may be processed outside Malaysia by the services listed above. We take reasonable steps to ensure comparable protection wherever it is processed.
Under the PDPA you may:
Business owners can do most of this inside the app. Loyalty customers should ask the shop whose card they joined — the shop can delete a record immediately from their dashboard.
No system is perfectly secure. If a breach happens that is likely to cause significant harm, we will notify affected users and the relevant authority as the PDPA requires.
Loyalty Cards is meant for businesses. We don't knowingly collect data from anyone under 13. If a shop has added a child's details and a parent objects, ask the shop to delete the record.
If we change this notice materially, we'll email account holders. The date at the top always shows the current version.
Questions, or want to exercise any of the rights above? Email support@loyaltycards.click, or raise a request inside the app. We aim to respond within 14 days.
Business owners: if you need a signed data processing agreement for your own records, ask us and we'll provide one.