← Back to home

Privacy Policy and Personal Data Protection Notice

Effective Date: 14 July 2026
Last Updated: 14 July 2026

This Privacy Policy and Personal Data Protection Notice ("this Notice") explains how personal data is collected, used, processed, stored, disclosed, protected and managed in connection with this website ("this Website").

This Website is owned and operated by or on behalf of Good Foodie Group Sdn Bhd (202601014114 / 1676212-V) ("the Business", "we", "us" or "our"). For the purposes of applicable personal data protection law, the Business is the data controller of personal data collected through this Website.

This Notice is issued pursuant to the Personal Data Protection Act 2010 of Malaysia ("PDPA"), including the Personal Data Protection (Amendment) Act 2024 and any applicable regulations, standards, codes of practice and guidelines issued thereunder, including applicable Data Protection by Design guidance.

By accessing this Website, submitting an enquiry, contacting us, providing personal data or otherwise using this Website, you acknowledge that you have read and understood this Notice and consent to the processing of your personal data as described in it.

1. Scope of This Notice

This Notice applies to personal data collected or processed in connection with:

  1. your visits to and use of this Website;
  2. enquiries, messages and requests submitted through this Website, including contact forms, enquiry forms, booking or appointment forms, reservation features, checkout features, WhatsApp links, telephone links and email links;
  3. purchases, bookings, orders, registrations, subscriptions or other transactions initiated through this Website;
  4. communications between you and the Business arising from this Website;
  5. marketing, promotional and follow-up communications where permitted; and
  6. website analytics, cookies and technical operation of this Website.

This Notice applies to visitors, customers, potential customers, business contacts and any other individual whose personal data is collected through or in connection with this Website.

2. Meaning of Personal Data

In this Notice, "personal data" means any information in respect of commercial transactions that relates directly or indirectly to a living individual who is identified or identifiable from that information or from that information combined with other information, as defined under the PDPA.

"Sensitive personal data" includes information relating to physical or mental health, political opinions, religious or other similar beliefs, the commission or alleged commission of any offence, biometric data and any other category prescribed under the PDPA.

"the Providers" has the meaning given in the Terms and Conditions published on this Website: each independent service provider engaged by or on behalf of the Business in connection with the design, development, publication, hosting, storage, security, maintenance, management or technical operation of this Website, including the operator of any website platform, content management system, self-service portal or hosting infrastructure used by or for this Website, together with their respective related companies, directors, officers, employees, contractors, subcontractors, licensors and agents.

3. Personal Data We May Collect

Depending on how you interact with this Website and the Business, the personal data collected may include:

3.1 Contact and Enquiry Data

  1. name;
  2. telephone number;
  3. WhatsApp number;
  4. email address;
  5. company or business name and role, where relevant;
  6. the content of your enquiry, message, request or feedback; and
  7. your preferred contact method and communication history.

3.2 Transaction and Booking Data

  1. booking, appointment, order, reservation or registration details;
  2. delivery or service address where required;
  3. billing details where required;
  4. payment status and transaction references; and
  5. records of Products or Services requested or purchased.

We do not usually collect or store full credit card or debit card numbers through this Website. Where online payment is available, payment details are normally collected and processed directly by third-party payment providers under their own terms and privacy policies.

3.3 Technical and Usage Data

This Website uses privacy-focused analytics designed to measure visits and interactions without building personal profiles of individual visitors. Technical data processed may include:

  1. IP address;
  2. device type, operating system and browser type;
  3. referring website or source;
  4. pages visited, time spent and click activity, including clicks on contact buttons;
  5. form submission events;
  6. cookies and similar identifiers; and
  7. general location information derived from your IP address.

3.4 Other Data You Provide

Any other personal data you choose to provide to us through this Website or in your dealings with the Business, including information contained in documents, images or messages you submit.

We generally do not request sensitive personal data through this Website. If you provide sensitive personal data, you consent to its processing for the purpose for which it was provided, and you confirm that you have the right and authority to provide it.

4. How We Collect Personal Data

Personal data may be collected:

  1. directly from you, when you submit a form, contact us, make a booking or order, subscribe to updates or otherwise communicate with us through or in connection with this Website;
  2. automatically, through cookies, analytics tools, server logs and similar technologies when you use this Website;
  3. from third-party platforms you use to contact us, such as WhatsApp, social media or messaging platforms;
  4. from third-party service providers involved in operating this Website or processing transactions, such as payment providers and booking systems; and
  5. from publicly available sources where relevant and lawful.

Consent by Design

Where this Website collects personal data through contact, booking, reservation or checkout forms, consent is obtained through clear, affirmative, opt-in mechanisms. Consent checkboxes on this Website are never pre-ticked, in line with applicable Data Protection by Design guidance under the PDPA. You are free to decline to provide personal data, in which case some features or services may not be available to you.

5. Purposes of Processing

Personal data may be collected, used and processed for the following purposes:

  1. to respond to your enquiries, messages, requests and feedback;
  2. to provide, process and manage bookings, appointments, orders, reservations, registrations and transactions;
  3. to provide, deliver and administer the Products and Services of the Business;
  4. to communicate with you regarding your enquiries, transactions or dealings with the Business;
  5. to process payments, invoicing and billing where applicable;
  6. to maintain business records and manage customer relationships;
  7. to operate, maintain, secure and improve this Website, including backups, security monitoring and fraud prevention;
  8. to analyse website usage and improve user experience;
  9. to send you marketing, promotional or informational communications where you have consented or where otherwise permitted by law;
  10. to verify identity and prevent fraud, abuse, security incidents or unlawful activity;
  11. to comply with legal, regulatory, tax, accounting and record-keeping requirements;
  12. to establish, exercise or defend legal rights and manage disputes; and
  13. for other purposes directly related to the above or notified to you at the time of collection.

6. Legal Basis and Consent

Personal data is processed on the basis of your consent, the necessity of processing for the performance of a contract or the taking of steps at your request before entering into a contract, compliance with legal obligations, and other lawful grounds recognised under the PDPA.

By providing personal data through this Website or otherwise to the Business, you consent to the collection, use, processing, disclosure and retention of your personal data in accordance with this Notice.

If you provide personal data of another individual to us (for example, a family member, colleague or representative), you confirm that you are authorised to do so and that you have obtained that individual's consent to the processing of their personal data in accordance with this Notice.

Providing your personal data is voluntary. However, if you do not provide the personal data requested, or if you later withdraw consent, we may be unable to respond to your enquiry, process your transaction or provide the relevant Products or Services.

7. Disclosure of Personal Data

Personal data may be disclosed, where necessary and for the purposes stated in this Notice, to:

  1. employees, management and authorised personnel of the Business;
  2. the Providers, acting as data processors in connection with the hosting, storage, backup, security, maintenance and technical operation of this Website;
  3. service providers engaged by the Business or the Providers, including hosting providers, domain and DNS providers, cloud storage providers, email service providers, analytics providers, security providers, communication and messaging platforms, booking systems and customer relationship tools;
  4. payment processors, payment gateways, banks and financial institutions where payment is involved;
  5. delivery, logistics or fulfilment providers where relevant to a transaction;
  6. professional advisers, including lawyers, accountants, auditors and insurers;
  7. government authorities, regulators, law enforcement agencies and courts where disclosure is required or permitted by law; and
  8. any party to whom you have authorised disclosure or to whom disclosure is necessary to fulfil your request.

Reasonable steps will be taken to ensure that third parties who process personal data on behalf of the Business do so only for permitted purposes and with appropriate safeguards.

If the Business is involved in any merger, acquisition, restructuring, sale of assets or other corporate transaction, personal data may be transferred as part of that transaction, subject to applicable legal requirements.

Personal data will not be sold to third parties.

8. Role of the Providers

This Website is operated on infrastructure and systems designed, hosted, secured, maintained or managed by one or more Providers as independent service providers engaged by the Business.

You acknowledge and agree that:

  1. the Business, and not any Provider, determines the purposes for which personal data collected through this Website is used, and the Business is the data controller of such personal data under the PDPA;
  2. the Providers act only as data processors, and may access or process personal data solely to the extent necessary to build, host, store, back up, secure, support, maintain or manage this Website and its related services, including automated database backups;
  3. no Provider uses personal data collected through this Website for its own marketing purposes;
  4. the Business publishes and controls the content of this Website through a self-service system, and the Business alone is responsible for ensuring that any personal data it chooses to publish on this Website (including names, photographs, testimonials or profiles) is published lawfully and with all required consents;
  5. any dealing, transaction or dispute concerning your personal data as used by the Business is a matter between you and the Business; and
  6. to the maximum extent permitted by law, no Provider shall be liable to you for any loss or damage arising from the collection, use, disclosure, publication or handling of your personal data by the Business or by third parties outside that Provider's reasonable control.

The protections in this clause are intended to benefit, and be enforceable by, each Provider to the fullest extent permitted by law.

9. Cross-Border Transfer of Personal Data

Some service providers, hosting infrastructure, cloud platforms, payment systems, analytics tools and communication platforms used in connection with this Website may be located, or may store or process data, outside Malaysia, including on hosting infrastructure distributed across global server locations.

By using this Website and providing personal data, you consent to the transfer, storage and processing of your personal data outside Malaysia where necessary for the purposes stated in this Notice.

Where personal data is transferred outside Malaysia, reasonable steps will be taken to ensure that the transfer complies with applicable requirements under the PDPA, including any applicable cross-border personal data transfer guidelines, and that the personal data receives adequate protection.

10. Cookies and Tracking Technologies

This Website may use cookies and similar technologies to:

  1. operate this Website and its core features, including the language selector;
  2. remember your preferences;
  3. measure and improve website performance;
  4. understand visitor behaviour and usage patterns through privacy-focused analytics;
  5. support analytics and, where used, advertising measurement; and
  6. support security and fraud prevention.

Cookies may be set by this Website or by third-party services integrated into this Website, such as analytics tools, embedded maps, embedded videos, social media features, chat, chatbot or messaging widgets and advertising platforms. These third parties may collect information in accordance with their own privacy policies.

You may manage or disable cookies through your browser settings. Some features of this Website may not function properly if cookies are disabled.

11. Chatbots and Automated Assistants

Where this Website includes a chatbot, automated assistant or AI-powered messaging feature, the conversations you have with it may be recorded and processed to respond to your queries, improve service quality and maintain records of enquiries.

Do not submit sensitive personal data, payment card numbers or passwords through a chatbot. Chatbot responses are provided for general information only and do not constitute professional advice.

12. Marketing Communications

Where you have consented, or where otherwise permitted by law, the Business may send you marketing, promotional or informational communications by email, telephone, SMS, WhatsApp, social media or other channels.

You may opt out of marketing communications at any time by contacting the Business using the contact details published on this Website or by using any unsubscribe or opt-out method provided in the communication. Opting out of marketing does not affect service, transactional or administrative communications relating to your dealings with the Business.

13. Retention of Personal Data

Personal data will not be kept longer than is necessary for the fulfilment of the purposes stated in this Notice, unless a longer retention period is required or permitted by law.

In general:

  1. enquiry records may be retained for a reasonable period after the enquiry to allow follow-up and record-keeping;
  2. customer, transaction, invoicing and tax records may be retained for the periods required under applicable law;
  3. communication records may be retained for reference, dispute resolution and support purposes;
  4. technical logs and automated backups (including scheduled database backups) may be retained for limited operational periods; and
  5. data relevant to a legal claim or dispute may be retained for as long as necessary to protect legal rights.

When personal data is no longer required, reasonable steps will be taken to delete, destroy, anonymise or securely dispose of it.

14. Security of Personal Data

Reasonable administrative, technical, physical and organisational measures are taken to protect personal data against loss, misuse, modification, unauthorised or accidental access or disclosure, alteration or destruction, in accordance with the security principle under the PDPA.

These measures may include SSL or HTTPS encryption on this Website, application-level firewall and security filtering, malware and bot protection, scheduled backups, access controls, password protection, restricted access on a need-to-know basis, security monitoring and the use of reputable service providers.

However, no method of transmission over the internet or method of electronic storage is completely secure. While reasonable steps are taken to protect personal data, absolute security cannot be guaranteed, and any transmission of personal data through this Website is at your own risk to the extent permitted by law.

15. Personal Data Breach

In the event of a personal data breach affecting personal data processed in connection with this Website, reasonable steps will be taken to assess, contain, investigate and respond to the incident.

Where required under the PDPA and applicable guidelines, the breach will be notified to the Personal Data Protection Commissioner and, where the breach is likely to cause significant harm, to the affected individuals, in accordance with applicable legal requirements.

16. Your Rights Under the PDPA

Subject to the provisions of the PDPA and any applicable exemptions, you have the right to:

  1. Access: request access to the personal data held about you;
  2. Correction: request correction of personal data that is inaccurate, incomplete, misleading or not up to date;
  3. Withdraw Consent: withdraw your consent to the processing of your personal data, in whole or in part, by written notice;
  4. Limit Processing: require the cessation of, or prevent, processing of your personal data for direct marketing purposes;
  5. Data Portability: where applicable under the PDPA, request that your personal data be transmitted to another data controller, subject to technical feasibility and compatibility of data formats; and
  6. Prevent Processing Likely to Cause Damage or Distress: object to processing that is likely to cause unwarranted substantial damage or distress to you or another person.

To exercise any of these rights, please contact the Business using the contact details published on this Website. Proof of identity or authority may be requested before a request is processed. A reasonable fee may be charged for access requests where permitted by the PDPA. Requests may be refused or limited where permitted or required by law, and reasons will be provided where required.

Withdrawal of consent does not affect processing carried out before the withdrawal, or processing that is otherwise required or permitted by law or necessary for contractual, accounting, dispute or legal purposes.

17. Accuracy of Personal Data

Reasonable steps are taken to ensure that personal data is accurate, complete, not misleading and kept up to date having regard to the purposes for which it was collected.

You are responsible for ensuring that the personal data you provide is accurate, complete and current, and for notifying the Business promptly of any changes, including changes to your contact details.

18. Children and Minors

This Website is not directed at children, and personal data of children is not knowingly collected through this Website without the consent of a parent or guardian.

If you are below 18 years of age, please obtain the consent of your parent or guardian before providing any personal data through this Website. If it comes to our attention that personal data of a child has been collected without appropriate consent, reasonable steps will be taken to delete such data.

19. Third-Party Websites and Platforms

This Website may contain links to, or integrate, third-party websites, platforms and services, including social media pages, messaging platforms, map services, review platforms, booking systems, payment gateways and video platforms.

This Notice does not apply to the collection, use or disclosure of personal data by third-party websites, platforms or services. Neither the Business nor any Provider is responsible for the privacy practices of such third parties. You should review the privacy policies of any third-party website, platform or service you use.

If you communicate with the Business through WhatsApp, social media or other third-party platforms, your use of those platforms is also subject to their own terms and privacy policies.

20. Relationship With the Terms and Conditions

This Notice forms an integral part of the Terms and Conditions published on this Website. Definitions used in the Terms and Conditions apply to this Notice unless the context requires otherwise.

21. Limitation of Liability

While reasonable steps are taken to protect personal data, to the maximum extent permitted by law, neither the Business nor any Provider shall be liable for any loss, damage, claim, cost or expense arising from unauthorised access to, disclosure of, loss of or misuse of personal data caused by events outside their reasonable control, including third-party platform failures, cyberattacks despite reasonable safeguards, compromised accounts or credentials not attributable to their negligence, or inaccurate information provided by you.

Nothing in this Notice excludes or limits any liability that cannot be excluded or limited under applicable law.

22. Updates to This Notice

This Notice may be updated or revised from time to time to reflect changes in legal requirements, business practices, technology or the operation of this Website. The updated version will be published on this Website with a revised "Last Updated" date.

Your continued use of this Website or continued dealings with the Business after any update constitutes your acknowledgement of the updated Notice. You are encouraged to review this Notice periodically.

23. Language

This Notice is issued in English. A Bahasa Malaysia version is available on request using the contact details published on this Website.

In the event of any inconsistency between the English version and any Bahasa Malaysia version, the English version shall prevail to the extent permitted by law.

24. Contact and Data Protection Enquiries

If you have any questions about this Notice, or if you wish to make a request relating to access, correction, withdrawal of consent, limitation of processing, data portability, complaints or any other personal data matter, please contact the Business using the contact details published on this Website, including any telephone number, WhatsApp number, email address, contact form or business address displayed on this Website.

Where a data protection officer has been appointed by the Business under the PDPA, requests and enquiries will be directed to that officer.

25. Acknowledgement

By accessing this Website, submitting an enquiry, providing personal data or otherwise using this Website, you acknowledge that you have read and understood this Privacy Policy and Personal Data Protection Notice and consent to the collection, use, processing, disclosure and retention of your personal data as described in this Notice.