Last updated: 25 Aug 2026
1. About this policy
This Privacy Policy explains how Vendora (“Vendora”, “we”, “us” or “our”), collects, uses, discloses, stores and protects personal data when you:
- Visit or use our website;
- Create a customer account;
- Purchase or enquire about our products;
- Contact our customer service team;
- Visit one of our showrooms;
- Subscribe to our marketing communications; or
- Otherwise interact with Vendora.
We process personal data in accordance with the Malaysian Personal Data Protection Act 2010 (“PDPA”), including applicable amendments, regulations, standards and guidelines. The PDPA applies to personal data processed in connection with commercial transactions in Malaysia. Personal Data Protection Commissioner
2. Personal data we collect
Depending on how you interact with us, we may collect:
- Identity information, such as your name and account username;
- Contact information, such as your email address, telephone number, billing address and delivery address;
- Order information, such as products purchased, order value, delivery instructions, returns and warranty claims;
- Account information, such as your account credentials and preferences;
- Payment information, such as payment status, transaction reference and limited payment details received from our payment service providers;
- Communications, including emails, contact-form submissions, customer-service conversations, reviews and survey responses;
- Marketing preferences, including whether you wish to receive promotional communications;
- Technical information, including IP address, browser type, device information, operating system and website activity;
- Cookie and analytics information; and
- Any other information that you voluntarily provide to us.
We generally do not store complete payment-card numbers. Payments are processed by our appointed payment service providers, subject to their respective privacy policies.
3. How we collect personal data
We may collect personal data:
- Directly from you when you register, place an order, contact us or visit a showroom;
- Automatically through cookies and similar technologies when you use our website;
- From payment gateways, delivery companies and other service providers involved in fulfilling your order;
- From social media platforms when you communicate with us through those platforms;
- From publicly available sources; and
- From another person acting on your behalf, such as the purchaser of a gift.
If you provide personal data relating to another person, you confirm that you are authorised to provide it and have informed that person about this Privacy Policy where appropriate.
4. How we use personal data
We may process your personal data to:
- Create and manage your customer account;
- Process payments, orders, deliveries, returns, refunds and warranty claims;
- Communicate with you about your orders;
- Respond to questions, complaints and customer-service requests;
- Provide product recommendations and improve our products and services;
- Maintain transaction, accounting and business records;
- Prevent fraud, misuse, security incidents and unlawful activity;
- Operate, secure, troubleshoot and improve our website;
- Analyse website usage and business performance;
- Send promotional communications where you have consented or where otherwise permitted by law;
- Comply with legal, regulatory, tax and reporting obligations;
- Establish, exercise or defend legal claims; and
- Carry out any other purpose disclosed to you when your data is collected.
We will not use personal data for an unrelated purpose without providing the required notice or obtaining consent where required.
5. Required and optional information
Information marked as required is necessary for us to create your account, process your order, deliver products, respond to your request or comply with legal requirements.
If you do not provide required information, we may be unable to:
- Create or maintain your account;
- Accept or fulfil your order;
- Process payment or delivery;
- Provide customer support; or
- Supply the requested product or service.
Providing information for marketing, surveys and optional account preferences is voluntary. You may decline without affecting an existing order.
6. Disclosure of personal data
We may disclose personal data to the following classes of recipients where necessary:
- Payment gateways, banks and financial institutions;
- Delivery, logistics, installation and warehousing providers;
- Website hosting, cloud storage, cybersecurity and IT providers;
- Customer-service, email and communication platforms;
- Marketing, analytics and advertising providers;
- Professional advisers, including lawyers, auditors, accountants and insurers;
- Companies within our corporate group;
- Business partners involved in providing a requested product or service;
- Government departments, regulators, courts and law-enforcement agencies where required or permitted by law;
- A purchaser, investor or adviser involved in a proposed business sale, restructuring or acquisition; and
- Other parties authorised by you.
Service providers may only process personal data for the services they provide to us and are expected to apply appropriate safeguards.
We do not sell personal data.
7. International transfers
Some service providers may store or process personal data outside Malaysia. Where personal data is transferred overseas, we will take reasonable steps to ensure that the transfer complies with section 129 of the PDPA and that the recipient provides an appropriate level of protection.
Depending on the transfer, safeguards may include contractual protections, an assessment of the receiving country’s laws, security measures, consent where required, or another condition permitted under the PDPA. Malaysian guidance also requires controllers to maintain appropriate transfer records. Cross-Border Personal Data Transfer Guidelines
8. Cookies
Our website may use:
- Essential cookies needed for accounts, carts, checkout, security and website operation;
- Preference cookies that remember your settings;
- Analytics cookies that help us understand website usage; and
- Advertising cookies, where enabled, used to measure or personalise marketing.
You can manage non-essential cookies through your browser settings. Disabling certain cookies may affect how some website features work.
This demonstration website does not currently use analytics or advertising services such as Google Analytics or Meta Pixel.
9. Marketing communications
If you subscribe to marketing, we may contact you about products, promotions and Vendora news.
You can withdraw your consent or opt out at any time by:
- Selecting the unsubscribe link in an email;
- Updating your account preferences; or
- Contacting us using the details below.
We may still send non-marketing communications concerning your account, orders, delivery, security or legal matters.
10. Retention
We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, including to:
- Complete orders and provide support;
- Honour warranties and manage disputes;
- Maintain records required by tax, accounting and consumer laws;
- Prevent fraud and protect our systems; and
- Establish or defend legal claims.
When personal data is no longer required, we will take reasonable steps to delete, destroy or anonymise it. The PDPA requires data not to be retained longer than necessary. Personal Data Protection Act 2010, sections 10–12
11. Security
We use reasonable administrative, physical and technical safeguards designed to protect personal data against loss, misuse, alteration, unauthorised access, disclosure or destruction.
These measures may include access controls, secure connections, staff access restrictions, system monitoring, backups and appropriate contractual requirements for service providers.
No internet transmission or storage system is completely secure. You are responsible for keeping your account password confidential and notifying us if you suspect unauthorised account access.
Where required by Malaysian law, we will notify the Personal Data Protection Commissioner and affected individuals of qualifying personal-data breaches. Malaysia’s breach-notification obligations took effect on 1 June 2025. Official Data Breach Notification guidance
12. Your rights and choices
Subject to the PDPA and any applicable exceptions, you may:
- Request access to personal data held about you;
- Request correction of inaccurate, incomplete, misleading or outdated data;
- Withdraw consent, where processing is based on consent;
- Request that we stop or limit certain processing;
- Object to or opt out of direct marketing;
- Request information about our processing of your personal data;
- Exercise data-portability rights where applicable; and
- Submit an enquiry or complaint.
We may need to verify your identity before processing a request. A permitted fee may apply to certain access requests.
Withdrawing consent does not affect processing already carried out lawfully, and may prevent us from continuing to provide some services.
13. Children’s information
Our website and products are not directed at children under 18. We do not knowingly collect personal data directly from children without appropriate consent from a parent or guardian.
If you believe a child has provided personal data to us without proper authorisation, please contact us.
14. Third-party websites
Our website may contain links to websites or services operated by other organisations. Their collection and use of personal data are governed by their own privacy policies. Vendora is not responsible for the privacy practices of third-party websites.
15. Changes to this policy
We may update this Privacy Policy when our practices, services or legal obligations change. The revised version will be published on this page with an updated effective date.
Where a change materially affects how we process personal data, we will provide additional notice where required.
