Privacy Policy

1. Introduction

This Privacy Policy describes how Horvy Pavilion Sdn Bhd (Company Registration No. 202501038537 (1639946-X)) ("Horvy Pavilion", "we", "us", or "our") collects, uses, discloses, and protects your personal data when you use the HakShan online ordering platform, including the website at horvy-frontend.vercel.app (and any successor domain), and any related mobile applications or services (collectively, the "Platform").

This Privacy Policy is issued in compliance with the Personal Data Protection Act 2010 of Malaysia ("PDPA") and its subsidiary regulations.

By using the Platform, you consent to the collection, use, and disclosure of your personal data in accordance with this Privacy Policy.

2. Personal Data We Collect

We collect the following categories of personal data:

2.1 Information You Provide Directly

• Full name
• Mobile phone number
• Email address (if provided)
• Delivery addresses and location coordinates
• Order history and preferences
• Payment information (processed by our payment gateway; we do not store full card details)
• Communications with our customer service team

2.2 Information Collected Automatically

• Device information (device type, operating system, browser type)
• IP address and approximate geolocation
• Usage data (pages viewed, features used, timestamps)
• Cookies and similar tracking technologies

2.3 Information from Third Parties

• Authentication data from SMS OTP verification (via Twilio)
• Location and mapping data (via Google Maps)
• Payment confirmation data (via FIUU)
• Delivery status updates (via Pandago)

3. Purposes for Which We Use Your Personal Data

We collect and use your personal data for the following purposes:

• To create and manage your account on the Platform;
• To process, confirm, and fulfil your orders;
• To facilitate payment processing through our authorised payment gateway;
• To arrange delivery through our logistics partner and communicate delivery status;
• To communicate with you regarding your orders, account, and customer service enquiries;
• To send you promotional communications, offers, and updates (where you have consented);
• To improve the Platform, analyse usage patterns, and develop new features;
• To detect, prevent, and address fraud, security incidents, and abuse;
• To comply with legal obligations, respond to lawful requests, and enforce our Terms of Use;
• For any other purpose reasonably related to the above or with your consent.

4. Legal Basis for Processing

We process your personal data on the following legal bases under the PDPA:

• Your consent, which you provide by agreeing to this Privacy Policy and using the Platform;
• Performance of a contract, namely processing your orders and providing the Platform services;
• Compliance with legal obligations under Malaysian law;
• Our legitimate interests in operating, improving, and securing our business, provided these interests are not overridden by your rights and freedoms.

5. Disclosure of Personal Data

We may disclose your personal data to the following categories of third parties, strictly for the purposes described in this Privacy Policy:

5.1 Authorised Outlet Partners

The HakShan Outlet Partner (being a separate Sdn Bhd entity under Horvy Holding Sdn Bhd) that prepares and fulfils your order will receive your name, contact number, delivery address, and order details.

5.2 Service Providers and Data Processors

• FIUU — Payment gateway provider, to process your payment securely;
• Pandago (Delivery Hero Malaysia Sdn Bhd) — Delivery logistics provider, to fulfil delivery orders;
• Twilio — SMS service provider, to send OTP and order notifications;
• Google — Maps, geolocation, and address verification;
• Supabase — Database, authentication, and hosting infrastructure;
• Vercel and Railway — Application hosting and deployment platforms;
• FeedMe POS — Point-of-sale system used by Outlet Partners to receive and process orders;
• WhatsApp Business — Messaging service for customer notifications (where applicable).

5.3 Legal and Regulatory Disclosures

We may disclose your personal data where required by law, court order, or lawful request from a competent authority, or to protect our rights, property, or safety and that of our users and the public.

5.4 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of our business, your personal data may be transferred to the acquiring entity, subject to confidentiality obligations.

6. Cross-Border Data Transfer

Some of our service providers (such as cloud infrastructure and SMS gateways) may process your personal data on servers located outside Malaysia. Where such transfers occur, we take reasonable steps to ensure that your personal data is protected by a standard of protection comparable to that under the PDPA.

7. Data Retention

We retain your personal data for as long as necessary to fulfil the purposes for which it was collected, including:

• Account data: for as long as your account remains active, plus a reasonable period thereafter;
• Order and transaction records: for a minimum of seven (7) years, in accordance with Malaysian tax and accounting requirements;
• Marketing communications data: until you withdraw your consent or unsubscribe;
• Technical and usage logs: for a reasonable period for security, fraud prevention, and analytics purposes.

After the applicable retention period, we will securely delete or anonymise your personal data.

8. Your Rights Under the PDPA

Subject to the provisions of the PDPA, you have the following rights:

• Right of access: to request a copy of the personal data we hold about you;
• Right of correction: to request correction of inaccurate or incomplete personal data;
• Right to withdraw consent: to withdraw your consent to our processing of your personal data, subject to legal or contractual limitations;
• Right to limit processing: to request that we limit the processing of your personal data for direct marketing purposes;
• Right to lodge a complaint: to lodge a complaint with the Personal Data Protection Commissioner of Malaysia.

To exercise any of these rights, please contact us using the details in Section 13. We may require you to verify your identity before processing your request. A nominal fee may apply for data access requests, as permitted by the PDPA.

9. Data Security

We implement reasonable technical, administrative, and physical safeguards to protect your personal data against unauthorised access, loss, misuse, alteration, or disclosure. These include:

• Encrypted data transmission (HTTPS/TLS) between your device and our servers;
• Secure authentication (SMS OTP verification);
• Access controls limiting staff access to personal data on a need-to-know basis;
• Regular security reviews of our infrastructure and third-party providers;
• Use of reputable payment gateway providers who comply with PCI DSS standards.

However, no system is completely secure. You are responsible for keeping your account credentials confidential, and you acknowledge that transmission of data over the internet carries inherent risks.

10. Cookies and Tracking Technologies

The Platform uses cookies and similar technologies to:

• Maintain your session and keep you logged in;
• Remember your preferences and cart contents;
• Analyse how the Platform is used, so we can improve it;
• Deliver relevant content and, where applicable, marketing communications.

You can control cookies through your browser settings. Disabling cookies may affect the functionality of the Platform.

11. Children's Privacy

The Platform is not intended for use by individuals under the age of 18 without the consent of a parent or legal guardian. We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child without parental consent, we will delete such data.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. Material changes will be notified via the Platform or by email/SMS to registered users. The "Effective Date" at the top of this Policy indicates when it was last updated.

13. Contact Us

If you have questions about this Privacy Policy, wish to exercise your rights, or have a complaint regarding our handling of your personal data, please contact our Data Protection Officer at:

If you are not satisfied with our response, you may lodge a complaint with the Personal Data Protection Commissioner of Malaysia (Jabatan Perlindungan Data Peribadi) at www.pdp.gov.my.