Privacy Policy

1. Introduction

This Privacy Policy describes how Horvy Pavilion Sdn Bhd (Company Registration No. 202501038537 (1639946-X)) ("Horvy Pavilion", "we", "us", or "our") collects, uses, discloses, and protects your personal data when you use the HakShan online ordering platform, including the website at order.hakshan.com (and any successor domain), and any related mobile applications or services (collectively, the "Platform").

This Privacy Policy is issued in compliance with the Personal Data Protection Act 2010 of Malaysia ("PDPA") and its subsidiary regulations.

By using the Platform, you consent to the collection, use, and disclosure of your personal data in accordance with this Privacy Policy.

2. Personal Data We Collect

We collect the following categories of personal data:

2.1 Information You Provide Directly

• Full name
• Mobile phone number
• Email address (if provided)
• Delivery addresses and location coordinates
• Order history and preferences
• Payment information (processed by our payment gateway; we do not store full card details)
• Communications with our customer service team

2.2 Information Collected Automatically

• Device information (device type, operating system, browser type)
• IP address and approximate geolocation
• Usage data (pages viewed, features used, timestamps)
• Cookies and similar tracking technologies
• Advertising identifiers and click identifiers (such as Meta's fbclid and browser identifier cookies, and Google's gclid) when you arrive at the Platform from an advertisement

2.3 Information from Third Parties

• Authentication data from one-time password verification (delivered over WhatsApp via Twilio)
• Location and mapping data (via Google Maps)
• Payment confirmation data (via FIUU)
• Delivery status updates (via our delivery partner)

3. Purposes for Which We Use Your Personal Data

We collect and use your personal data for the following purposes:

• To create and manage your account on the Platform;
• To process, confirm, and fulfil your orders;
• To show, in My Orders, your in-store bills from our outlets that are linked to your HakShan membership (date, outlet, items and amount), alongside your online orders;
• To facilitate payment processing through our authorised payment gateway;
• To arrange delivery through our logistics partner and communicate delivery status;
• To communicate with you regarding your orders, account, and customer service enquiries;
• To send you promotional communications, offers, and updates (where you have consented);
• To improve the Platform, analyse usage patterns, and develop new features;
• To measure the performance of our advertising and show you relevant advertisements on third-party platforms (such as Meta and Google), including sharing order events together with hashed contact details and technical identifiers for conversion measurement and audience building;
• To detect, prevent, and address fraud, security incidents, and abuse;
• To comply with legal obligations, respond to lawful requests, and enforce our Terms of Use;
• For any other purpose reasonably related to the above or with your consent.

4. Legal Basis for Processing

We process your personal data on the following legal bases under the PDPA:

• Your consent, which you provide by agreeing to this Privacy Policy and using the Platform;
• Performance of a contract, namely processing your orders and providing the Platform services;
• Compliance with legal obligations under Malaysian law;
• Our legitimate interests in operating, improving, and securing our business, provided these interests are not overridden by your rights and freedoms.

5. Disclosure of Personal Data

We may disclose your personal data to the following categories of third parties, strictly for the purposes described in this Privacy Policy:

5.1 Authorised Outlet Partners

The HakShan Outlet Partner (being a separate Sdn Bhd entity under Horvy Holding Sdn Bhd) that prepares and fulfils your order will receive your name, contact number, delivery address, and order details.

5.2 Service Providers and Data Processors

• FIUU — Payment gateway provider, to process your payment securely;
• Lalamove (Lalamove Malaysia Sdn. Bhd.) — Delivery logistics provider, to fulfil delivery orders;
• Pandago (Delivery Hero Malaysia Sdn Bhd, f.k.a. foodpanda Malaysia Sdn Bhd) — Delivery logistics provider, used only as a manual backup where our primary delivery partner cannot supply a rider;
• Twilio — messaging provider, to deliver login one-time passwords over WhatsApp;
• Google — Maps, geolocation, and address verification; and, where advertising measurement is enabled, analytics and advertising services (Google Analytics 4, Google Tag Manager, and Google Ads conversion tracking);
• Meta Platforms (Facebook/Instagram) — advertising measurement via the Meta Pixel and the Meta Conversions API; where enabled, we share order and browsing events together with hashed identifiers (phone number, email address) and technical data (IP address, browser information, click identifiers) so that Meta can measure ad conversions and build advertising audiences;
• Supabase — Database, authentication, and hosting infrastructure;
• Vercel and Railway — Application hosting and deployment platforms;
• FeedMe — our point-of-sale and membership (CRM) provider: used by Outlet Partners to receive and process orders, and to hold your HakShan membership profile (your HakShan account ID, phone number and name) so your membership is the same online and in our outlets;
• WhatsApp Business — Messaging service for customer notifications (where applicable).

5.3 Legal and Regulatory Disclosures

We may disclose your personal data where required by law, court order, or lawful request from a competent authority, or to protect our rights, property, or safety and that of our users and the public.

5.4 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of our business, your personal data may be transferred to the acquiring entity, subject to confidentiality obligations.

6. Cross-Border Data Transfer

Some of our service providers (such as cloud infrastructure and messaging gateways) may process your personal data on servers located outside Malaysia. Where such transfers occur, we take reasonable steps to ensure that your personal data is protected by a standard of protection comparable to that under the PDPA.

7. Data Retention

We retain your personal data for as long as necessary to fulfil the purposes for which it was collected, including:

• Account data: for as long as your account remains active, plus a reasonable period thereafter;
• Order and transaction records: for a minimum of seven (7) years, in accordance with Malaysian tax and accounting requirements;
• Marketing communications data: until you withdraw your consent or unsubscribe;
• Technical and usage logs: for a reasonable period for security, fraud prevention, and analytics purposes.

After the applicable retention period, we will securely delete or anonymise your personal data.

8. Your Rights Under the PDPA

Subject to the provisions of the PDPA, you have the following rights:

• Right of access: to request a copy of the personal data we hold about you;
• Right of correction: to request correction of inaccurate or incomplete personal data;
• Right to withdraw consent: to withdraw your consent to our processing of your personal data, subject to legal or contractual limitations;
• Right to limit processing: to request that we limit the processing of your personal data for direct marketing purposes;
• Right to lodge a complaint: to lodge a complaint with the Personal Data Protection Commissioner of Malaysia.

To exercise any of these rights, please contact us using the details in Section 13. We may require you to verify your identity before processing your request. A nominal fee may apply for data access requests, as permitted by the PDPA.

9. Data Security

We implement reasonable technical, administrative, and physical safeguards to protect your personal data against unauthorised access, loss, misuse, alteration, or disclosure. These include:

• Encrypted data transmission (HTTPS/TLS) between your device and our servers;
• Secure authentication (one-time password verification);
• Access controls limiting staff access to personal data on a need-to-know basis;
• Regular security reviews of our infrastructure and third-party providers;
• Use of reputable payment gateway providers who comply with PCI DSS standards.

However, no system is completely secure. You are responsible for keeping your account credentials confidential, and you acknowledge that transmission of data over the internet carries inherent risks.

10. Cookies and Tracking Technologies

The Platform uses cookies and similar technologies to:

• Maintain your session and keep you logged in;
• Remember your preferences and cart contents;
• Analyse how the Platform is used, so we can improve it;
• Deliver relevant content and, where applicable, marketing communications.

10.1 Analytics and Advertising Technologies

Where advertising measurement is enabled, the Platform uses Google Tag Manager to load Google Analytics 4, Google Ads conversion tracking, and the Meta Pixel. These services collect information about your visit (pages viewed, items viewed, items added to cart, checkouts started, and purchases completed) together with cookies and identifiers set by Google and Meta, to measure the effectiveness of our advertising and to help us reach relevant audiences.

In addition to browser-based tracking, when you complete a purchase we may also send a confirmation of that purchase to Meta directly from our servers (via the Meta Conversions API), together with hashed contact identifiers and technical data as described in Section 5.2. Because this happens server-to-server, it is not affected by your browser's cookie settings.

10.2 Your Choices

• You can control cookies through your browser settings; disabling cookies may affect the functionality of the Platform;
• You can manage how Meta uses data to show you ads via your Facebook/Instagram Ad Preferences settings;
• You can manage Google's ad personalisation at myadcenter.google.com and opt out of Google Analytics via the Google Analytics Opt-out Browser Add-on;
• You may also contact us under Section 13 to limit the processing of your personal data for direct marketing purposes.

11. Children's Privacy

The Platform is not intended for use by individuals under the age of 18 without the consent of a parent or legal guardian. We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child without parental consent, we will delete such data.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. Material changes will be notified via the Platform or by email/SMS to registered users. The "Effective Date" at the top of this Policy indicates when it was last updated.

13. Contact Us

If you have questions about this Privacy Policy, wish to exercise your rights, or have a complaint regarding our handling of your personal data, please contact our Data Protection Officer at:

If you are not satisfied with our response, you may lodge a complaint with the Personal Data Protection Commissioner of Malaysia (Jabatan Perlindungan Data Peribadi) at www.pdp.gov.my.