Privacy Policy

JoySaves Seller is operated by JoySaves Sdn Bhd. We're the data controller for the personal information you provide through this platform. This policy explains what we collect and what we do with it, in line with the Personal Data Protection Act 2010 (PDPA) of Malaysia.

Depending on how you use the service, we collect:

• Account information — email, password (hashed), phone, display name, profile photo.
• Business information — company name, SSM number, business address, bank details for payouts.
• Identity & verification documents — uploaded IC / passport, SSM certificate, bank statement, business licence, etc.
• Product & catalogue information — listings, prices, photos, certifications.
• Usage data — IP address, browser, pages visited, actions taken (for security, analytics and product improvement).

We use your information to:

• Set up your JoySaves Seller account and review your application.
• Forward approved applications and product data to the JoySaves marketplace and related local-lifestyle modules.
• Send transactional notifications (status updates, password resets, approval letters).
• Detect and prevent fraud, abuse and security incidents.

We share information only when needed:

• JoySaves — your approved application and ongoing transactional data flows to JoySaves so your shop / services can go live.
• Service providers — hosting, file storage (MinIO/S3), email delivery, payment processing. They access data only to provide the service.
• Authorities — when required by law, court order, or to protect rights and safety.

Account and application data are kept while your account is active, plus a reasonable period after closure for legal, audit and tax requirements (typically up to 7 years for financial records under Malaysian law).

Identity documents are kept only as long as needed for verification, then archived under restricted access.

Under the PDPA you have the right to:

• Access the personal information we hold about you.
• Request correction of inaccurate or incomplete data.
• Withdraw consent (note: this may end your ability to use the service).
• Lodge a complaint with the Personal Data Protection Commissioner.

To exercise any of these rights, email privacy@joysaves.com.

We use industry-standard measures: TLS-encrypted connections, hashed passwords (bcrypt), HttpOnly cookies for sessions, role-based access controls and audit logs. No system is perfectly secure, but we take it seriously.

We use cookies for authentication, language preference, and basic analytics (Google Analytics, Meta Pixel). You can disable non-essential cookies in your browser settings.

If we make material changes we'll notify you by email or an in-app banner. The "last updated" date at the top reflects the most recent revision.