隐私与个人资料保护通知
Privacy & Personal Data Protection Notice
1. 我们收集的资料 · Information we collect
我们可能收集姓名、邮箱、电话号码、头像、收货地址、账户登录资料、购物车、订单与付款状态、客服对话、语言偏好、设备与网站使用信息。支付卡资料由付款服务商直接处理，我们不会保存完整卡号。 We may collect your name, email, phone number, profile photo, delivery addresses, account credentials, cart, orders and payment status, client-care messages, language preferences, device and site-usage information. Payment card details are handled directly by the payment provider; we do not store full card numbers.
2. 使用目的 · Why we use it
资料用于创建及保护账户、邮箱验证、同步购物车、处理订单与配送、提供客服、找回或更改密码、防止欺诈、改善网站，以及在你选择接收时发送品牌资讯。 We use data to create and secure accounts, verify email, sync carts, process orders and delivery, provide support, recover or change passwords, prevent fraud, improve the site and send brand updates only where you choose to receive them.
3. 分享与境外处理 · Sharing and international processing
仅在提供服务所需范围内向基础设施、邮件、支付、储存、分析与配送服务商披露资料，例如 OpenAI Sites/Cloudflare、Resend、PayPal 及相关物流服务商。部分处理可能发生在马来西亚境外，并采用合理保护措施。 We disclose data only as needed to infrastructure, email, payment, storage, analytics and delivery providers, including OpenAI Sites/Cloudflare, Resend, PayPal and relevant delivery partners. Some processing may occur outside Malaysia with reasonable safeguards.
4. Cookies 与本机储存 · Cookies and local storage
我们使用安全登录 Cookie 维持会话，并使用本机储存保存访客购物车、语言及未登录客服会话。登录后，账户资料会安全同步至云端。 We use a secure sign-in cookie to maintain your session and local storage for guest carts, language and pre-login support sessions. After sign-in, account data is securely synchronised to the cloud.
5. 保存期限 · Retention
我们只在完成上述目的、履行订单、处理争议、满足税务会计及法律要求所需期间保存资料。验证码与安全链接会自动失效；不再需要的资料会删除或匿名化。 We retain data only as long as needed for the purposes above, order fulfilment, dispute handling, tax/accounting and legal requirements. Verification codes and secure links expire automatically; data no longer required is deleted or anonymised.
6. 安全措施 · Security
密码采用加盐哈希保存而非明文；会话 Cookie 使用 HttpOnly、Secure 与 SameSite；访问、地址、订单及客服会话均在服务器端验证账户所有权。尽管我们采用合理保护措施，任何网络服务都无法保证绝对安全。 Passwords are stored as salted hashes, not plaintext; session cookies use HttpOnly, Secure and SameSite; ownership of profiles, addresses, orders and support conversations is checked server-side. While reasonable safeguards are used, no online service can guarantee absolute security.
7. 你的权利 · Your rights
你可以查询、更正个人资料，撤回非必要处理或营销同意，要求停止直接营销，并在适用法律允许范围内要求删除资料或关闭账户。某些订单与交易记录可能因法律或争议处理需要继续保留。 You may request access or correction, withdraw optional processing or marketing consent, object to direct marketing and request deletion or account closure where permitted by law. Certain order and transaction records may be retained for legal or dispute purposes.
8. 联系我们 · Contact us
如需行使资料权利、关闭账户或提出隐私问题，请通过网站右下角 Client Care 客服联系，并使用账户注册邮箱验证身份。 To exercise your rights, close an account or raise a privacy concern, contact Client Care through the website and use your registered email to verify your identity.
9. 法律与更新 · Law and updates
本通知参考马来西亚《2010 年个人资料保护法令》（Act 709）及其后续修订。我们可能更新本通知，并在本页注明更新日期；重大变更会以合理方式通知。 This notice is informed by Malaysia’s Personal Data Protection Act 2010 (Act 709), as amended. We may update it and show the revision date here; material changes will be communicated reasonably.
本页面为网站营运说明，不构成针对任何个人情况的法律意见。 This page describes website operations and is not individual legal advice.