Privacy policy
Last Updated: 20 August 2026
Welcome to Sub Store ("we," "us," or "our"). We value your privacy and are committed to protecting your personal data in accordance with the Personal Data Protection Act 2010 ("PDPA"), the Personal Data Protection (Amendment) Act 2024, and any applicable regulations or guidelines issued by the Personal Data Protection Commissioner.
This Privacy Policy explains how we collect, use, disclose, store, and protect your personal data when you visit our website at SubStore. (the "Site"), create an account, make a purchase, or otherwise interact with us.
By accessing or using our Site, or by providing your personal data to us, you acknowledge that you have read and understood this Privacy Policy.
1. Personal Data We Collect
Depending on how you interact with us, we may collect the following categories of personal data:
Identity & Contact Information
• Full name
• Email address
• Mobile or telephone number
• Billing address
• Shipping address
Account Information
If you create an account with us, we may collect:
• Username
• Password (stored securely in encrypted form)
• Account preferences
• Saved addresses
• Wishlist information
Order & Transaction Information
• Products purchased
• Order history
• Delivery instructions
• Payment status
• Refunds and exchanges
Please note: We do not store your full credit card or debit card details. Payments are securely processed by our authorised third-party payment gateway providers.
Technical Information
When you browse our Site, we may automatically collect:
• IP address
• Browser type
• Device type
• Operating system
• Cookies
• Website usage information
• Pages viewed
• Referral source
• Date and time of visits
Communications
When you contact us, we may collect:
• Customer service enquiries
• Emails
• Live chat messages
• Social media messages
• Feedback
• Reviews
We do not knowingly collect sensitive personal data (such as information relating to health, religion, political opinions, biometric data or other special categories of personal data) unless required by law or with your explicit consent.
2. How We Collect Your Personal Data
We collect personal data when you:
• Place an order
• Create an account
• Subscribe to our newsletter
• Contact customer support
• Submit enquiries
• Participate in promotions or giveaways
• Leave reviews
• Browse our Site
• Accept cookies
• Interact with us on social media
• Communicate with us through messaging platforms
We may also receive limited personal data from trusted third-party service providers where necessary to complete your transactions.
3. How We Use Your Personal Data
We use your personal data for legitimate business purposes, including to:
• Process and fulfil your orders
• Verify your identity
• Deliver purchased products
• Process payments
• Process refunds and exchanges
• Provide customer support
• Send order confirmations
• Send shipping updates
• Manage warranties (where applicable)
• Maintain your customer account
• Improve our products and services
• Personalise your shopping experience
• Detect and prevent fraud
• Protect our business from unauthorised activities
• Conduct internal analytics
• Improve website functionality
• Comply with legal and regulatory obligations
• Respond to law enforcement requests where legally required
Where permitted by law and with your consent where required, we may also send promotional communications about new products, campaigns, offers, events and newsletters.
You may unsubscribe from marketing communications at any time by clicking the "Unsubscribe" link in our emails or by contacting us directly.
4. Legal Basis for Processing
We process your personal data where:
• you have provided your consent;
• processing is necessary to perform a contract with you (such as fulfilling your order);
• processing is necessary to comply with legal obligations; or
• processing is necessary for our legitimate business interests, provided such interests do not override your rights under applicable law.
5. Disclosure of Personal Data
We may disclose your personal data to trusted third parties only where necessary, including:
• Payment gateway providers
• Banks and payment processors
• Courier and logistics companies
• Warehousing partners
• IT service providers
• Website hosting providers
• Cloud storage providers
• Analytics providers
• Email marketing providers
• Customer support platforms
• Professional advisers
• Auditors
• Government authorities
• Regulatory bodies
• Law enforcement agencies where required by law
All third-party service providers are required to process personal data responsibly and only for authorised purposes.
We do not sell, rent or trade your personal data to third parties.
6. International Transfers of Personal Data
Some of our service providers may be located outside Malaysia.
Where your personal data is transferred outside Malaysia, we take reasonable steps to ensure appropriate safeguards are implemented, including ensuring the recipient provides a comparable level of protection or that the transfer is otherwise permitted under applicable law.
7. Cookies and Similar Technologies
Our Site uses cookies and similar technologies to:
• keep you signed in
• remember your preferences
• improve website performance
• analyse website traffic
• understand customer behaviour
• personalise your shopping experience
• measure advertising effectiveness (where applicable)
The cookies we use may include:
• Essential Cookies
• Functional Cookies
• Analytics Cookies
• Performance Cookies
• Marketing Cookies (where applicable)
You may disable cookies through your browser settings. However, some features of the Site may not function properly if cookies are disabled.
8. Marketing Communications
With your consent where required by law, we may send promotional emails, newsletters, exclusive offers, product launches and marketing updates.
You may withdraw your consent at any time by:
• clicking the unsubscribe link in our emails;
• updating your account preferences; or
• contacting us using the details below.
Withdrawing your consent will not affect communications relating to existing orders or legal obligations.
9. Data Retention
We retain your personal data only for as long as reasonably necessary to:
• fulfil the purposes described in this Privacy Policy;
• comply with legal obligations;
• resolve disputes;
• enforce agreements;
• maintain appropriate business records.
When personal data is no longer required, it will be securely deleted, anonymised or destroyed.
10. Data Security
We implement appropriate technical, administrative and organisational measures designed to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised access, disclosure or misuse.
These measures may include:
• Secure Socket Layer (SSL) encryption
• Password protection
• Restricted staff access
• Secure payment processing
• Firewalls
• Regular security monitoring
• Data backup procedures
While we strive to protect your personal data, no method of transmission over the Internet or electronic storage is completely secure. Accordingly, we cannot guarantee absolute security.
11. Your Rights
Subject to applicable law, you may have the right to:
• request access to your personal data;
• request correction of inaccurate or incomplete personal data;
• withdraw consent where processing is based on consent;
• request that we cease or limit certain processing activities where permitted by law;
• request information regarding how your personal data has been used;
• request data portability where applicable under future regulations.
Before processing your request, we may ask you to verify your identity.
Certain requests may be subject to legal exceptions or administrative fees as permitted by law.
12. Personal Data Breach
If a personal data breach occurs that is likely to result in significant harm to affected individuals, we will take appropriate action, including notifying the Personal Data Protection Commissioner and affected individuals where required under applicable law.
13. Third-Party Websites
Our Site may contain links to third-party websites or services.
We are not responsible for the privacy practices, security or content of those third-party websites. We encourage you to review their privacy policies before providing any personal data.
14. Children's Privacy
Our Site is intended for individuals aged 18 years and above.
We do not knowingly collect personal data from children under 18 years of age without appropriate parental or guardian consent where required by law.
If you believe a child has provided personal data to us, please contact us so that we may promptly remove such information.
15. Business Transfers
In the event of a merger, acquisition, restructuring, sale of assets or other business transaction, your personal data may be transferred as part of that transaction, subject to applicable data protection laws.
16. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our business operations, technology, legal requirements or regulatory guidance.
The revised version will be posted on this page together with the updated "Last Updated" date.
Your continued use of our Site after any updates constitutes your acceptance of the revised Privacy Policy.
17. Contact Us
If you have any questions, concerns or requests relating to this Privacy Policy or how we handle your personal data, please contact us.
Sub Store
Email: stirringupborneo@gmail.com
Registered Business Address: 242E Lorong Green No3, Jalan Green, 93150 Kuching, Sarawak, Malaysia
If you remain dissatisfied with our response, you may lodge a complaint with the relevant Malaysian regulatory authority responsible for administering the Personal Data Protection Act.