This Personal Data Protection Policy (“Policy”) provides information on the obligations and policies of Bluebell Marketing (M) Sdn Bhd (the “Company”, “we” or “us”) and its affiliated organisations (each an “affiliated organisation” and collectively, the “Group”) under the Malaysia Personal Data Protection Act 2010.

The Policy is designed to assist you in understanding how we collect, use and safeguard the personal data you provide to us and to assist you in making informed decisions when using the Bluebell Web site, our products and services. We endeavor to continuously assess our privacy practices in light of new technologies, business practices and our customers’ needs. Our Policy may therefore be amended from time to time. You should check our Policy regularly to ensure you are aware of our latest policies.

The Company’s officers, management, and members of staff shall, at all times, respect the confidentiality of and endeavor to keep safe any and all personal data collected and/or stored and/or transmitted and/or used for, or on behalf of, the Company.

For the purpose of this Policy, “Personal Data” is any information related directly or indirectly to an individual who is identified or identifiable from that information or from that and other information that the Company possesses.

By using the Bluebell Web site and/or enrolment in the Bluebell CRM and/or Loyalty Programs, you consent to our collection and use of your Personal Data as described and notified to you in this Policy. If we shall change our privacy policies and procedures, they will be posted on the Bluebell Web site to keep you aware of the changes and what information we collect, how we use it and under what circumstances we may disclose it.

For the purpose of carrying on the Company’s business, including registration and related products and services (including relevant online services), you may be requested to provide Personal Data such as, but not limited to, the following, without which it may not be possible to satisfy your request, as such processing is necessary for the Company to provide you with the products and services:

You also have the option to provide certain data that may be used to further improve our products and services and/or better tailor the type of information presented to you. Your consent will be sought for such processing and you will still be able to use the Company’s services even if you do not give your consent for such processing purposes.

However, where you have requested a personalized service, or the provision of a product is dependent on your providing all necessary Personal Data to provide such personalised service, failure to provide the requested Personal Data may prevent us from providing the service to you. This type of Personal Data includes, but is not limited to:

In support of the services offered by the Company, other information which are not Personal Data may be automatically collected relating to those services so we may perform accurate reporting and administration of your accounts.

The Company’s web servers may also collect data relating to your online session, the use of which is to provide aggregated, anonymous, statistical information on the server’s usage so that we may better meet the demands and expectations of visitors to our sites. This type of data may include, but is not limited to:

Your personal data is collected either directly from you (e.g., when you create an account on our websites/apps or make a purchase or otherwise interact with our sales team in stores or through our Customer Service representatives), or from you passively (e.g., when using tracking tools like browser cookies), or from third parties (e.g. through social media platforms) to the extent permitted by applicable law.

Generally, we collect, use and disclose your Personal Data for purposes of administering our business activities, providing customer service and making available other products and services to our customers and prospective customers. We collect, use and disclose your Personal Data where:

The main proposes for which your Personal Data may be used by us are:

Your Personal Data may also be used for the following marketing purposes:

We will not contact you for marketing purposes unless you have provided your express consent.

You may withdraw consent for our use of your Personal Data, by sending your request in writing to the email stipulated in the Annex. If the withdrawal of your consent makes us unable to provide certain products and services to you, we will notify you of this.

If you wish to unsubscribe from any emails from us, such as marketing or promotional material, please click Unsubscription link included in every message.

We use cookies in order to improve your navigation experience when you visit the website of Bluebell. Cookies are small pieces of information that your web browser stores on your computer when you visit a website. Our cookies let us personalize your visits to Bluebell Web site and recognize you when you return. Information collected from these cookies may be used for the purposes laid out above in this Policy.

Most browsers automatically accept cookies. You can disable cookies on your computer by indicating this in the preferences or options menus in your browser. We recommend you do this if you are concerned about receiving cookies.

Please note that the Bluebell Web site contains links to other sites and occasionally allows other sites to be co-branded with the Bluebell Web site. Please remember that when you use a link to go from our Website to another Web site or when you use a co-branded site, this Policy is no longer in effect. Your browsing and interaction on any other Web site, including Web sites that have a link to the Bluebell Web site, is subject to that Web site’s own rules and policies which may differ from that of the Bluebell Web site.

We are not responsible for the practices employed by websites linked to or from our Website nor the information or content contained therein. Often links to other websites are provided solely as pointers to information on topics that may be useful to the users of our Website.

The Company will take reasonable steps to ensure that all information we collect, use or disclose is accurate, complete, up-to-date and stored in a secure environment accessible only to our authorised employees and contractors. However, we give no warranty against third parties hacking into the data or any unauthorised access to the data by anyone.

When the Company has credible grounds to believe that a data breach has occurred, it will notify the Personal Data Protection Commission if the breach is likely to result in significant harm to the individuals whose Personal Data is affected by the breach; or is of a significant scale (at least 500 individuals). If your Personal Data has been affected, and the breach is likely to result in significant harm to you, the Company will notify you of this breach, unless certain exceptions apply, which includes but is not limited to a situation where the Company has already taken remedial action such that no significant harm is likely to be caused, or if appropriate technological measures have already been applied to the Personal Data.

The Company will give you access to your own Personal Data upon your request, and you may also request for information on the ways your Personal Data has been used or disclosed by the Company within a year before the date of your request. The Company will then consider your request and inform you if your request is granted. If your request is refused, the Company will inform you accordingly, and will specify the reasons for such refusal. If your Personal Data is no longer within the possession of the Company, we will not be able to process your request and will inform you as such. The Company reserves the right to impose a fee to process a request for access to your Personal Data.

You may also submit a request to correct any inaccuracies or incompleteness in your Personal Data. The Company will endeavour to correct the Personal Data as soon as reasonably practicable. No fees will be charged for correcting any inaccuracies in your Personal Data.

You may send in such requests in writing to the email stipulated in the Annex.

We retain Personal Data for as long as reasonably necessary to fulfill the purpose for which it is being collected, save where is otherwise permitted by law.

All Personal Data held by the Company will be kept confidential and protected but the Company may, where such disclosure is necessary to satisfy the purpose, or a directly related purpose, for which the data was collected provide such information to the following parties:

You should also note that the privacy protection as set out in this Privacy Statement does not apply to personal data which is passed to third parties, and we are not responsible for the protection of your personal data or lack thereof by such third parties.

Except as otherwise provided in this Policy, Personal Data about you as an individual subscriber will not be provided to any third party without your consent. Where Personal Data has been provided to a third party with your consent, and has been transferred outside of Malaysia, we will ensure that the overseas third-party recipient is legally obligated to protect your Personal Data to a standard of protection that is comparable to that under the PDPA, or if the former is not possible, we will provide you with a summary of how the extent to which your Personal Data which has been transferred overseas will be protected to a standard comparable to the protection under the PDPA.

Personal data may also be disclosed to any person or persons that have a right to gain access to such information provided they are able to prove their authority to access such information. For example, if the Company were served with a court order demanding certain customer information then the Company would disclose the information to the duly appointed officer of the court or such other persons as the court orders.