Privacy Policy

1. Introduction

This Privacy Policy explains how WA COMM MALAYSIA SDN. BHD. (“WA COMM”, “we”, “us”, or “our”) collects, uses, discloses, stores, transfers, and otherwise processes personal data through waly.com.my and related services, platforms, systems, customer support channels, and communications (collectively, the “Services”).

This Privacy Policy is provided in compliance with the Personal Data Protection Act 2010 of Malaysia (“PDPA”) and any applicable amendments, subsidiary legislation, guidelines, or directions issued by the relevant authority from time to time. It should be read together with our Terms & Conditions, which govern product orders, production, refunds, liabilities, and other commercial terms.

Our business details are as follows:

Company: WA COMM MALAYSIA SDN. BHD.
Registration No.: 202501043019 (1644427-A)
Address: 33, Tingkat Satu, Medan Desa Aman, Kg Koh, 32000 Sitiawan, Perak, Malaysia
Email: [email protected]

By accessing or using the Services, submitting your personal data to us, placing an order, creating an account, topping up wallet credit, contacting us, or otherwise interacting with us, you acknowledge that your personal data may be processed in accordance with this Privacy Policy.

2. Scope of This Privacy Policy

This Privacy Policy applies to personal data processed by us in connection with:

website visits and browsing;
account registration and account management;
quotation requests and order placement;
artwork uploads and production-related communication;
wallet top-ups and payment processing;
delivery, collection, and after-sales support;
enquiries, complaints, and customer service;
marketing, advertising, promotions, and business development; and
legal, regulatory, tax, security, and operational compliance.

This Privacy Policy does not govern third-party websites, apps, or services that may be linked to or integrated with our Services, including payment gateways, courier tracking pages, social media platforms, or other external websites. Those third parties may have their own privacy notices and policies.

3. Types of Personal Data We May Collect

We may collect, use, disclose, store, and process personal data including, where applicable:

3.1 Identity and Contact Data: Name, company name, trading name, NRIC number, passport number, or other identification details where legally or operationally required, email address, mobile number, telephone number, billing address, delivery address, pickup contact details, and other contact information provided to us.
3.2 Business and Tax Data: Company registration number, tax identification number (TIN), SST registration details, e-invoicing information, billing information, and other business information required for transactions, invoicing, or compliance.
3.3 Account and Wallet Data: Username or account login details, account preferences, order history, wallet balance, wallet top-up records, transaction references, and account activity logs.
3.4 Transaction and Payment Data: Order amount, payment status, payment method, transaction date and time, and payment gateway references. (For the avoidance of doubt, full credit card numbers or sensitive banking credentials are processed directly by our secure payment gateway providers. While we do not store full payment credentials on our servers, we may retain limited payment-related information to the extent necessary for payment verification, refund processing, or dispute resolution).
3.5 Artwork, Upload, and Content Data: Files, artwork, designs, spreadsheets, lists, images, names, phone numbers, addresses, photographs, logos, or other content uploaded by you; instructions, remarks, notes, and production-related communication; and any personal data contained within uploaded files or artwork.
3.6 Technical and Usage Data: IP address, browser type, device information, operating system, pages viewed, access dates and times, referring URLs, session information, cookies and similar technologies, and website interaction data.
3.7 Communication and Support Data: Emails, chat messages, call records or notes, complaint details, support requests, service team communication history, and survey or feedback responses.
3.8 Marketing Data: Subscription preferences, campaign response data, promotional participation data, and communication preferences.
3.9 Sensitive Personal Data: Under Malaysian law, sensitive personal data includes information relating to physical or mental health, political opinions, religious beliefs, or the commission of offences. We do not intentionally request sensitive personal data unless it is necessary and lawful for a specific purpose. Where you choose to submit sensitive personal data, whether in forms, messages, or uploaded files, you represent that you are lawfully entitled to do so and, where required, that you have obtained the relevant express consent.

4. Sources of Personal Data

We may obtain your personal data from one or more of the following sources:

directly from you when you register, place orders, upload files, make payments, or contact us;
automatically through your use of the website and cookies or similar technologies;
from your employer, company, colleagues, agents, or authorised representatives;
from payment gateway providers, logistics providers, installers, vendors, or service providers involved in fulfilling your transaction;
from public sources, social media, or business directories where lawful and relevant;
from referrals, enquiries, sales leads, or commercial introductions; and
from any other lawful source connected with our business relationship with you.

5. Purposes of Processing Personal Data

We may process your personal data for one or more of the following purposes:

to create, administer, and maintain your account;
to verify your identity or authority to act;
to provide quotations, products, and services;
to process orders, payments, wallet top-ups, refunds, reprints, and related transactions;
to review uploaded files for basic technical handling;
to communicate with you regarding artwork issues, previews, order status, delivery, claims, or customer support;
to arrange shipment, pickup, delivery, or collection;
to issue invoices, e-invoices, credit notes, debit notes, receipts, statements, and tax-related documents;
to comply with legal, tax, audit, regulatory, and enforcement obligations;
to manage complaints, disputes, investigations, or claims;
to secure our website, systems, and business operations;
to prevent fraud, abuse, unauthorised access, chargeback abuse, or policy misuse;
to improve our website, products, workflow, and customer experience;
to carry out internal administration, analytics, reporting, and record keeping;
to send service-related notices or operational updates; and
subject to applicable law and your choices, to send marketing, promotional, product, or business communications.

6. When Supplying Personal Data Is Necessary

Certain personal data is necessary for us to provide you with products or services, process your order, deliver your goods, comply with tax or legal requirements, or respond to your request. If you do not provide the required personal data, we may be unable to:

create or maintain your account;
process your order or payment;
issue invoices or e-invoices properly;
arrange delivery or pickup;
communicate with you about production issues; or
provide support, refunds, reprints, or other services.

7. Disclosure of Personal Data

We do not sell your personal data as a standalone product. We may disclose your personal data to third parties where necessary for the purposes described in this Privacy Policy, including:

payment gateway providers and payment processors;
banks and financial institutions;
courier companies, transport providers, delivery partners, and pickup handlers;
cloud storage, hosting, website, IT, software, and system service providers;
email, messaging, CRM, analytics, and communication service providers;
production vendors, installers, subcontractors, or other service providers engaged in fulfilment;
auditors, accountants, tax agents, lawyers, consultants, insurers, and professional advisers;
government agencies, regulators, enforcement bodies, courts, tribunals, or authorities where required or authorised by law;
any buyer, investor, successor, assignee, or transferee in connection with a merger, restructuring, sale, financing, acquisition, or disposal of business or assets; and
such other parties as you may authorise or as may be reasonably necessary in connection with our business relationship with you.

8. Personal Data in Uploaded Files and Third-Party Data

You may upload artwork, name lists, contact lists, photographs, stickers, signboard content, databases, spreadsheets, or other materials that contain personal data of third parties. Where you provide us with any personal data relating to another individual, you represent and warrant that:

you have lawfully collected that personal data;
you are authorised to disclose it to us;
you have provided any required notices; and
you have obtained any necessary consent or other lawful basis required under applicable law, including the PDPA, before providing such data to us.

We are not responsible for independently verifying the legality, authenticity, ownership, or source of personal data contained in files or content submitted by you.

9. Cookies and Similar Technologies

Our website may use cookies, pixels, tags, scripts, local storage, and similar technologies to operate core website functions, remember preferences and login states, keep your session secure, analyse website traffic, improve functionality, and support advertising and remarketing where applicable. You may disable or manage cookies through your browser or device settings. However, doing so may affect website functionality, user experience, or certain features of the Services.

10. Marketing and Promotional Communications

Where lawful and appropriate, we may use your personal data to send you updates regarding new products or services, price lists, promotional campaigns, seasonal offers, business opportunities, or operational updates. You may opt out of marketing communications at any time by following the unsubscribe instructions in the communication, contacting us directly, or otherwise informing us that you no longer wish to receive such communications.

Please note that even if you opt out of marketing communications, we may still send you service-related communications necessary for account administration, order processing, legal compliance, or operational purposes.

11. Cross-Border Transfer of Personal Data

Your personal data may be stored on servers located in Malaysia or outside Malaysia, or processed by service providers operating in other jurisdictions, where such transfer, storage, or processing is necessary for our operations, systems, hosting, communications, analytics, payment processing, or business administration. Any cross-border transfer of your personal data will only be conducted where permitted by applicable law. In such cases, we will implement reasonable protective measures to ensure that your personal data continues to receive a standard of protection comparable to the requirements under Malaysian law.

12. Security of Personal Data

We take practical and reasonable steps to protect personal data from loss, misuse, unauthorised or accidental access, disclosure, alteration, destruction, or other similar risks. Such steps may include restricted access controls, password protections, secure systems and hosting arrangements, and vendor management. However, no system or transmission method can be guaranteed to be completely secure. You acknowledge that internet-based services always carry some inherent security risk.

13. Retention of Personal Data

We will retain personal data only for as long as is reasonably necessary for the purposes for which it was collected, or as required or permitted by applicable law, contractual needs, tax requirements, audit needs, dispute handling, enforcement, or legitimate operational purposes. For example:

account and transaction data may be retained for accounting, tax, audit, and legal purposes;
support and complaint records may be retained for service, dispute, and quality purposes;
uploaded artwork and production files may be retained only for a limited operational period and may be deleted thereafter. (This Privacy Policy should be read together with our Terms & Conditions, which separately explain that artwork and production files are not kept as a long-term file storage service).

14. Your Rights as a Data Subject

Subject to applicable law, you may have the right to:

request to know whether your personal data is being processed;
request access to your personal data;
request correction of your personal data if it is inaccurate, incomplete, misleading, or outdated;
withdraw consent to certain processing where processing is based on consent;
request that direct marketing communications stop; and
object or request prevention of certain processing that may cause damage or distress, where recognised by law.

To exercise any of these rights, you may contact us using the contact details in Section 18 below. We may require you to verify your identity and provide sufficient information to process your request. We may also charge a reasonable administrative fee where permitted by law for access requests.

15. Accuracy of Information

You are responsible for ensuring that the personal data you provide to us is accurate, complete, not misleading, and kept reasonably up to date. If there is any change to your personal data, such as your company name, phone number, email address, billing address, delivery address, tax details, or authorised contact person, you should notify us promptly.

16. Children

Our Services are generally intended for business users, general customers, and persons capable of entering into transactions with us. We do not knowingly provide Services directly to minors (children under the age of 18) without appropriate involvement of a parent, guardian, school, organisation, or other authorised person where required. If you believe that personal data of a child has been improperly provided to us, please contact us so that we can review the matter.

17. Changes to This Privacy Policy

We reserve the right to amend, update, vary, or replace this Privacy Policy at any time. The updated version will be published on our website with the revised “Last Updated” date. Your continued use of the Services after the updated version is published constitutes your acknowledgement of the updated Privacy Policy to the extent permitted by law.

18. Contact, Requests, and Complaints

For any questions, requests, corrections, complaints, or notices relating to this Privacy Policy or your personal data, please contact us at:

WA COMM MALAYSIA SDN. BHD.

Email: [email protected]
Address: 33, Tingkat Satu, Medan Desa Aman, Kg Koh, 32000 Sitiawan, Perak, Malaysia

When contacting us, please provide sufficient information to allow us to identify you, understand your request, and respond appropriately. You also have the right to lodge a complaint with the Personal Data Protection Commissioner of Malaysia (JPDP) if you believe your personal data has been processed in breach of applicable law.

19. Language

This Privacy Policy is issued in both English and Bahasa Melayu in compliance with the Personal Data Protection Act 2010 of Malaysia. In the event of any inconsistency or conflict between the English version and the Bahasa Melayu version, the English version shall prevail.