Privacy and Cookie Policy
This Privacy Policy explains how Tong Garden Food Sdn. Bhd. ("Tong Garden", "we", "us") collects and uses your personal data when you use shop.tonggarden.com.my, our mobile pages, customer support and membership programme (the "Platform").
This Privacy Policy is a companion to, and should be read together with, our Terms and Conditions. Our company’s registration number, SST/tax ID and general customer-service contact are set out in the Terms and Conditions and are not repeated here.
We are the Data User for your personal data under the Personal Data Protection Act 2010, as amended by the Personal Data Protection (Amendment) Act 2024 ("PDPA").
- Registered office: 32, Jalan Mega 1, Taman Perindustrian Nusa Cemerlang, 79200 Iskandar Puteri, Johor
- Privacy contact: enquiry@tonggarden.com.my · 016-7105346
1. LAWS WE FOLLOW
We process personal data in line with the Personal Data Protection Act 2010 and its 2024 amendment; the Consumer Protection Act 1999; and the Consumer Protection (Electronic Trade Transactions) Regulations 2012. This policy applies to personal data we collect in digital form, or collect offline and later digitize.
2. WHAT WE COLLECT AND WHY
We collect only what we need for the purposes below.
Personal data | Purpose |
Name, mobile number, email address | Create and manage your account; send order and delivery updates; customer support |
Delivery and billing address | Deliver orders; issue receipts/invoices |
Order history, cart and wishlist | Process orders, returns and refunds; show your past orders |
Payment status and transaction reference | Confirm payment and process refunds. Card, e-wallet and bank details are entered directly with our payment gateway; we do not store them |
Date of birth, gender (optional) | Birthday offers and membership benefits, only if you choose to provide them |
Membership points and rewards | Run the loyalty programme |
Messages, calls, reviews and feedback | Resolve complaints and improve products |
Device, browser, IP address, pages viewed, cookies | Keep the Platform secure, prevent fraud, fix errors, and (with consent) analytics and advertising |
Marketing preferences | Send offers by email, SMS, WhatsApp or other channels, only if you opt in |
We do not collect more data than needed for these purposes and will ask for fresh consent before using your data for any new purpose.
3. YOUR CONSENT
We process your personal data on the basis of your consent, given by a clear action such as ticking a box or tapping "I agree", or because processing is necessary to perform your order contract or to comply with Malaysian law. Marketing communications and non-essential cookies have their own separate opt-ins, and you can use the Platform without agreeing to them.
You can withdraw consent at any time, as easily as you gave it, from My Account > Privacy settings or by writing to enquiry@tonggarden.com.my. Withdrawal does not affect processing already done. If you withdraw consent needed for an order, we may be unable to complete it.
4. WHO WE SHARE DATA WITH
We do not sell your personal data. We share it only with:
- Service providers (Data Processors) acting on our instructions under a written contract: payment gateways , courier and logistics partners, SMS/email/WhatsApp providers, customer support tools, and analytics providers.
- Government agencies and courts, when required by Malaysian law.
Each processor may use your data only to provide its service to us.
5. COOKIES AND SIMILAR TECHNOLOGIES
We use cookies to run the Platform.
- Essential cookies keep you logged in and remember your cart. These are always on.
- Analytics cookies help us understand how the Platform is used. These are on only with your consent.
You can change your choice at any time through [Cookie settings] at the bottom of every page, or through your browser.
6. HOW LONG WE KEEP YOUR DATA
We keep personal data only while it is needed for its purpose, then erase or anonymize it unless the law requires us to keep it.
Data | Retention |
Account data | While your account is active. If there is no activity for 3 years, we will erase it after giving you notice |
Orders and tax records | 7 years, to meet Income Tax Act record-keeping rules |
Marketing preferences | Until you withdraw consent |
Support records | 2 years after the issue is closed |
Security and access logs | 1 year |
7. HOW WE PROTECT YOUR DATA
We use reasonable security safeguards, including encryption in transit (HTTPS/TLS), encryption or masking of stored data where appropriate, role-based access controls, access logging and monitoring, and regular backups. Our processors must maintain equivalent safeguards.
If a personal data breach occurs that is likely to cause significant harm, we will notify the Personal Data Protection Commissioner as soon as practicable and, where feasible, within 72 hours of becoming aware, and will notify affected individuals within 7 days after that report, explaining what happened, the likely impact, and what you can do.
8. YOUR RIGHTS
Under the PDPA you can:
- Access a copy of the personal data we hold about you.
- Correct inaccurate or incomplete data.
- Withdraw consent, or object to processing that is likely to cause you damage or distress.
- Object to your data being used for direct marketing.
- Request data portability, where technically possible (introduced by the 2024 amendment).
- Complain to the Personal Data Protection Commissioner if you believe we have not complied with the PDPA.
To use these rights, go to My Account > Privacy or email enquiry@tonggarden.com.my. We may ask you to verify your identity and may charge a prescribed fee for an access request, as permitted under the PDPA. We aim to respond within 21 days.
9. MINORS
The age of majority in Malaysia is 18 under the Age of Majority Act 1971. The Platform is meant for adults; a person under 18 may use it only with the involvement of a parent or legal guardian, who is responsible for any order placed. If you believe a minor’s data reached us without appropriate consent, contact us and we will delete it.
10. DATA STORED OUTSIDE MALAYSIA
Some service providers may store or process data outside Malaysia. Where we transfer personal data abroad, we take reasonable steps to ensure it receives protection comparable to the PDPA, in line with section 129 of the Act.
11. CHANGES TO THIS POLICY
We may update this policy when our practices or the law change. We will post the new version here with a new "Last updated" date. For material changes, we will notify you by email or on the Platform and ask for fresh consent where required.
12. CONTACT US
For any complaint or question about your personal data, please contact the privacy contact above, or the customer-service contact published in our Terms and Conditions. You may also complain to the Personal Data Protection Commissioner of Malaysia.