Privacy Policy

This policy covers personal data processed through the O2O Platform — the private operations system through which we run our catalog, stock, orders, deliveries and invoicing with our appointed retailers. It applies to everyone whose data reaches the Platform: our own staff, staff at our retailers, and people who take delivery of goods on a retailer's behalf.

It should be read together with our Terms & Conditions.

CTG4U RETAIL SDN. BHD., Company No. 202601026837 (1688933-M), is the data user in respect of the personal data described here. Our registered contact details are in section 15.

Account and sign-in data

Your name, work email address, the role assigned to your account, account status, whether your password is still the temporary one issued to you, and the date and time you last signed in. Passwords are stored only as a cryptographic hash — we cannot read them.

Session and technical data

When you sign in we create a session record holding a session token, its expiry, and the IP address and browser user-agent it was created from. This is what keeps you signed in and lets us investigate suspicious access.

Retailer and store contact data

For each appointed retailer: the registered business name and SSM number, the named contact person, that person's mobile number, the store telephone and fax numbers, and the business email address.

Address and location data

The store or receiving-warehouse address and the registered business address, each broken into street, postcode, city, state and country; and the latitude and longitude of the delivery point, used to place it on the delivery map and to plan routes. These are business premises, not the home address of any individual.

Operational and transaction data

Sales orders, delivery orders, stock movements, stock takes, recalls and transfers, invoices, credit notes and billing periods — each recorded against the user who created, confirmed, verified or cancelled it.

Proof of delivery

When goods are received, the Platform captures the receiver's handwritten signature as an image, the name they print, their designation, the contact number they give, and the date and time of signing, together with a copy of the signed delivery order. This is our evidence that a delivery was made and accepted.

Files you upload

Documents and photographs attached to orders, deliveries, disputes and products, along with the file name, type, size and the account that uploaded them. Please do not upload personal data that is not needed for the matter at hand.

Payment data

When an invoice is paid online we record a payment reference, the amount and currency, the payment channel used, the gateway's transaction identifier and approval code, the status, and the account that initiated the payment. We also retain the verified notification the gateway sent us, so that a disputed payment can be traced. We do not receive or store your full card number, expiry date or security code — those are entered on the gateway's own hosted page and never reach us.

Activity and audit records

A log of significant actions taken on the Platform: who did what, to which record, when, from which IP address, and — where an administrator acted on another user's behalf for support — both accounts involved. We also keep the in-app notifications sent to your account.

• From you — when you sign in, enter or correct records, upload a file, sign for a delivery, or contact us.
• From your employer — when a retailer gives us the details of the staff who should hold accounts, or of its contact person for deliveries and invoicing.
• From our own staff — when they create your account or record a transaction involving you.
• Automatically — session, IP and audit data generated as you use the Platform.
• From our service providers — delivery status from couriers, and payment outcomes from our payment gateway.

We process personal data because it is necessary for the performance of the supply relationship between us and the retailer you work for, for our legitimate business interests in running that relationship safely and accurately, and to comply with our legal obligations. Specifically:

• to create accounts and authenticate the people who sign in;
• to apply role-based access, so each account sees only what it should;
• to process orders, plan and make deliveries, and prove that a delivery was received;
• to keep accurate stock records, and to carry out counts, recalls and transfers;
• to raise invoices and credit notes, collect payment, and reconcile receipts;
• to contact you about an order, a delivery, an invoice or a recall;
• to keep an audit trail, investigate errors and disputes, and detect and prevent fraud or misuse;
• to maintain, secure, support and improve the Platform, and to produce internal management reports; and
• to meet obligations under Malaysian tax, accounting, consumer protection and data protection law.

We do not sell personal data, and we do not use it for third-party advertising.

We disclose personal data only where it is necessary for the purposes above, and only to:

• the retailer you work for — its own records, orders, deliveries and invoices are visible to its authorised users;
• our courier partners— including Ninja Van, J&T Express, Pos Laju, DHL and LineClear Express, who receive the recipient name, delivery address and contact number needed to make a delivery;
• our payment gateway — Fiuu (formerly Razer Merchant Services), which processes online invoice payments and returns the outcome to us;
• our technology providers — the cloud platform that hosts the application (Vercel), the managed database service that stores its records (Neon), the file storage service that holds uploads (UploadThing), and the scheduling service that runs our background jobs (Trigger.dev), each acting as our data processor under contract;
• the issuing company named on an invoice, where it is a separate entity within our group;
• our professional advisers — auditors, accountants, insurers and lawyers, under a duty of confidence;
• regulators, enforcement agencies and courts, where we are required or permitted by law to disclose; and
• a purchaser or successor of our business, in connection with a sale, merger or reorganisation.

Some of the technology providers named in section 6 operate infrastructure outside Malaysia, so personal data on the Platform may be stored or processed outside Malaysia. Where that happens we take reasonable steps to satisfy ourselves that the data will be afforded protection substantially similar to that required under the Personal Data Protection Act 2010, including by contract with the provider. You may ask us for more detail using the contact in section 15.

We apply technical and organisational measures appropriate to the data we hold, including encrypted connections, hashed passwords, expiring sessions, role-based access control that limits each account to the records it needs, and an audit log of significant actions. Access by our own staff is limited to those whose duties require it.

No system is perfectly secure. If a breach occurs that is likely to cause significant harm, we will notify the Personal Data Protection Commissioner and, where required, the individuals affected, within the time the law allows. You can help by keeping your password private, never sharing an account, and telling us at once if you suspect misuse.

We keep personal data for as long as it is needed for the purpose it was collected for, and then for as long as we are required to keep it. In practice:

• Account data — for as long as the account is active, and afterwards where it is attached to a transaction record we must retain.
• Session records — until the session expires or is revoked, and for a short period afterwards for security investigation.
• Orders, deliveries, proof of delivery, invoices, credit notes and payment records — for at least seven (7) years, to meet Malaysian tax and accounting record-keeping requirements and to defend claims.
• Audit logs — for as long as needed to investigate and evidence activity on the Platform.
• Uploaded files — for as long as the record they are attached to is retained.

When data is no longer needed we delete it or render it no longer associated with an identifiable individual.

Subject to the exceptions in the Personal Data Protection Act 2010, you may:

• Access the personal data we hold about you, and be told how it is being processed;
• Correct personal data that is inaccurate, incomplete, misleading or out of date;
• Withdraw consent to processing that relies on your consent — though this may mean we can no longer give you access to the Platform;
• Limit processing that is causing, or is likely to cause, unwarranted damage or distress;
• Object to direct marketing, at any time and at no cost; and
• Request portability of personal data you provided to us, to another data user, where the law provides for it and it is technically feasible.

Write to us using the details in section 15. We may need to verify your identity, and we may charge a prescribed fee for a data access request. We will respond within the period the law requires. Some records — a signed delivery order, an issued invoice, an audit entry — cannot be altered or deleted on request, because they are the evidence of a transaction; where that is the case we will tell you why.

The Platform uses a small number of strictly necessary cookies. The main one holds your signed session so that you stay signed in as you move between pages; it is signed, expires, and is cleared when you sign out. Your browser may also store your display preferences, such as light or dark theme, on your own device.

We do not use advertising cookies, third-party tracking pixels or cross-site profiling. Blocking the session cookie will prevent you from signing in.

The Platform generates suggestions and alerts automatically — restock prompts, overdue-invoice flags and negative-stock warnings, for example. These are prompts for our staff, not decisions. We do not make decisions producing legal or similarly significant effects about you by automated means alone.

The Platform is a business system for appointed retailers and staff. It is not directed at children, and we do not knowingly collect personal data from anyone under 18. If you believe a child's data has reached the Platform, tell us and we will remove it.

We may update this policy. The current version is always published on this page with the date it was last updated, and we will tell you through the Platform or by email where a change materially affects you.

For any question about this policy, to exercise a right under section 10, or to raise a concern about how we have handled your personal data, contact us. Please mark your message "Personal Data Request" so it reaches the right person.

If you are not satisfied with our response, you may complain to the Personal Data Protection Department (Jabatan Perlindungan Data Peribadi), Malaysia.