Legal

Privacy Policy

Last updated: 4 November 2026

1. Who is responsible for your data

[Registered business name] ([SSM registration no.]), trading as HeyWell, is responsible for the personal data collected through heywell.online.

2. What we collect

• Details you give us: your name, phone number, email, delivery and billing address, order notes, and messages you send us on WhatsApp, email or our forms.
• Order details: the products you buy, order history and payment status.
• Account details: your login details if you create an account. Your password is stored encrypted and we cannot see it.
• Technical data: your IP address, browser and device type, and how you use our site, collected through cookies.

Payments are processed by our payment provider. We do not receive or store your full card number or online banking login.

3. Why we use it

• to process, deliver and follow up on your orders
• to verify payments and prevent fraud
• to answer your questions and provide customer support
• to keep business, accounting and tax records required by law
• to improve our website and products
• to send you news and promotions, but only if you agree. You can unsubscribe at any time.

You must provide your name, phone number and address for us to deliver your order. Without them, we cannot complete your purchase.

4. Who we share it with

We only share your data with parties that help us run the store, and only as much as they need:

• courier and delivery partners, to deliver your parcel
• our payment provider, to process your payment
• our website hosting, email and messaging providers
• analytics providers, to understand how the site is used
• government or regulatory authorities, when required by law

We never sell your personal data. Some of these providers may store data on servers outside Malaysia. Where this happens, we take reasonable steps to make sure your data stays protected.

5. Cookies

We use essential cookies to keep your cart and login working, and analytics cookies to understand how visitors use our site. You can block or delete cookies in your browser settings, but parts of the site, such as the cart, may stop working properly.

6. How long we keep it

We keep your personal data only as long as needed for the purposes above. Order and payment records are kept for up to 7 years to meet accounting and tax requirements. After that, they are deleted or anonymised.

7. How we protect it

Our website uses an encrypted connection (HTTPS), and access to customer data is limited to people who need it to handle your order. No system is completely secure, but we take reasonable steps to protect your data from loss, misuse and unauthorised access.

8. Your rights

Under the PDPA, you may:

• ask for a copy of the personal data we hold about you
• ask us to correct data that is wrong, incomplete or out of date
• withdraw your consent, or ask us to stop sending you marketing
• make an enquiry or complaint about how your data is handled

To make a request, contact us on WhatsApp ([WhatsApp number]) or email (contact.support@heywell.online). We will respond within 21 days. We may charge a small fee for data access requests, as allowed under the PDPA.

9. Children

Our website is not intended for children under 18. We do not knowingly collect personal data from children without a parent’s or guardian’s consent.

10. Changes to this policy

We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated.