Dasar Kuki

1. Purpose

This Cookie Policy explains how Karya (Company No. 1234567-X), trading as Karya ("we", "us", "our"), uses cookies, device identifiers and similar technologies on our website at https://karya.rizen.space/ (the "Website") and in connection with the sale and electronic delivery of digital goods, including vouchers, e-codes, software licences and top-up codes.

The purpose of this Policy is to:

• Describe what cookies and similar technologies are and how they work;
• Set out the categories of cookies we use and the purposes for which we use them;
• Disclose the third-party cookies set on the Website, including those of our payment partner, and the sharing of related personal data with them;
• Explain how personal data collected through these technologies may be transferred outside Malaysia; and
• Explain how you may manage, control or disable cookies.

This Policy should be read together with our Privacy Policy, our Terms and Conditions and our Refund Policy, each of which forms part of the agreement between you and us. Where there is any inconsistency on the treatment of personal data, our Privacy Policy prevails. Where personal data is collected through cookies, that personal data is processed in accordance with our Privacy Policy and the Personal Data Protection Act 2010 ("PDPA").

1.1 Role of the Payment Processor

Payments made on the Website are processed by Bayarcash Sdn. Bhd. (Company No. 202201040365) of Kota Bharu, Kelantan, Malaysia, a payment gateway regulated under Malaysian law (the "Payment Processor"). The Payment Processor acts solely as an independent third-party provider of payment-processing services. It is not the seller, supplier, merchant of record or counterparty to any purchase, and it does not own, control or operate the Website.

Karya, and not the Payment Processor, is the seller of record and your sole counterparty in respect of any purchase and the supply of digital goods. All questions concerning your order, delivery, refunds, disputes, cookies or your personal data must be directed to Karya in the first instance.

Certain cookies and device data described in this Policy support security and payment-integrity processes that are relied upon by us and, where relevant, shared with the Payment Processor, as described in Sections 4 and 5 and in our Privacy Policy.

2. What Are Cookies

Cookies are small text files that are placed on your computer, smartphone, tablet or other device when you visit a website. They are widely used to make websites work, or to work more efficiently, as well as to provide information to the operators of the website.

In this Policy, "cookies" and "similar technologies" include:

Cookies may be session cookies, which are deleted when you close your browser, or persistent cookies, which remain on your device for a set period or until you delete them. Cookies may be set by us ("first-party cookies") or by third parties ("third-party cookies"), as described in Section 5.

3. Types of Cookies We Use

We use the following categories of cookies and similar technologies. Some cookies serve more than one purpose. Personal data collected through these technologies — such as IP address, device information and on-site behaviour — is governed by the PDPA, including the Notice and Choice Principle, the Security Principle and the Retention Principle, and is handled as set out in our Privacy Policy.

Essential and Security cookies are necessary for the legitimate operation, security and lawful conduct of the Website and the delivery of digital goods, and are not subject to opt-in consent. Performance, Functional and Advertising cookies are non-essential and are set only on the basis of your affirmative consent (see Section 7).

4. Cookies Used for Security

We use cookies, local storage, pixels and device identifiers for security and payment-integrity purposes, including to:

• Authenticate users, maintain secure sessions and protect against unauthorised account access;
• Detect and prevent unauthorised or fraudulent transactions and the use of compromised payment cards;
• Protect the security and integrity of the Website, your account and the checkout process; and
• Support our compliance with applicable legal and regulatory obligations, including, where relevant, the Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001 ("AMLA").

The technical data captured through these technologies — including IP address, device identifiers, session data and timestamps — is collected, processed and retained for the purpose of securing transactions and protecting against fraud and unauthorised use. Where necessary for processing or securing your payment, this data may be shared with the Payment Processor, Bayarcash Sdn. Bhd., for payment processing, transaction-security and legal-compliance purposes, as further described in Section 5 and in our Privacy Policy.

These Security cookies are strictly necessary for the secure and lawful operation of the Website and cannot be disabled while you continue to use the Website. The processing of personal data through these technologies is carried out in accordance with the PDPA, including the Notice and Choice Principle, the Security Principle and the Retention Principle, and is further described in our Privacy Policy.

5. Third-Party Cookies and Data Sharing

Some cookies on the Website are set by third parties that provide services to us or to you. We do not control the setting of these cookies, and you should review the relevant third party's own cookie and privacy policies for further information. Third-party cookies and similar technologies on the Website include those set by:

The use of payment-related cookies, and the sharing of the related personal data with the Payment Processor (Bayarcash Sdn. Bhd.), is consistent with, and forms part of, the data-sharing disclosure set out in our Privacy Policy. By transacting on the Website, you acknowledge and consent that your payment, transaction and device data will be shared with the Payment Processor for the purposes described in this Policy and in our Privacy Policy. This sharing is necessary for the performance of your purchase contract, for the security of your payment, and for the Payment Processor's compliance with its legal and regulatory obligations.

5.1 Cross-Border Transfer

Because we may serve customers internationally and our payment and analytics partners may operate or store data outside Malaysia, personal data collected through the cookies and technologies described in this Policy — including your IP address, device data and transaction data — may be transferred to, processed and stored in locations outside Malaysia. Where such transfers occur, we take reasonable steps to ensure the data is protected to a standard consistent with the PDPA. By transacting on the Website, you acknowledge and consent to such cross-border transfer for the purposes described in this Policy and in our Privacy Policy.

Personal data collected through third-party cookies (including IP address, device and behavioural data) is governed by the PDPA, including the Notice and Choice Principle, the Security Principle and the Retention Principle, as further described in our Privacy Policy.

6. Managing and Disabling Cookies

You have the right to decide whether to accept or reject non-essential cookies. You can manage cookies in the following ways:

• Consent tool / cookie banner — Where available on the Website, you may use our cookie banner or preference centre to accept or reject categories of non-essential cookies (performance, functional and advertising) and to change your choices at any time.
• Browser settings — Most web browsers allow you to view, manage, delete and block cookies through their settings. Instructions are usually found in the "Help", "Settings" or "Preferences" menu of your browser. You can also set your browser to notify you when a cookie is being placed.
• Third-party opt-outs — Some third-party advertising and analytics providers offer their own opt-out mechanisms, which are described in their respective policies.

Please note that essential cookies and security cookies cannot be disabled while you use the Website, as they are strictly necessary for the secure, lawful and proper functioning of the Website and the delivery of digital goods. If you choose to block or delete other cookies, some features of the Website may not function correctly, your preferences may not be remembered, and your experience may be affected.

We currently do not respond to "Do Not Track" or similar browser signals, as no common industry standard for such signals has been adopted. You may manage non-essential cookies using the methods described above.

In the interest of fair dealing and transparency consistent with the Consumer Protection Act 1999, we have set out clearly above the categories of cookies we use and the means by which you may control them, so that you can make an informed choice before continuing to use the Website.

7. Consent

Essential cookies and security cookies are placed because they are strictly necessary for the operation, security and lawful conduct of the Website. They do not require your consent and cannot be disabled while you use the Website.

Non-essential cookies (performance, functional and advertising cookies) are placed only where you have given your affirmative consent through our cookie banner or consent tool. Until you provide that consent, non-essential cookies will not be set.

You may withdraw or change your consent to non-essential cookies at any time by adjusting your settings through our cookie banner or consent tool, or through your browser settings, as described in Section 6. Withdrawing consent will not affect the lawfulness of any processing carried out before the withdrawal, and will not affect the operation of essential or security cookies.

Where cookies collect personal data, that data is processed on the basis described in this Policy and in our Privacy Policy, in accordance with the PDPA.

8. Age and Eligibility

The Website and the purchase of digital goods are intended for persons who are at least 18 years of age and who have the legal capacity to enter into a binding contract under the Contracts Act 1950. If you are below the age of majority, you may use the Website and transact only with the consent and supervision of a parent or legal guardian who agrees to be bound on your behalf. By continuing to use the Website and to consent to cookies, you confirm that you meet these requirements.

9. Amendments

We may update or amend this Cookie Policy from time to time to reflect changes in the cookies and technologies we use, in our business practices, or in applicable law. Any changes will take effect from the date the revised Policy is published on the Website, and the "lastUpdated" date above will be revised accordingly. We will provide notice of material changes by posting the updated Policy on the Website or by such other means as we consider appropriate. Your continued use of the Website after any amendment constitutes your acceptance of the revised Cookie Policy. We encourage you to review this Policy periodically.

10. Governing Law and Severability

This Cookie Policy, and any matter arising out of or in connection with it, is governed by and construed in accordance with the laws of Malaysia. You submit to the exclusive jurisdiction of the courts of Malaysia in respect of any dispute arising out of or in connection with this Policy.

If any provision of this Policy is held to be invalid, unlawful or unenforceable, that provision shall be severed and the remaining provisions shall continue in full force and effect. This Policy, together with our Privacy Policy, Terms and Conditions and Refund Policy, constitutes the entire agreement between you and us regarding cookies and similar technologies on the Website.

11. Contact Information

If you have any questions, requests or concerns about this Cookie Policy or our use of cookies and similar technologies, please contact us:

Karya (trading as Karya) —

For matters relating specifically to payment processing, the Website's payments are handled by the Payment Processor:

For all questions concerning your order, delivery of digital goods, refunds, disputes or your personal data held by us, you must contact Karya in the first instance using the contact details above. Karya is the seller of record and your sole counterparty, and the Payment Processor is an independent third party that provides payment-processing services only and is not responsible for the goods, their delivery, or any dispute between you and Karya.