Dasar Privasi

1. Introduction

This Privacy Policy explains how Karya (Company No. 1234567-X), trading as Karya ("we", "us", "our"), collects, uses, discloses, stores and protects your personal data when you visit our website at https://karya.rizen.space/ (the "Website") and when you purchase digital goods from us, including vouchers, e-codes, gift cards, software licences, top-up codes and similar products delivered electronically.

We are committed to handling your personal data in accordance with the Personal Data Protection Act 2010 ("PDPA") of Malaysia and its seven Personal Data Protection Principles. This Policy sets out your rights and our obligations in relation to your personal data.

This Policy should be read together with our Terms and Conditions and our Refund Policy, each of which forms part of the agreement between you and us.

1.1 Role of the Payment Processor

Payments made on the Website are processed by Bayarcash Sdn. Bhd. (Company No. 202201040365) of Kota Bharu, Kelantan, Malaysia, a payment gateway regulated under Malaysian law (the "Payment Processor"). The Payment Processor acts solely as an independent third-party provider of payment-processing services. It is not the seller, supplier, merchant of record or counterparty to any purchase, and it does not own, control or operate the Website.

Karya, and not the Payment Processor, is the seller of record and your sole counterparty in respect of any purchase and the supply of digital goods. All questions concerning your order, the delivery of digital goods, refunds, disputes or your personal data must be directed to Karya in the first instance.

When you pay for your order, your payment and related transaction data are processed by the Payment Processor in its capacity as an independent data processor and, where applicable, a data user in its own right for payment, fraud-screening and regulatory-compliance purposes, as described in Sections 3 and 5.

2. Personal Data We Collect

We collect only the personal data that is necessary to process your orders, deliver your digital goods and provide customer support. Depending on how you use the Website, we may collect the following categories of personal data:

• Identity and contact data — Full name, email address, mobile or telephone number
• Order and delivery data — Items purchased, order reference, the email address or account to which the digital code or licence is delivered
• Payment data — Payment method and transaction reference; card and banking details are entered directly with, and processed by, the Payment Processor and are not stored by us
• Technical and device data — IP address, browser type, operating system, device identifiers, and similar signals collected automatically when you use the Website
• Usage and communications data — Pages visited, actions taken on the Website, and the content of your enquiries and correspondence with our support team

Where we ask you to provide personal data, we will indicate whether it is obligatory. If you do not provide personal data that is necessary to fulfil your order, we may be unable to process your purchase or deliver your digital goods.

3. How We Use Your Personal Data

In accordance with the Notice and Choice Principle under the PDPA, we use your personal data for the following purposes:

• Order processing — To process your order, verify your payment, generate and deliver your digital goods (such as vouchers, e-codes and licence keys) electronically
• Customer support — To respond to your enquiries, provide after-sales support and resolve order and delivery issues
• Fraud prevention and security — To detect, prevent and investigate fraud, unauthorised transactions and abuse, and to protect the security and integrity of the Website and the payment process
• Legal and regulatory compliance — To comply with our obligations under Malaysian law, including record-keeping, tax and anti-money-laundering and counter-financing-of-terrorism ("AML/CFT") requirements
• Service improvement — To understand how the Website is used and to maintain and improve our products and services

We will not use your personal data for purposes that are unrelated to those above without first obtaining your consent, unless permitted or required by law.

4. Disclosure of Personal Data

We do not sell, rent or trade your personal data. In accordance with the Disclosure Principle under the PDPA, we may disclose your personal data only to the following parties and only for the purposes described in this Policy:

• Payment Processor — To process and secure your payment, perform payment-related fraud and risk screening, and meet the Payment Processor's own legal and regulatory obligations. This is our Payment Processor, Bayarcash Sdn. Bhd., together with its banking and acquiring partners
• Service providers — Trusted vendors who provide hosting, email delivery, code-fulfilment and customer-support tools on our behalf, under obligations of confidentiality
• Regulators and authorities — Government agencies, regulators, law-enforcement bodies and courts, where required or permitted by law, including for AML/CFT compliance

By placing an order and paying on the Website, you acknowledge and consent that your payment, order and transaction data will be shared with the Payment Processor for the purposes described in this Policy. This sharing is necessary for the performance of your purchase contract, for the legitimate prevention of fraud, and for the Payment Processor's compliance with its legal and regulatory obligations.

5. Cross-Border Transfer of Personal Data

Some of our service providers and our Payment Processor's partners may operate or store data outside Malaysia. As a result, your personal data — including your contact, order and transaction data — may be transferred to, processed and stored in locations outside Malaysia.

Where such transfers occur, we take reasonable steps to ensure that your personal data continues to be protected to a standard consistent with the PDPA. By transacting on the Website, you acknowledge and consent to such cross-border transfer for the purposes described in this Policy.

6. Data Security

In accordance with the Security Principle under the PDPA, we implement reasonable technical and organisational measures to protect your personal data against loss, misuse, unauthorised access, disclosure, alteration or destruction.

All payments are processed securely through the Payment Processor, a payment gateway that maintains payment-industry security standards. Card and banking details are entered directly with the Payment Processor and are not stored on our systems. We apply encryption in transit, access controls and other safeguards appropriate to the sensitivity of the data we hold.

While we take reasonable steps to protect your personal data, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

7. Cookies

We use cookies and similar technologies to enable essential Website functions, remember your preferences, measure and improve performance, and support fraud prevention and security. Personal data collected through cookies (such as your IP address and device information) is governed by this Policy and the PDPA.

Most browsers allow you to view, manage, delete and block cookies through their settings. Please note that disabling essential cookies may prevent parts of the Website from functioning correctly.

8. Data Retention

In accordance with the Retention Principle under the PDPA, we retain your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or for as long as we are required to retain it by law.

• Transaction and financial records — Retained for a minimum of seven (7) years to comply with Malaysian tax, accounting and AML/CFT record-keeping requirements
• Order and support records — Retained for as long as necessary to provide support, resolve disputes and enforce our agreements
• Other personal data — Deleted or anonymised once it is no longer required for the purposes set out in this Policy

9. Your Rights Under the PDPA

Under the PDPA, you have the following rights in respect of the personal data we hold about you:

• Right of access — To request access to the personal data we hold about you
• Right of correction — To request that we correct any inaccurate, incomplete, misleading or out-of-date personal data
• Right to withdraw consent — To withdraw your consent to our processing of your personal data, subject to legal and contractual restrictions
• Right to limit processing — To request that we limit the processing of your personal data for direct marketing or other specified purposes

To exercise any of these rights, please contact us using the details in Section 12. We may need to verify your identity before acting on your request, and we may charge a reasonable fee for an access request as permitted by the PDPA. Withdrawing consent or limiting processing may mean we are unable to continue providing certain services to you.

10. Children and Eligibility

The Website and the purchase of digital goods are intended for persons who are at least 18 years of age and who have the legal capacity to enter into a binding contract under the Contracts Act 1950. If you are below the age of majority, you may use the Website and transact only with the consent and supervision of a parent or legal guardian who agrees to be bound on your behalf. We do not knowingly collect personal data from children without such consent.

11. Changes to This Policy

We may update or amend this Privacy Policy from time to time to reflect changes in our practices, our products, or applicable law. Any changes will take effect from the date the revised Policy is published on the Website, and the "lastUpdated" date above will be revised accordingly. We will provide notice of material changes by posting the updated Policy on the Website or by such other means as we consider appropriate. Your continued use of the Website after any amendment constitutes your acceptance of the revised Policy. We encourage you to review this Policy periodically.

12. Contact Information

If you have any questions, requests or concerns about this Privacy Policy or our handling of your personal data, please contact us:

Karya (trading as Karya) —

For matters relating specifically to payment processing, the Website's payments are handled by the Payment Processor:

For all questions concerning your order, the delivery of digital goods, refunds, disputes or your personal data held by us, you must contact Karya in the first instance using the contact details above. Karya is the seller of record and your sole counterparty, and the Payment Processor is an independent third party that provides payment-processing services only and is not responsible for the goods, their delivery, or any dispute between you and Karya.