Privacy policy

PRIVACY POLICY

(Personal Data Protection Act 2010 – Malaysia)

Last Updated:1 February 2026

This Privacy Policy sets out how Luméa (operating under bylumea.co) (“we”, “our”, or “us”) collects, processes, uses, discloses and protects your Personal Data in accordance with the Personal Data Protection Act 2010 (PDPA) of Malaysia.

By accessing our website and/or placing an order with us, you consent to the collection and processing of your Personal Data as described in this Privacy Policy.

1. Definition of Personal Data

“Personal Data” refers to any information that relates directly or indirectly to you and from which you may be identified, including but not limited to:

  • Full name

  • Contact number

  • Email address

  • Delivery address

  • Payment confirmation details (e.g., transaction receipt)

  • Any information submitted via Instagram, WhatsApp or other communication channels

2. Source of Personal Data

Your Personal Data may be collected from:

  • Information provided directly by you when placing an order

  • Communication via our website, Instagram (@bylumea.co), or WhatsApp (+6016 680 6586)

  • Voluntary submissions such as enquiries, feedback, or promotional participation

3. Purpose of Processing

Your Personal Data is collected and processed for the following purposes:

  • Processing and fulfilling orders

  • Payment verification

  • Delivery arrangement and logistics coordination

  • Customer service and communication

  • Responding to enquiries or complaints

  • Internal record keeping

  • Marketing communications (where consent has been provided)

  • Compliance with legal or regulatory obligations

We will not process your Personal Data for purposes other than those stated above without your consent, unless permitted under applicable laws.

4. Disclosure of Personal Data

We may disclose your Personal Data to:

  • Courier and logistics service providers for delivery purposes

  • Payment verification purposes

  • Professional advisors where necessary

  • Authorities or regulators if required by law

We do not sell, rent, or trade your Personal Data to third parties.

5. Data Security

We take reasonable and practical steps to protect your Personal Data from loss, misuse, modification, unauthorized access, or disclosure.

However, please note that no data transmission over the internet is completely secure. While we strive to protect your Personal Data, we cannot guarantee absolute security.

6. Retention of Personal Data

Your Personal Data will be retained only for as long as necessary to fulfill the purposes stated in this Privacy Policy, or as required under applicable laws and regulations.

7. Your Rights Under PDPA

Under the Personal Data Protection Act 2010, you have the right to:

  • Request access to your Personal Data

  • Request correction of inaccurate or incomplete Personal Data

  • Withdraw consent (subject to legal or contractual restrictions)

To exercise these rights, please contact us via:

Instagram: @bylumea.co
Email: bylumea.co@gmail.com

We may require verification of your identity before processing such requests.

8. Cookies and Website Usage

Our website may use cookies or similar technologies to enhance user experience and analyze website traffic. You may choose to disable cookies through your browser settings.

9. Amendments to This Policy

We reserve the right to amend this Privacy Policy from time to time. Any updates will be published on this page. Continued use of our website constitutes acceptance of the revised policy.