Privacy Policy / Notis Privasi

Last updated / Kemas kini terakhir: 24 July 2026

English

1. Who we are

Woyalty is an appointment-booking platform for Malaysian service businesses (“the Platform”). This notice is issued for the purposes of the Personal Data Protection Act 2010 (“PDPA”) and explains how personal data is collected, used, and disclosed when you use the Platform.

Two roles apply. When you book an appointment with a business listed on the Platform, that business is the data user responsible for your personal data, and Woyalty processes it on the business’s behalf. When you register a business account with Woyalty, Woyalty is the data user for your account and billing data.

2. Personal data we collect

  • Booking customers: name, mobile phone number, optional email address, appointment details (service, staff, date and time), booking history, loyalty points and prepaid package balances, and payment status.
  • Business owners and staff: name, email address, business details, subscription plan and billing records.
  • Payments: processed by Fiuu (formerly Razer Merchant Services). We record the transaction reference, amount, and status. We never see or store your full card number or online-banking credentials.

3. How we use it

  • Creating and managing appointments, waitlists, and prepaid packages.
  • Sending booking confirmations, reminders, and related service messages via WhatsApp — only where you have opted in.
  • Collecting deposits and payments, and issuing refunds.
  • Operating loyalty programmes on behalf of the business you booked with.
  • Providing anonymised, aggregated analytics to business owners.

4. Disclosure

Personal data is shared only with the business you booked with and the service providers needed to run the Platform: Supabase (database and authentication), Vercel (hosting), Meta (WhatsApp Cloud API messaging), and Fiuu (payments). We do not sell personal data. Data is stored on servers located in Singapore (AWS ap-southeast-1); by using the Platform you consent to this transfer outside Malaysia.

5. WhatsApp messages and opting out

You can withdraw consent to WhatsApp messages at any time by replying STOP or BERHENTI to any message from the Platform. Your number is then placed on a blocklist for that business and no further messages are sent.

6. Retention and security

Personal data is kept for as long as needed to provide the service and meet legal and accounting obligations, then deleted or anonymised. Data is encrypted in transit, access is restricted by role, and every outbound message and administrative action is logged.

7. Your rights

Under the PDPA you may request access to or correction of your personal data, withdraw consent, and limit processing of your data. For data held about your bookings, you may also contact the business directly. To exercise these rights, contact us at support@woyalty.com.

Bahasa Melayu

1. Siapa kami

Woyalty ialah platform tempahan janji temu untuk perniagaan perkhidmatan di Malaysia (“Platform”). Notis ini dikeluarkan bagi maksud Akta Perlindungan Data Peribadi 2010 (“APDP”) dan menerangkan cara data peribadi dikumpul, digunakan, dan dizahirkan apabila anda menggunakan Platform.

Dua peranan terpakai. Apabila anda menempah janji temu dengan perniagaan di Platform, perniagaan tersebut ialah pengguna data yang bertanggungjawab ke atas data peribadi anda, dan Woyalty memprosesnya bagi pihak perniagaan itu. Apabila anda mendaftar akaun perniagaan dengan Woyalty, Woyalty ialah pengguna data bagi data akaun dan pengebilan anda.

2. Data peribadi yang dikumpul

  • Pelanggan tempahan: nama, nombor telefon bimbit, alamat e-mel (pilihan), butiran janji temu (perkhidmatan, kakitangan, tarikh dan masa), sejarah tempahan, mata kesetiaan dan baki pakej prabayar, serta status pembayaran.
  • Pemilik perniagaan dan kakitangan: nama, alamat e-mel, butiran perniagaan, pelan langganan dan rekod pengebilan.
  • Pembayaran: diproses oleh Fiuu. Kami hanya menyimpan rujukan transaksi, amaun, dan status. Kami tidak melihat atau menyimpan nombor kad penuh atau kelayakan perbankan dalam talian anda.

3. Cara kami menggunakannya

  • Mewujudkan dan mengurus janji temu, senarai menunggu, dan pakej prabayar.
  • Menghantar pengesahan tempahan, peringatan, dan mesej perkhidmatan berkaitan melalui WhatsApp — hanya jika anda telah memberi kebenaran.
  • Mengutip deposit dan pembayaran, serta memproses bayaran balik.
  • Mengendalikan program kesetiaan bagi pihak perniagaan yang anda tempah.
  • Menyediakan analitik agregat tanpa nama kepada pemilik perniagaan.

4. Penzahiran

Data peribadi hanya dikongsi dengan perniagaan yang anda tempah dan pembekal perkhidmatan yang diperlukan untuk mengendalikan Platform: Supabase (pangkalan data dan pengesahan), Vercel (pengehosan), Meta (pemesejan WhatsApp Cloud API), dan Fiuu (pembayaran). Kami tidak menjual data peribadi. Data disimpan pada pelayan di Singapura (AWS ap-southeast-1); dengan menggunakan Platform anda bersetuju dengan pemindahan ini ke luar Malaysia.

5. Mesej WhatsApp dan menarik diri

Anda boleh menarik balik kebenaran mesej WhatsApp pada bila-bila masa dengan membalas STOP atau BERHENTI kepada mana-mana mesej daripada Platform. Nombor anda akan disenaraihitamkan bagi perniagaan tersebut dan tiada mesej lanjut akan dihantar.

6. Penyimpanan dan keselamatan

Data peribadi disimpan selagi diperlukan untuk menyediakan perkhidmatan dan memenuhi kewajipan undang-undang dan perakaunan, kemudian dipadam atau ditanpanamakan. Data disulitkan semasa penghantaran, akses dihadkan mengikut peranan, dan setiap mesej keluar serta tindakan pentadbiran direkodkan.

7. Hak anda

Di bawah APDP, anda boleh memohon akses kepada atau pembetulan data peribadi anda, menarik balik kebenaran, dan mengehadkan pemprosesan data anda. Bagi data berkaitan tempahan anda, anda juga boleh menghubungi perniagaan tersebut secara terus. Untuk melaksanakan hak ini, hubungi kami di support@woyalty.com.