Privacy notice / Notis Privasi

English — Privacy notice

Effective: 22 October 2026. Loominos Studio, trading as StoryBook by Loominos Studio, is responsible for the personal data it handles through https://shop.loominosstudio.my and related ordering and support activities. This notice explains our practices and your choices under Malaysia's Personal Data Protection Act 2010, as amended, and applicable requirements. The notice is provided in English and Bahasa Malaysia.

1. Information and sources

We receive information when you register, edit a profile, upload photographs, save projects, order prints, purchase or redeem Credits, apply vouchers, request a voucher email, submit feedback, contact support or provide delivery and payment information. Information includes name, email, mobile number, addresses, account and session records, order and print selections, uploaded images and print renditions, editing metadata, communications, payment references, payment-slip images, verification results and refund bank details where required.

We also collect technical and security information such as IP address, browser/user-agent information, cookies or similar storage identifiers, request times, errors and audit events. We may receive payment confirmation from a bank or payment provider, delivery updates from a courier, and information from a person ordering or receiving on your behalf. Photographs can identify you or other people and can reveal sensitive information. Do not upload unnecessary identity documents, bank balances or sensitive personal details. We do not need a copy of an identity card merely to print an ID photograph.

2. Why we use information

We use the information needed to provide accounts and projects, prepare and print your images, check specifications, verify payment, deliver or arrange collection, operate Credits and eligible promotions, answer enquiries, resolve complaints and returns, and maintain appropriate business records. We also use relevant information for security, fraud prevention, access control, troubleshooting, transaction reconciliation and compliance with legal duties.

For limited-use vouchers, registered customers are matched by account. Guest use may be matched by a server-observed IP address together with email or mobile details. Keyed hashes of these identifiers can be stored with a voucher redemption to detect repeat use. Hashing does not necessarily make identifiable information anonymous. If a voucher check is wrong, contact us for review; do not treat it as a final determination about your identity.

3. Required information, optional choices and consent

Fields marked required, necessary order files and sufficient payment or delivery details are needed to supply the relevant service. If you do not provide them, we may be unable to create an account, verify payment, apply an eligible voucher or fulfil the order. Optional fields may be left blank. Guest checkout and optional account features are offered where the website permits them.

We process data with your consent where required, or on another basis permitted by Malaysian law, including where necessary to perform your requested transaction or comply with a legal obligation. This notice is not blanket consent to unrelated activities. If processing requires explicit consent for sensitive personal data, we will obtain it or rely on a specific lawful exception. Providing someone else's information does not remove our duty to process it lawfully; please obtain the necessary authority and bring this notice to their attention.

4. Your photographs and confidentiality

You retain your rights in your photographs. Access is limited to people and service providers who need the material for the described service, support, security or legal purposes. Ordering prints authorises processing needed for that order, not publication of your photographs. We do not use customer photographs for public galleries, advertising or AI-model training without separate express permission. Do not use the service as your only photo archive: keep your original files and backups.

5. Who may receive information

Relevant information may be shared with authorised staff; printing, finishing, hosting, storage, backup, IT and security service providers; couriers and collection partners; banks, payment providers including FPX/PayNet participants, and refund-processing providers; email and SMS delivery providers; professional advisers; and public authorities where disclosure is lawfully required or permitted. Each receives information relevant to its role. We do not sell your personal data.

Bank login credentials and OTPs should be entered only through the bank's legitimate payment process, never sent to us. We receive transaction details needed for reconciliation, not your online-banking password. WhatsApp, bank, courier, map/address or anti-bot services used through their own interfaces may also process data under their own notices. We do not control those independent services; contact us if you need to identify the provider used for your transaction.

6. Cookies and communications

Essential cookies or browser storage help maintain sessions, CSRF protection, carts and selected preferences. Blocking them can prevent sign-in, saving or checkout. Browser controls let you remove or restrict storage. Any non-essential tracking or marketing that requires consent will be subject to the relevant choice; this notice does not authorise it by default.

Order, verification, payment, delivery and security messages are service communications. Where SMS notifications are selected for an order, the relevant mobile number is used for delivery of that message. Requesting a voucher email triggers that requested email and does not create a marketing subscription. Promotional messages require an appropriate permission and a practical opt-out. You may object to direct marketing or withdraw marketing consent using the message instructions or our support contact. Essential service notices may still be necessary for an existing transaction.

7. Storage, retention and transfers abroad

We keep personal data only for as long as reasonably necessary for the stated purpose, applicable record-keeping obligations and genuine unresolved disputes or legal claims. Order and payment records may need longer retention than temporary image files. Saved projects and order-linked images can remain while the project, fulfilment or a related claim requires them. Deleting a project from your account does not necessarily delete an order record or every backup immediately. We review retention and arrange secure deletion or anonymisation when data is no longer needed; no automatic deletion date is promised here for every file type. Ask us about the retention applicable to your data or request deletion for review.

Some service providers or their support/backup systems may process information outside Malaysia. A cross-border transfer must meet applicable Malaysian requirements, including an appropriate lawful basis and safeguards. We assess relevant protection and contractual/security arrangements rather than assuming another country's protection is adequate. Contact us for information about the providers, destinations and safeguards relevant to your data. Where separate consent is required, we will request it before the relevant transfer.

8. Security and incidents

We use appropriate access controls and security measures and require relevant providers to protect information entrusted to them. No internet service is risk-free. Use a strong password, protect your email and device, sign out on shared devices and contact us promptly about suspected unauthorised access. We will assess personal-data incidents and notify the Commissioner and affected individuals where required, within the applicable statutory and regulatory periods. A security incident does not remove any right you may have under law.

9. Your rights and how to exercise them

Contact our Privacy Contact using the details below to request access or correction, withdraw consent, limit relevant processing, object to direct marketing, or raise a privacy complaint. You may request transmission of your data to another controller where the statutory portability right applies, subject to technical feasibility and format compatibility. You may also ask us to review deletion of data no longer needed; deletion is subject to lawful retention and others' rights and is not an unconditional entitlement to erase every transaction record.

We may reasonably verify identity and authority without requesting excessive identification. We will explain any lawful limitation, applicable prescribed fee or information needed to process a request and respond within applicable time limits. Withdrawing consent may prevent a related service from continuing, but does not retrospectively invalidate lawful prior processing. If you are dissatisfied, you may complain to Malaysia's Personal Data Protection Commissioner at https://www.pdp.gov.my.

10. Children and changes

An adult parent or guardian should arrange orders involving a child's data and provide the necessary authority. Do not create an account or independently place a contractual order if you lack the capacity to do so. We do not seek to collect more children's information than needed for the requested printing service.

We will update this notice when our practices or applicable requirements change. Material new purposes or disclosures will be brought to your attention and additional consent obtained where necessary, rather than assumed from a notice update. Both language versions are intended to convey the same protections. Contact us if a translation appears inconsistent.

11. Privacy Contact

Address requests to “Privacy Contact — StoryBook by Loominos Studio”. This contact description does not claim that a statutory Data Protection Officer has been appointed or registered.
Loominos Studio
SSM: 201703056580 / 002620744-D
2-1 Jalan Maju 9, Kuchai Entrepreneurs Park, 58200, Kuala Lumpur, Kuala Lumpur, MY
Email / E-mel: general@loominosstudio.my
Telephone / Telefon: 601126688600

Bahasa Malaysia — Notis Privasi

Berkuat kuasa: 22 Oktober 2026. Loominos Studio, yang berniaga sebagai StoryBook by Loominos Studio, bertanggungjawab terhadap data peribadi yang dikendalikannya melalui https://shop.loominosstudio.my serta aktiviti pesanan dan sokongan berkaitan. Notis ini menerangkan amalan dan pilihan anda menurut Akta Perlindungan Data Peribadi 2010 Malaysia, sebagaimana dipinda, dan keperluan berkenaan. Notis disediakan dalam Bahasa Malaysia dan bahasa Inggeris.

1. Maklumat dan sumber

Kami menerima maklumat semasa pendaftaran, kemas kini profil, muat naik foto, simpanan projek, pesanan cetakan, pembelian atau penebusan Kredit, penggunaan baucar, permintaan e-mel baucar, maklum balas, urusan sokongan serta pemberian butiran penghantaran dan pembayaran. Maklumat termasuk nama, e-mel, nombor mudah alih, alamat, rekod akaun dan sesi, pesanan dan pilihan cetakan, imej asal serta hasil cetakan, metadata suntingan, komunikasi, rujukan pembayaran, imej slip, hasil pengesahan dan butiran bank bayaran balik jika diperlukan.

Kami juga mengumpul maklumat teknikal dan keselamatan seperti alamat IP, pelayar/ejen pengguna, kuki atau pengecam storan seumpamanya, masa permintaan, ralat dan rekod audit. Maklumat boleh diterima daripada bank atau penyedia pembayaran, kurier dan orang yang memesan atau menerima bagi pihak anda. Foto boleh mengenal pasti individu serta mendedahkan maklumat sensitif. Jangan muat naik dokumen pengenalan, baki bank atau butiran sensitif yang tidak perlu. Salinan kad pengenalan tidak diperlukan semata-mata untuk mencetak foto ID.

2. Tujuan penggunaan

Maklumat perlu digunakan untuk akaun dan projek, penyediaan serta cetakan imej, semakan spesifikasi, pengesahan pembayaran, penghantaran atau pengambilan, pengendalian Kredit dan promosi layak, pertanyaan, aduan, pemulangan serta rekod perniagaan sesuai. Maklumat berkaitan juga digunakan untuk keselamatan, pencegahan penipuan, kawalan akses, penyelesaian masalah, penyelarasan transaksi dan kewajipan undang-undang.

Bagi had baucar, pelanggan berdaftar dipadankan mengikut akaun. Penggunaan tetamu boleh dipadankan melalui IP yang diperhatikan pelayan bersama e-mel atau nombor mudah alih. Hash berkunci pengecam ini boleh disimpan bersama penebusan untuk mengesan penggunaan berulang. Hash tidak semestinya menjadikan data tanpa nama. Hubungi kami untuk semakan jika padanan salah; ia bukan keputusan muktamad tentang identiti anda.

3. Maklumat wajib, pilihan dan persetujuan

Medan wajib, fail pesanan yang perlu serta butiran pembayaran dan penghantaran mencukupi diperlukan untuk perkhidmatan berkenaan. Tanpanya, kami mungkin tidak dapat mewujudkan akaun, mengesahkan bayaran, menggunakan baucar atau memenuhi pesanan. Medan pilihan boleh dikosongkan. Pembayaran tetamu dan ciri akaun pilihan tersedia setakat yang dibenarkan laman.

Kami memproses dengan persetujuan apabila diperlukan atau atas asas lain yang dibenarkan undang-undang Malaysia, termasuk keperluan melaksanakan transaksi diminta atau kewajipan undang-undang. Notis ini bukan persetujuan menyeluruh untuk aktiviti tidak berkaitan. Jika data sensitif memerlukan persetujuan nyata, kami akan mendapatkannya atau bergantung pada pengecualian sah yang khusus. Dapatkan kuasa perlu apabila memberikan data orang lain dan maklumkan notis ini kepada mereka; kewajipan kami memproses secara sah kekal terpakai.

4. Foto dan kerahsiaan

Hak anda terhadap foto dikekalkan. Akses dihadkan kepada pihak yang memerlukan bahan untuk perkhidmatan, sokongan, keselamatan atau tujuan undang-undang yang dinyatakan. Pesanan memberi kebenaran pemprosesan perlu, bukan penerbitan foto. Kami tidak menggunakan foto pelanggan untuk galeri awam, pengiklanan atau latihan model AI tanpa kebenaran nyata berasingan. Simpan fail asal dan sandaran anda; jangan bergantung pada perkhidmatan ini sebagai satu-satunya arkib foto.

5. Penerima maklumat

Maklumat berkaitan boleh dikongsi dengan kakitangan dibenarkan; penyedia cetakan, kemasan, pengehosan, storan, sandaran, IT dan keselamatan; kurier dan rakan pengambilan; bank serta penyedia pembayaran termasuk peserta FPX/PayNet dan penyedia bayaran balik; penyedia e-mel dan SMS; penasihat profesional; serta pihak berkuasa jika dibenarkan atau diwajibkan undang-undang. Setiap pihak menerima maklumat relevan dengan tugasnya. Kami tidak menjual data peribadi anda.

Kelayakan log masuk bank dan OTP hanya patut dimasukkan melalui proses bank yang sah, bukan dihantar kepada kami. Kami menerima maklumat transaksi untuk penyelarasan, bukan kata laluan perbankan anda. WhatsApp, bank, kurier, peta/alamat atau perkhidmatan anti-bot yang digunakan melalui antara muka masing-masing juga mungkin memproses data menurut notis sendiri. Hubungi kami untuk mengenal pasti penyedia bagi transaksi anda.

6. Kuki dan komunikasi

Kuki atau storan penting menyokong sesi, perlindungan CSRF, troli dan pilihan terpilih. Menyekatnya boleh menghalang log masuk, simpanan atau pembayaran. Gunakan kawalan pelayar untuk mengehadkan atau membuang storan. Penjejakan tidak penting atau pemasaran yang memerlukan persetujuan tertakluk pada pilihan berkenaan dan tidak dibenarkan secara automatik oleh notis ini.

Mesej pesanan, pengesahan, pembayaran, penghantaran dan keselamatan ialah komunikasi perkhidmatan. Jika pemberitahuan SMS dipilih, nombor berkaitan digunakan untuk menghantar mesej itu. Permintaan e-mel baucar hanya mencetuskan e-mel diminta dan bukan langganan pemasaran. Mesej promosi memerlukan kebenaran sesuai serta cara berhenti menerima yang praktikal. Bantah pemasaran langsung atau tarik balik persetujuan melalui arahan mesej atau hubungan kami. Notis penting bagi transaksi sedia ada mungkin masih diperlukan.

7. Simpanan, tempoh dan pemindahan luar negara

Data disimpan hanya selama munasabah perlu untuk tujuan dinyatakan, kewajipan rekod dan pertikaian atau tuntutan sebenar belum selesai. Rekod pesanan dan pembayaran mungkin memerlukan tempoh lebih lama daripada imej sementara. Projek disimpan dan imej berkaitan pesanan boleh kekal apabila diperlukan bagi projek, pemenuhan atau tuntutan. Memadam projek pada akaun tidak semestinya memadam rekod pesanan atau semua sandaran serta-merta. Kami menyemak keperluan simpanan dan mengatur pemadaman selamat atau penanpanamaan apabila tidak lagi perlu. Tiada tarikh pemadaman automatik dijanjikan bagi setiap jenis fail. Hubungi kami tentang tempoh terpakai atau untuk meminta semakan pemadaman.

Sesetengah penyedia atau sistem sokongan/sandaran mungkin memproses data di luar Malaysia. Pemindahan mesti memenuhi keperluan Malaysia, termasuk asas sah serta perlindungan sesuai. Kami menilai perlindungan dan aturan kontrak/keselamatan, bukan menganggap negara lain sentiasa mencukupi. Hubungi kami untuk maklumat penyedia, destinasi dan perlindungan berkaitan data anda. Persetujuan berasingan akan diminta sebelum pemindahan jika diperlukan.

8. Keselamatan dan insiden

Kami menggunakan kawalan akses serta langkah keselamatan sesuai dan menghendaki penyedia berkaitan melindungi maklumat diamanahkan. Tiada perkhidmatan internet bebas risiko. Lindungi kata laluan, e-mel dan peranti, log keluar pada peranti dikongsi serta laporkan akses mencurigakan segera. Kami akan menilai insiden dan memberitahu Pesuruhjaya serta individu terjejas apabila diwajibkan, dalam tempoh undang-undang dan kawal selia berkenaan. Insiden tidak menghapuskan hak anda di sisi undang-undang.

9. Hak dan pelaksanaannya

Hubungi Pegawai Hubungan Privasi di bawah untuk meminta akses atau pembetulan, menarik balik persetujuan, mengehadkan pemprosesan berkaitan, membantah pemasaran langsung atau membuat aduan. Anda boleh meminta penghantaran data kepada pengawal lain apabila hak kemudahalihan berkanun terpakai, tertakluk pada kebolehlaksanaan teknikal dan keserasian format. Pemadaman data tidak lagi perlu boleh diminta untuk semakan; ia tertakluk pada simpanan sah dan hak pihak lain, bukan hak mutlak memadam semua rekod transaksi.

Kami mungkin mengesahkan identiti dan kuasa secara munasabah tanpa pengenalan berlebihan. Sebarang had sah, fi yang ditetapkan atau maklumat tambahan perlu akan dijelaskan, dengan jawapan dalam tempoh terpakai. Penarikan persetujuan mungkin menjejaskan kesinambungan perkhidmatan tetapi tidak membatalkan pemprosesan terdahulu yang sah. Jika tidak berpuas hati, aduan boleh dibuat kepada Pesuruhjaya Perlindungan Data Peribadi Malaysia melalui https://www.pdp.gov.my.

10. Kanak-kanak dan pindaan

Ibu bapa atau penjaga dewasa hendaklah mengurus pesanan melibatkan data kanak-kanak dan memberikan kuasa perlu. Jangan membuka akaun atau membuat pesanan kontrak sendiri jika tiada keupayaan berbuat demikian. Kami tidak bertujuan mengumpul maklumat kanak-kanak melebihi keperluan cetakan diminta.

Notis dikemas kini apabila amalan atau keperluan berubah. Tujuan atau pendedahan baharu yang ketara akan dimaklumkan dan persetujuan tambahan diperoleh jika perlu, bukan dianggap diberikan melalui pindaan notis. Kedua-dua bahasa bertujuan memberikan perlindungan sama. Hubungi kami jika terjemahan kelihatan tidak selaras.

11. Hubungan Privasi

Alamatkan permintaan kepada “Privacy Contact — StoryBook by Loominos Studio”. Nama hubungan ini bukan dakwaan bahawa Pegawai Perlindungan Data berkanun telah dilantik atau didaftarkan.
Loominos Studio
SSM: 201703056580 / 002620744-D
2-1 Jalan Maju 9, Kuchai Entrepreneurs Park, 58200, Kuala Lumpur, Kuala Lumpur, MY
Email / E-mel: general@loominosstudio.my
Telephone / Telefon: 601126688600