Legal
Privacy & Cookie Policy
This Privacy & Cookie Policy explains how Coffee Star® Malaysia (“Coffee Star”, “we”, “us”, “our”) collects, uses, discloses, and protects your personal data when you visit coffeestar.my, contact us, or use our products and services. We are committed to handling your data in line with Malaysia’s Personal Data Protection Act 2010 (PDPA), the EU/UK General Data Protection Regulation (GDPR), and the California Consumer Privacy Act as amended by the CPRA (CCPA/CPRA).
1. Who we are (Data Controller)
The data controller responsible for your personal data is:
trading as Coffee Star® Malaysia
1-17-G, Space U8, Bukit Jelutong, 40150 Shah Alam, Selangor, Malaysia
Email: wecare@coffeestar.my · Phone: +60 3 2770 0117
2. Information we collect
Information you give us
- Contact & enquiry data — name, email, phone, company, and message when you submit a form, request a free trial/demo, or chat with us.
- Service data — delivery address, site details, and preferences needed to provide a machine, subscription, or supplies.
Information collected automatically
- Usage & device data — IP address, browser/device type, pages viewed, referring URLs, and interactions, via cookies and similar technologies (see Section 6).
- Live chat data — messages and metadata when you use our chat widget (provided by HubSpot).
3. How we use your information & purposes
- To respond to enquiries, provide quotes, demos, and free trials.
- To deliver, support, and bill for our products and services.
- To operate, secure, and improve our website and services.
- To send service updates and — where permitted — marketing you can opt out of at any time.
- To comply with legal, tax, and regulatory obligations.
4. Legal bases for processing (GDPR)
Where the GDPR applies, we rely on: consent (e.g., marketing, non-essential cookies); contract (to provide services you request); legal obligation (e.g., accounting); and legitimate interests (to run and secure our business), balanced against your rights.
5. Sharing & disclosure
We do not sell your personal data. We share it only with: service providers acting on our behalf (e.g., hosting, analytics, HubSpot for CRM/chat, payment and logistics partners) under confidentiality terms; professional advisers; and authorities where required by law. We require all processors to protect your data and use it only for the purposes we specify.
6. Cookies & similar technologies
Cookies are small files stored on your device. We use them to make the site work, understand usage, and (with consent) support marketing.
| Type | Purpose | Examples |
|---|---|---|
| Strictly necessary | Core functionality, security, caching. Always on. | WordPress session, LiteSpeed cache |
| Functional | Remember preferences (e.g., language EN/BM), enable live chat. | Language toggle, HubSpot chat |
| Analytics | Measure traffic and improve the site (aggregated). | Google/Site Kit analytics |
| Marketing | Measure campaigns and relevance (only with consent). | HubSpot tracking |
You can manage or block cookies via your browser settings. Blocking some cookies may affect site functionality. Where required, we request your consent before setting non-essential cookies.
7. International data transfers
Some providers (e.g., HubSpot) process data outside Malaysia, including in the United States and EU. Where we transfer personal data internationally, we use appropriate safeguards such as Standard Contractual Clauses and provider compliance programs to protect your data consistent with the PDPA and GDPR.
8. Data retention
We keep personal data only as long as necessary for the purposes above or as required by law (e.g., tax records). When no longer needed, we securely delete or anonymise it.
9. Security
We use technical and organisational measures — encryption in transit (HTTPS), access controls, and trusted providers — to protect your data. No method of transmission is 100% secure, but we work to safeguard it and respond promptly to incidents.
10. Your rights — Malaysia (PDPA 2010)
Under the PDPA you may: access and correct your personal data; withdraw consent; limit processing for direct marketing; and enquire about disclosures. We will respond within the timeframes set by the PDPA. To exercise these rights, contact wecare@coffeestar.my.
11. Your rights — EU/UK (GDPR)
If you are in the EU/UK, you have the right to: access; rectification; erasure (“right to be forgotten”); restriction; data portability; objection (including to direct marketing); and to withdraw consent. You may also lodge a complaint with your local supervisory authority.
12. Your rights — California (CCPA/CPRA)
California residents have the right to: know what personal information we collect and how it’s used; access and delete it; correct inaccurate information; and opt out of “sale” or “sharing” of personal information. We do not sell or share personal information as defined by the CCPA/CPRA. We will not discriminate against you for exercising your rights. To make a request, email wecare@coffeestar.my with “California Privacy Request” in the subject.
13. Children’s privacy
Our site and services are intended for businesses and adults. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.
14. Changes to this policy
We may update this policy from time to time. The “Last updated” date above reflects the latest version. Material changes will be highlighted on this page.
15. Contact us
For any privacy question or to exercise your rights, contact our team:
Email: wecare@coffeestar.my · Phone: +60 3 2770 0117
1-17-G, Space U8, Bukit Jelutong, 40150 Shah Alam, Selangor, Malaysia
