Privacy Policy

1. About this policy

This policy explains how Kafein (“Kafein”, “we”, “us”) handles personal data when you visit kafein.my, when you use the Kafein app, and when you collect rewards at a shop that runs its loyalty programme on Kafein. We handle personal data in line with the Personal Data Protection Act 2010 (“PDPA”).

The money side of your relationship with us is covered by our Terms and Conditions and Refund Policy.

2. Who this covers

• Merchants and staff — the people who sign a shop up to Kafein and scan at the counter.
• Customers — people collecting stamps or points at a participating shop.
• Visitors — anyone reading this site or registering interest as a merchant.

Each shop runs its own loyalty programme, so for a shop’s customer data the shop decides what is collected and why, and we process it on the shop’s behalf. For our own accounts, billing and website, we decide.

3. What we collect

If you run or work at a shop

• Your name, email address and phone number.
• Your shop’s name, address, outlet details and opening information.
• Your role and access level, and your login credentials.
• Your plan, and payment and invoice records for your subscription. Card details are handled by our payment provider — we don’t store them.
• Support conversations, and the messages you send us.

If you collect rewards at a shop

• Your phone number, which is how you sign in, and your name if you provide it.
• Your stamp or points balance, and the rewards you have unlocked or redeemed.
• The visits recorded at the counter, and which shop recorded them.
• Your contact preferences and consents, including whether you agreed to WhatsApp or push notifications.
• A push notification token, plus basic device and browser details needed to deliver notifications.
• Messages and offers you open or tap on.

If you are just visiting this site

• What you type into the register-interest form: shop name, your name, email and phone number, the plan and billing period you’re interested in, the best time to reach you, and any note you add.
• Basic analytics such as pages viewed, device type and approximate location from your IP address — where analytics is switched on for this site.

Insights built from loyalty data

Shops can build audiences from their own loyalty data — for example “regulars who haven’t been in for 30 days”. That is still your visit and reward data, grouped and filtered. It is visible only to the shop whose programme you are a member of.

4. Where we get it

• Directly from you — forms, sign-up, and messages you send us.
• From the app as you use it — scans, redemptions, notification opens.
• From the shop whose programme you joined.
• From your device and browser — cookies, and a push token if you allow notifications.
• From our providers — for example a payment confirmation from our payment provider.

5. Why we use it

• To run the loyalty programme: create your account, record visits, add stamps or points, and unlock and redeem rewards.
• To show a shop its own members, visits and results, and to let it build audiences and run offers.
• To send messages a shop has asked for — push notifications, WhatsApp and email — including offers from a shop you are a member of.
• To bill merchants, issue invoices and provide support.
• To follow up on the interest you registered, and to set your shop up.
• To keep the Service safe: preventing fraud and abuse, debugging, and monitoring performance.
• To improve Kafein by understanding what is used and what isn’t.
• To meet our legal, tax and accounting obligations.
• To tell you about Kafein itself, where you have asked us to or where we are otherwise allowed to.

6. Consent and your choices

We rely on your consent for marketing and for anything optional, and on our contract with you (or with the shop) and our legal duties for everything else. You can withdraw consent at any time: use the unsubscribe link, reply STOP to a message, or turn notifications off in the app or in your phone settings. Withdrawing consent for something the programme needs — for example your phone number — may mean a shop can no longer record your visits or rewards.

7. Who we share it with

• Providers who run parts of the system. Cloud hosting and delivery, database hosting, push notifications, and email or analytics providers where enabled. They only process data to provide their service to us, under contract.
• The shop you visited. A shop sees the balances, visits, rewards and contact details of its own members, and the messages it has sent them.
• Our payment provider, for merchant subscription billing.
• Authorities, courts or regulators, where the law requires it or where it is needed to protect someone’s safety.
• A buyer or successor, if Kafein is sold or merged — under the same protections described here.

We do not sell personal data, and we do not share your data for another shop’s marketing.

8. Where your data is stored

Our servers and those of our providers may be outside Malaysia — for example in the United States, Europe or the Asia-Pacific region. Where data leaves Malaysia we take reasonable steps to ensure it keeps a comparable level of protection, and we choose providers that contract to protect it.

9. How long we keep it

We keep account and loyalty records while your account, or your shop’s programme, is active, and for as long as we need them for the purposes above. When a shop leaves Kafein, or a customer asks us to delete, we delete or anonymise the data — except where we must keep records for legal, tax or dispute reasons (Malaysian tax records, for example, are kept for seven years).

10. How we protect it

The site and app run over HTTPS. Access to personal data is limited to the people who need it, credentials are stored securely, and a shop can only see its own members. No system is perfectly secure. If a breach affects you, we will notify you and the relevant authorities as the PDPA requires.

11. Your rights

Under the PDPA you can ask us to:

• tell you what personal data we hold about you, and give you a copy;
• correct anything that is inaccurate or out of date;
• stop processing your data, including for direct marketing, or withdraw consent;
• delete data we no longer have a reason to keep; and
• explain how we have handled your data.

Email hello@kafein.my and we will respond within 21 days; if we need longer, we will tell you why. We may need to verify who you are first. Where you are a customer of a shop’s programme, we may pass your request to that shop, since it decides how that data is used. If you are unhappy with how we have handled your request, you can complain to the Personal Data Protection Commissioner (Jabatan Perlindungan Data Peribadi).

12. Cookies and analytics

This site uses only what it needs to work — for example remembering your app settings and keeping the installed app up to date. Analytics tools are switched on only where we have enabled them for this site, and where the law requires consent we ask for it first. You can block or clear cookies in your browser; parts of the app may not work as smoothly if you do.

13. Children

Kafein is not intended for children under 18. If a minor collects rewards at a shop, that shop is responsible for obtaining parental or guardian consent. If you believe a child’s data has reached us, email us and we will remove it.

14. Changes to this policy

If we change how we handle personal data, we will publish the updated policy here with a new “last updated” date, and tell you by email or in the app if the change is significant.