Privacy Policy

Effective Date: 01 February 2026
Last Updated: 01 February 2026

STUDIO GEMALA (CA0354404-A), together with its related brands and platforms (including but not limited to gempikat.com) (“Company”, “we”, “us”, or “our”), respects your privacy and is committed to safeguarding your personal data in accordance with the Personal Data Protection Act 2010 (PDPA) of Malaysia.

This Privacy Policy explains how we collect, use, store, disclose, and protect your personal information when you interact with our websites, services, events, and marketing activities.

1. Types of Personal Data We Collect and How It Is Obtained

In the course of our business activities, we may collect and process personal data including, but not limited to, the following categories:

a. Identity Information

Such as your name, age, date of birth, gender, identification details (e.g. MyKad or passport number for verification or contest purposes), and preferred language.
Source: Information provided directly by you through forms, registrations, or submissions.

b. Contact Information

Including billing address, delivery address, email address, and contact number.
Source: Provided by you during account registration, checkout, or inquiries.

c. Transaction Information

Details relating to purchases, order history, payment methods, and participation in loyalty programmes.
Source: Generated automatically when transactions are carried out.

d. Event and Media Information

Photographs, videos, or audio recordings captured during events, promotions, contests, or campaigns organised or supported by the Company.
Source: Recorded during physical or digital events.

e. Technical and Usage Information

Including IP address, browser type, operating system, and data collected through cookies or similar technologies.
Source: Collected automatically when you access or browse our websites.

f. Marketing and Engagement Information

Your communication preferences, responses to marketing campaigns, and interactions with our social media channels or marketing platforms.
Source: Provided by you directly or generated via our CRM and marketing systems.

Mandatory Data:
Certain information such as your name, contact details, and payment information is required for us to fulfil orders, manage accounts, or administer contests. If such data is not provided, we may be unable to deliver the requested products or services.

2. Purposes for Processing Personal Data

Your personal data is processed strictly for legitimate business purposes, including:

  • Order Fulfilment and Account Management
    To process purchases, manage user accounts, deliver products, and provide customer support.

  • Marketing and Communications
    To send promotional messages, newsletters, product updates, and personalised offers, where you have consented.

  • Loyalty and Rewards Administration
    To track transactions, calculate rewards, and manage loyalty or membership programmes across our brands.

  • Business Analytics and Improvement
    To analyse customer behaviour and improve our products, services, platforms, and overall customer experience.

  • Promotional and Publicity Use
    To use images, videos, or recordings captured during events for marketing, advertising, and public relations purposes across various media channels, without compensation.

  • Legal and Regulatory Compliance
    To meet legal obligations, prevent fraud, and comply with applicable laws, regulations, audits, or governmental requests.

We do not process personal data for purposes beyond those stated above unless required or permitted by law.

3. Disclosure and Sharing of Personal Data

Your personal data may be shared with trusted third parties for the purposes outlined above, including:

  • Affiliated Companies
    Our holding company, subsidiaries, and related entities, whether located in or outside Malaysia.

  • Service Providers
    Vendors that support our operations such as CRM systems, loyalty platforms, EDM tools, website hosting, cloud services, and IT infrastructure providers.

  • Business and Operational Partners
    Logistics providers, couriers, payment gateways, and financial institutions involved in order fulfilment and payment processing.

  • Marketing and Event Partners
    Co-organisers or sponsors of campaigns, promotions, or events.

  • Professional Advisors and Authorities
    External auditors, legal advisors, consultants, regulators, and law enforcement agencies, where required by law.

Cross-Border Transfers

Some of our service providers may be located outside Malaysia. Where personal data is transferred internationally, we take reasonable measures to ensure that adequate data protection standards are in place or that your consent has been obtained.

4. Data Security, Retention, and Accuracy

Security Measures

We implement reasonable administrative, technical, and physical safeguards to protect your personal data against unauthorised access, loss, misuse, alteration, or disclosure. These include controlled access, secure servers, encryption, and internal data protection policies.

Retention

Personal data is retained only for as long as necessary to fulfil the purposes for which it was collected or to meet legal and regulatory requirements. Once no longer required, data will be securely deleted or destroyed.

Data Accuracy

We take reasonable steps to ensure that personal data is accurate, complete, and up-to-date. You are encouraged to inform us if any of your information changes.

5. Cookies and Automated Technologies

Our websites use cookies and similar technologies to enhance functionality and user experience. These may be used for:

  • Essential Operations
    Such as maintaining login sessions, shopping cart functionality, and site security.

  • Analytics and Personalisation
    To analyse website traffic, understand user behaviour, and customise content or advertisements.

You may manage or disable cookies through your browser settings. Please note that disabling essential cookies may affect website performance and functionality.

6. Your Rights Under PDPA

Subject to applicable laws, you have the right to:

  • Request access to your personal data held by us

  • Request correction of inaccurate, incomplete, or outdated information

  • Withdraw consent for specific data processing activities, including marketing communications

Requests will be handled within the time period prescribed under the PDPA.

7. Updates, Enquiries, and Contact Details

We reserve the right to amend this Privacy Policy from time to time. Any updates will be published on our website, and continued use of our services constitutes acceptance of the revised policy.

For enquiries, complaints, or requests relating to personal data access, correction, or withdrawal of consent, please contact:

Customer Service
gempikat@gmail.com