Privacy Policy

This Privacy Policy and Personal Data Protection Notice explains how H O W Enterprise Sdn. Bhd. collects, uses, stores, discloses, transfers, and protects your personal data when you visit, browse, create an account, place an order, contact us, subscribe to our communications, or otherwise interact with SunflowerAroma.

We issue this Notice in accordance with the Malaysian Personal Data Protection Act 2010, including applicable amendments, regulations, standards, codes of practice, and guidelines issued under it.

By using our website or providing personal data to us, you acknowledge that you have read and understood this Notice. Where we rely on consent, you may withdraw your consent as described in this Notice, subject to legal or contractual restrictions and reasonable notice.

SunflowerAroma is operated by H O W Enterprise Sdn. Bhd., company registration number 201601022126 (1193065-M), with its registered business address at Lot 9930, No. 86, 1st Floor, Block J, RH Plaza, Jalan Lapangan Terbang, Kuching, Sarawak 93250, Malaysia. For the purposes of Malaysian personal data protection law, we are the data controller responsible for personal data that we collect and process in connection with this website and our ecommerce services.

If you have questions about this Notice or how we handle personal data, you may contact us at [email protected].

The personal data we collect depends on how you interact with us. We only collect personal data that is reasonably necessary for our business, ecommerce, customer service, security, marketing, analytics, and legal purposes.

• Identity data, such as your name and account profile details.
• Contact data, such as email address, phone number, billing address, and shipping address.
• Account data, such as login identifiers, authentication status, account preferences, saved addresses, wishlist activity, and order history.
• Order and transaction data, such as products purchased, cart information, payment status, refund records, delivery status, and transaction references.
• Customer support data, such as messages, requests, complaints, reviews, returns, exchanges, and related correspondence.
• Technical data, such as IP address, browser type, device information, operating system, referring pages, pages viewed, approximate location derived from technical data, logs, and security events.
• Marketing and preference data, such as newsletter subscription status, consent records, product interests, and communication preferences.
• Cookie and analytics data, such as session identifiers, cart/session cookies, website usage data, and analytics events.

We do not intentionally collect sensitive personal data unless it is necessary for a specific purpose or you voluntarily provide it to us. Sensitive personal data may include information about health, medical conditions, religious beliefs, political opinions, criminal records, or similar protected categories.

If you choose to provide information about allergies, sensitivities, skin concerns, pregnancy, medical conditions, or other health-related matters when contacting us or reviewing products, we will use it only for the purpose for which it was provided, such as responding to your request. Our products and website content are not a substitute for professional medical advice.

We may collect personal data from the following sources:

• Directly from you when you create an account, place an order, submit a form, leave a review, subscribe to marketing, contact customer support, or otherwise communicate with us.
• Automatically through cookies, server logs, analytics tools, security tools, and similar technologies when you use our website.
• From payment processors, delivery partners, authentication providers, ecommerce infrastructure providers, customer support tools, marketing platforms, or other service providers that support our business.
• From public sources or third-party platforms where you interact with our official pages, campaigns, or advertisements.

We may collect, use, disclose, store, or otherwise process personal data for the following purposes:

• To create, verify, secure, and manage your account.
• To process orders, payments, refunds, returns, exchanges, delivery, and customer service requests.
• To communicate with you about your account, cart, orders, payment status, delivery status, returns, support requests, and important service updates.
• To personalize your shopping experience, remember preferences, maintain carts and wishlists, and improve website usability.
• To verify transactions, prevent fraud, detect abuse, protect our website, troubleshoot errors, and maintain system security.
• To manage product reviews, feedback, surveys, promotions, campaigns, and loyalty or referral activities.
• To send marketing communications, promotional offers, product updates, or newsletters where you have consented or where applicable law allows us to do so.
• To analyze website performance, customer behavior, product demand, campaign performance, and business operations.
• To maintain business, tax, accounting, audit, compliance, and legal records.
• To comply with applicable laws, regulations, court orders, regulatory requests, enforcement requests, or legal processes.
• To protect our legal rights, enforce our terms, resolve disputes, and manage risk.

Some personal data is mandatory because we need it to provide the website, process purchases, arrange delivery, respond to support requests, prevent fraud, or comply with legal and accounting obligations.

If you do not provide mandatory personal data, we may be unable to create or maintain your account, process your order, collect payment, arrange delivery, issue refunds, respond to your requests, or provide certain parts of the Service.

Personal data for direct marketing, non-essential cookies, surveys, reviews, or optional promotions is generally voluntary. Refusing or withdrawing consent for these optional activities will not prevent you from purchasing products, but it may limit certain optional features or communications.

We may disclose personal data to the following categories of parties, only where reasonably necessary for the purposes described in this Notice or where permitted or required by law:

• Payment gateways, banks, card networks, fraud screening providers, and payment processors.
• Delivery companies, fulfilment partners, warehouse partners, and logistics providers.
• Website hosting providers, cloud infrastructure providers, database providers, CDN providers, ecommerce platform providers, and technical support vendors.
• Email, SMS, WhatsApp, push notification, customer support, CRM, analytics, advertising, and marketing service providers.
• Authentication, security, monitoring, logging, and fraud prevention service providers.
• Professional advisers, auditors, accountants, insurers, bankers, lawyers, consultants, and other representatives.
• Government authorities, regulators, courts, law enforcement agencies, dispute resolution bodies, or parties involved in legal proceedings.
• Business partners or successors in connection with a merger, acquisition, restructuring, sale of assets, investment, financing, or transfer of all or part of our business, subject to appropriate safeguards.

Payments may be processed by third-party payment gateways or payment processors. We may receive payment status, transaction references, masked payment details, refund status, and fraud screening information, but we do not intend to store your full payment card number or full card security code on our own systems.

Your payment information is handled by the relevant payment provider according to its own terms, privacy notice, and security standards. Please review the payment provider notices where applicable.

We use cookies and similar technologies to operate the website, keep you signed in, maintain your cart, remember preferences, understand website performance, secure the Service, and support marketing or analytics activities.

Cookies used on our website may include strictly necessary cookies, functionality cookies, analytics cookies, security cookies, and marketing cookies. Some cookies are set by us, and others may be set by service providers such as analytics, advertising, payment, authentication, or customer support tools.

You can control cookies through your browser settings. If you block strictly necessary cookies, parts of the website, checkout, account, cart, or security functions may not work properly. Where required by applicable law, we will request your consent before using non-essential cookies.

We may send you marketing emails, product updates, promotions, or newsletters if you have subscribed, consented, or where applicable law permits us to do so.

You may opt out of marketing communications at any time by using the unsubscribe instructions in our messages or by contacting us at [email protected]. We may still send non-marketing communications, such as order confirmations, delivery updates, security notices, account notices, and service-related messages.

We may transfer, store, or process personal data outside Malaysia where our service providers, hosting providers, payment processors, analytics providers, communication tools, or business partners are located outside Malaysia or use infrastructure outside Malaysia.

Where personal data is transferred outside Malaysia, we will take reasonable steps to ensure that the receiving party protects the personal data in a manner consistent with Malaysian personal data protection requirements, including through contractual safeguards, security measures, due diligence, or other lawful transfer mechanisms where applicable.

We take reasonable technical and organizational measures to protect personal data against loss, misuse, unauthorized access, disclosure, alteration, and destruction. These measures may include access controls, encrypted transmission, secure authentication, vendor controls, logging, monitoring, backups, and staff or contractor confidentiality obligations.

No website, payment system, email, or online transmission is completely secure. You are responsible for keeping your account login details confidential and for notifying us promptly if you believe your account or personal data may have been compromised.

We retain personal data only for as long as it is necessary for the purposes described in this Notice, unless a longer retention period is required or permitted by law.

Order, payment, tax, accounting, audit, legal, and dispute records may be retained for the period required for business records, statutory compliance, tax, accounting, audit, dispute resolution, and legal purposes. This period may typically be up to seven years where required for accounting, tax, or legal records.

Account data may be retained while your account remains active and for a reasonable period after account closure where needed for legal, security, fraud prevention, accounting, or dispute resolution purposes. Marketing data is retained until you unsubscribe, withdraw consent, or the data is no longer required.

When personal data is no longer required, we will take reasonable steps to securely delete, destroy, anonymize, or permanently de-identify it.

Subject to the PDPA and applicable legal restrictions, you may have the following rights in relation to your personal data:

• Request access to personal data that we hold about you.
• Request correction of personal data that is inaccurate, incomplete, misleading, or not up to date.
• Withdraw consent for processing that is based on consent, subject to legal or contractual restrictions and reasonable notice.
• Request that we limit or stop processing personal data for direct marketing.
• Object to or restrict certain processing where permitted by law.
• Request deletion or anonymization where the personal data is no longer required and we have no legal basis to retain it.
• Request data portability where applicable, technically feasible, and required under Malaysian personal data protection law.
• Make a complaint to us or to the relevant Malaysian personal data protection authority.

To make a request, contact us at [email protected]. We may need to verify your identity before responding to your request. We may also ask for additional information to help us locate the relevant records.

We will respond within the timeframe required by applicable law. In some cases, we may refuse a request or charge a fee where permitted by law, such as where a request is repetitive, excessive, unsupported, or legally restricted. If we refuse a request, we will explain the reason where required.

If we become aware of a personal data breach that is required to be notified under Malaysian personal data protection law, we will take reasonable steps to assess, contain, investigate, and remediate the breach.

Where required, we will notify the Personal Data Protection Commissioner and affected individuals in accordance with the PDPA and applicable guidance issued by the Commissioner.

Our website and products are not intended for children. We do not knowingly collect personal data from children without appropriate consent from a parent or legal guardian where required by law.

If you believe that a child has provided personal data to us without appropriate consent, please contact us at [email protected] so that we can review and take appropriate action.

Our website may contain links to third-party websites, platforms, payment services, delivery tracking pages, social media pages, or other external services. We are not responsible for the privacy practices, content, or security of third-party websites or services.

Please review the privacy notices of those third parties before providing personal data to them.

We may update this Notice from time to time to reflect changes in our practices, technologies, legal requirements, service providers, or business operations.

The updated version will be posted on this page with a revised last updated date. Your continued use of the website after an updated Notice is posted means you acknowledge the updated Notice.

If you have any questions, requests, complaints, or concerns about this Notice or our handling of personal data, please contact H O W Enterprise Sdn. Bhd. at [email protected].

Please include enough information for us to identify you and understand your request. Do not send sensitive information unless it is necessary for your request.