Last updated: 2026-05-26

This Privacy Policy describes how MiriDept Sdn Bhd ("MiriDept", "we", "us", or "our") collects, uses, and protects your personal information when you use the MiriDept Member mobile application (the "App") and related services. This policy is written in line with Malaysia's Personal Data Protection Act 2010 (PDPA).

1. What we collect

When you sign in to the App, we link your usage to your existing MiriDept membership account. The following information may be collected or accessed:

• Membership details — your member number, name, MyKad / identification number, date of birth, gender, race, nationality, email, and mobile number, as stored in MiriDept's existing membership system.
• Loyalty data — your point balance, membership expiry, voucher status, and redemption history.
• Device identifiers — a push notification token (issued by Firebase Cloud Messaging / Apple Push Notification service) so we can deliver notifications to your device. The token does not personally identify you to third parties.
• App interaction data — notifications you have received and read, popups you have viewed, and feedback you submit through the App.
• Feedback submissions — any messages, ticket types, and contact email you provide via the in-app feedback form.

We do not collect your precise location. We do not collect contact lists, photos, or microphone data unless you explicitly attach them when submitting feedback.

2. How we use it

We use your information to:

• Authenticate you and link your App session to your membership account.
• Show you content relevant to your membership (promotions, member-only offers, outlet information, banners).
• Send notifications about offers, account events, and important updates from MiriDept.
• Respond to feedback you submit.
• Maintain the security and integrity of the App and our membership system.

3. How we store it

• All membership and App-interaction data is stored on MiriDept's own systems, located at our premises in Malaysia.
• Push notification tokens are stored in our membership database and are also processed by Firebase Cloud Messaging (Google LLC) for the sole purpose of routing notifications to your device. We do not share any other personal data with Firebase or Google.
• We retain your data for as long as your MiriDept membership is active, and for a reasonable period after account closure as required by accounting, tax, and consumer-protection laws.

4. Who we share with

We do not sell your personal information. We share data only with:

• Firebase Cloud Messaging (Google LLC) and, indirectly, Apple Push Notification service (Apple Inc.), solely to deliver push notifications. Only your device token and the notification payload are processed by these services.
• MiriDept staff and authorised contractors who need access to operate the membership system and respond to your feedback. They are bound by confidentiality obligations.
• Authorities and regulators, if we are legally required to disclose information (for example, in response to a court order or a regulatory investigation).

5. Your rights

Under PDPA you have the right to:

• Access the personal data we hold about you.
• Correct any inaccurate or incomplete personal data.
• Withdraw consent for certain processing activities (such as marketing notifications).
• Limit or stop the processing of your data in specific circumstances.
• Request deletion of your account and associated data, subject to legal retention requirements.

You can exercise these rights by contacting us using the details in section 8. You can also turn off push notifications at any time from your device's system settings.

6. Security

We use industry-standard measures to protect your data: encrypted connections (HTTPS) between the App and our servers, access controls limiting who within MiriDept can view membership data, and regular review of who has access. No system is perfectly secure, but we take reasonable steps to minimise the risk of unauthorised access.

7. Children

The App is intended for MiriDept members aged 18 and above. We do not knowingly collect personal data from anyone under 18. If you believe we hold data about a minor, please contact us so we can delete it.

8. Contact us

If you have questions about this policy, want to exercise your data-protection rights, or wish to raise a complaint about how we handle your data, contact:

• MiriDept Sdn Bhd — [fill in registered address]
• Email — [fill in privacy contact email]
• Data protection officer — [fill in DPO name and contact, if appointed]

9. Changes to this policy

We may update this policy from time to time. When we do, we will revise the "Last updated" date above. Material changes will be communicated through the App or by email to your registered address. Continued use of the App after changes take effect constitutes acceptance of the updated policy.