Privacy Policy

Flowbase Bakehouse Sdn. Bhd. (Company No. 202101037245 (1423867-P), "Flowbase", "we", "us") operates the website flowbase.my. This policy explains what personal data we collect, why we collect it, and the choices you have. It is written to comply with Malaysia's Personal Data Protection Act 2010 ("PDPA") and, where relevant to overseas visitors, comparable data protection principles.

1. Data we collect

We collect only what an order or enquiry genuinely requires:

• Enquiry details — your name, email address, optional mobile number, requested date and the content of your message, submitted through our contact form.
• Order records — delivery addresses, dietary notes, payment references and invoicing details for confirmed orders.
• Technical data — basic server logs (IP address, browser type, pages visited) generated automatically when you browse, and cookies as described in our Cookie Policy.

We do not collect data from children knowingly, and we never ask for identity card numbers or banking credentials through this website.

2. How we use it

Your data is used to respond to enquiries, prepare quotes, fulfil and deliver orders, issue invoices, meet tax and accounting obligations, and — only if you have expressly agreed — send occasional news about seasonal menus. We do not sell, rent or trade personal data to anyone, and we do not use it for automated profiling.

3. Who can see it

Access is limited to Flowbase staff who need it to serve you. We share limited data with third parties only where fulfilment requires it: our chilled-delivery partner receives the recipient name, address and phone number for a delivery; our accountant and the Inland Revenue Board may see invoice records; and our web hosting provider stores the site's data on servers it operates. Each party is bound by contract or law to protect the data it handles.

4. How long we keep it

Enquiry messages that do not become orders are deleted within twelve months. Order and invoicing records are retained for seven years as required by Malaysian tax law, then securely destroyed. Server logs rotate automatically after ninety days.

5. Security

Data is stored on access-controlled systems, transmitted over encrypted connections, and backed up in encrypted form. No system is infallible, but we review our safeguards annually and after any incident.

6. Your rights under the PDPA

You may request access to the personal data we hold about you, ask us to correct it, withdraw consent to marketing at any time, or ask us to delete data we are not legally required to keep. Write to [email protected] with "Data Request" in the subject line and we will respond within twenty-one days.

7. Changes to this policy

If we change how we handle personal data, the revised policy appears on this page with a new revision date. Material changes affecting existing customers are notified by email.

8. Contact

Data protection questions: Flowbase Bakehouse Sdn. Bhd., 27, Jalan Telawi 3, Bangsar Baru, 59100 Kuala Lumpur, Malaysia · +60 3-2110 4382 · [email protected].