Privacy Policy
Last updated: 19 October 2026
[Ohla Patisserie] we run this website. This policy explains what personal data we collect, why we collect it, who we share it with, and your rights under Malaysia’s Personal Data Protection Act 2010 (PDPA).
What we collect
| When | What we collect |
|---|---|
| You place an order | Name, phone number, email address, billing details, the items you order, any celebration message and order notes |
| You choose delivery | Delivery address, the location you pin on the map, and the recipient’s name and phone number |
| You use the contact form | Name, email address and your message |
| You browse the site | Cookies needed for the cart and checkout, and technical data such as your IP address |
You check out as a guest; we do not create customer accounts. We never see or store your card or online banking details. Payments are handled by Billplz.
Why we use it
- To prepare your order and hand it over at pickup or delivery
- To contact you or the recipient about the order
- To calculate the delivery fee from the road distance to your address
- To send order confirmations and reply to your enquiries
- To keep the records the law requires for tax and accounting
We do not sell your personal data, and we do not send you marketing without your consent.
Who we share it with
| Service | What it receives | Why |
|---|---|---|
| Billplz | Name, email, phone and order amount | To process your payment (FPX, e-wallet or card) |
| OpenStreetMap (Nominatim) | The address you type or the location you pin | To find your address on the map |
| OSRM routing service | The shop’s and your delivery location | To measure the road distance for the delivery fee |
| [Courier, if you use one] | Recipient name, phone and address | To deliver your order |
| [Email service, e.g. Gmail or Hostinger Email] | Your email address and order emails | To send order emails |
| Hostinger (website hosting) | Data stored on the website | To run the website |
| Google Fonts and cdnjs (Cloudflare) | Your IP address when a page loads | To load the site’s fonts, icons, map and calendar |
Some of these services may store data outside Malaysia. We only share what each service needs for its task.
Cookies
The site uses cookies that keep your cart and checkout working. Logged-in staff also get WordPress login cookies. We do not use advertising or tracking cookies.
Customer reviews
The homepage shows reviews that customers shared with us on Instagram, together with their Instagram username. We only show a review with the customer’s permission. Contact us to have a review removed.
How long we keep it
We keep order records for 7 years for tax and accounting. Contact form messages are kept for 12 months. After that we delete or anonymise them.
Your rights
Under the PDPA you can ask to see the personal data we hold about you, ask us to correct it, or withdraw consent for us to use it, except where we must keep it by law. Email [privacy email] and we will reply within 21 days.
Changes and contact
We may update this policy and will change the date above when we do.
Questions:
[email protected]
+60 16-412 9471
10, Jalan 19/31,
Seksyen 19,
46300 Petaling Jaya,
Selangor