Privacy Policy

Last updated 5 August 2026. This policy explains how KALIMA GROUP TRADING (M) SDN. BHD. (Company No. 202101012868 / 1413167-V), trading as Kalima, collects and handles your personal data. We are the data user under Malaysia's Personal Data Protection Act 2010 (PDPA), and this notice is given under section 7 of that Act.

What we collect. When you create an account we hold your name, email address, phone number and whether you have consented to marketing. When you place an order we hold your delivery recipient name, phone number and full address, the items ordered and the amount paid. If you join Kalima Club we hold your points balance and tier. If you subscribe to our newsletter we hold your email address, your name if given, and a record of when and where you gave consent. We do not ask for your identity card number, date of birth, or any other information we have no use for.

Payments. Payments are processed by our gateway, LeanX, using FPX online banking and e-wallets. You enter your banking or wallet credentials on your own bank's or provider's page, never on ours. We receive and store only the transaction reference, the amount and whether the payment succeeded. Kalima never sees, holds or stores your card number, online banking password, PIN or TAC.

Delivery. To send you an order we pass your recipient name, phone number and delivery address to our courier partners through EasyParcel. They use it to deliver your parcel and to give you tracking updates, and for nothing else on our instruction.

Messaging. If you message us on WhatsApp, Instagram or Facebook, we store that conversation — the message content, the time it was sent, and the phone number or handle it came from — so our team can answer you and see your order history alongside your question. These conversations reach us through Meta Platforms, whose own terms and privacy policy govern the message while it is in transit. We reply to you; we do not use these conversations to build advertising profiles.

Marketing. We only send marketing email or WhatsApp messages if you have opted in, and every marketing email carries a working unsubscribe link that is unique to you. Withdrawing consent is free and takes effect immediately. Transactional messages about an order you have actually placed — payment received, parcel shipped, tracking number — are not marketing and will still be sent, because you need them.

Cookies and tracking. We use cookies that are necessary for the site to work: keeping you signed in, remembering your cart, and carrying the security token that protects forms from cross-site abuse. Our affiliate programme records that a referral link was clicked, storing only a one-way hash and never your IP address or browser fingerprint — we count clicks, we do not identify visitors. We do not run third-party advertising or cross-site tracking cookies.

Who we share it with. Your data is processed on our behalf by Supabase (database and authentication, hosted in Singapore), Vercel (website hosting), LeanX (payments), EasyParcel (delivery), Resend (transactional email) and Meta Platforms (WhatsApp, Instagram and Facebook messaging). Each receives only what it needs to do its job. We do not sell your personal data, and we do not share it with anyone for their own marketing. We will disclose data where the law requires it or to establish or defend a legal claim.

Transfers outside Malaysia. Some of these providers process data on servers outside Malaysia. Where that happens we rely on the provider's contractual data protection commitments to keep your data protected to a standard comparable to the PDPA.

How long we keep it. Order, payment and delivery records are kept for seven years, because Malaysian tax and company law requires us to. Account details are kept while your account is open. Newsletter records are kept until you unsubscribe, after which we keep a minimal suppression record so we do not accidentally email you again. Customer service conversations are kept for two years.

Your rights. Under the PDPA you may ask us for a copy of the personal data we hold about you, ask us to correct anything inaccurate, ask us to stop using it for marketing, or ask us to delete it where we are not legally required to keep it. Write to hello@kalima.my and we will respond within twenty-one days. If you are not satisfied, you may complain to the Personal Data Protection Commissioner, Malaysia.

Security. Access to customer data is restricted to Kalima staff who need it, enforced at the database level rather than only in the application. Traffic to this site is encrypted in transit. No system is perfectly secure, but we do not store payment credentials at all, which removes the most damaging thing an attacker could take.

Children. This site is not intended for children under 18, and we do not knowingly collect their personal data. If you believe a child has given us data, contact us and we will delete it.

Changes. If we change this policy we will update the date at the top of this page. Material changes affecting how we use data you have already given us will be notified to you directly.

Contact. KALIMA GROUP TRADING (M) SDN. BHD., No. 26-1, Jalan Eco Grandeur 1/8A, Eco Grandeur, Bandar Puncak Alam, 42300 Selangor, Malaysia. Email hello@kalima.my.