Effective date: 1 October 2026 | Version: 1.0
Scope and contact
This Privacy Policy covers the JUZ Coffee Android and iOS app and the services connected to your app account. Juz Coffee (M) Sdn Bhd (202301039822) is responsible for this processing. Contact [hello@juzcoffee.com], the app Help Centre or other available methods with privacy questions. This policy works together with our PDPA Notice, available in English and Bahasa Malaysia.
Account and profile information
We use the account and contact details you provide to identify you, authenticate your account and communicate about the service. This includes your name and the phone number or email used for registration. Profile fields marked optional can be left blank. If you add a photo or other optional profile information, we use it for the feature you select and any purpose explained when we ask for it.
Orders and financial records
We record your selected products and variations, quantities, pickup outlet, order status, transaction time, payment method and reference, refund history, wallet entries, rewards and voucher use. We use these records to fulfil orders, calculate balances, keep transaction history, handle queries, reconcile accounts and detect misuse. A participating outlet receives the order details and information it needs to prepare and hand over your purchase.
Our payment partners handle the payment information needed for the method you select under their own privacy terms. We receive the payment result and relevant transaction references. Never send card security codes, passwords, or one-time verification codes to customer support.
Technical and support information
The app and its supporting systems process technical information needed to maintain service and investigate faults, including device or session identifiers, app and operating system versions, IP addresses, request logs and crash diagnostics. Support correspondence may include your account or order details and any information or attachments you choose to send. We use these records to investigate issues, improve reliability and protect accounts and transactions.
Device permissions
We ask for device permissions only when they are needed for an enabled feature, and explain the purpose at that point. Location, if enabled, helps you find or select a nearby outlet. You can select an outlet manually instead. Camera or photo access, if enabled, is limited to the feature you choose, such as adding a profile image or a support attachment. Notification permission lets us deliver enabled order alerts and, if you separately opt in, promotional messages.
You can change permissions in your device settings. A declined permission affects only the feature that needs it. We do not require access to your contacts, microphone or background location for ordinary coffee ordering.
Marketing and preferences
We send promotions through the channels you select, such as app push notifications, email, SMS or WhatsApp where offered. Each channel is optional. You can change marketing preferences in the app or use the unsubscribe or contact method in a message. We retain a minimal record of an opt-out where needed to honour it. Essential order, payment, security and account messages are separate from promotional messages.
We may use your order and reward activity within JUZ Coffee to show relevant offers where this use has been disclosed and is permitted. Any optional advertising tracking across other companies’ apps or services requires a separate disclosure and any required consent, including the relevant iOS permission. Accepting our Terms of Service does not grant permission for that tracking.
Service providers and disclosures
We use providers for payment processing, hosting, app maintenance, messaging, security and support. Where analytics providers are used, their data collection and purposes must be identified in the provider details below. Providers acting on our instructions receive only information needed for their work and must apply appropriate contractual and security protections. Payment partners may also act as independent data controllers for their own lawful obligations.
We may disclose relevant records to professional advisers, auditors and authorities where required or lawfully necessary. A business transfer may require relevant account records to pass to a new operator, with appropriate protection and notice. We do not sell personal data or allow unrelated brands to use your details for their own marketing without a separate lawful basis and any required consent.
If information is transferred outside Malaysia, we assess the applicable legal basis and safeguards before transfer. A general acceptance of these terms is not a substitute for that assessment.
Retention and security
We keep account information while needed to provide your account. Transaction, wallet, and refund records may be kept longer where accounting laws, disputes, or fraud investigations require it. Support records are retained for the period needed to resolve and review the issue. Diagnostic records have a separate, limited retention period. We securely delete or anonymise data when it is no longer needed, including through the applicable backup deletion cycle.
We apply appropriate access controls, secure transmission, staff access restrictions and service provider safeguards. No system is risk-free. If a personal data breach occurs, we investigate, take steps to limit its impact and notify the Commissioner and affected individuals where required by applicable law.
Your rights and requests
You can ask to access or correct personal data, withdraw consent, stop direct marketing, or exercise any other applicable PDPA right. You can also make a written electronic request to transmit your data directly to another data controller, subject to technical feasibility, compatible formats and legal requirements. Contact [hello@juzcoffee.com] or the Help Centre. We use proportionate identity checks and respond within applicable legal time limits. If we cannot fulfil a request, we explain the reason and available next steps.
Withdrawal does not invalidate processing already carried out lawfully. If you withdraw consent for information needed to maintain an account or fulfil an order, we explain the effect on that service. We do not treat withdrawal of marketing consent as withdrawal from ordering.
Account deletion
Start deletion using the Delete Account option in the app. Uninstalling the app does not delete your account. We verify the request, explain how any outstanding orders, paid wallet balance, or refunds will be resolved, and process account deletion without unnecessary delay. Temporary account deactivation is not a substitute for deletion.
We delete associated personal data except records we must retain for identified legal, accounting, dispute or security reasons. We explain those categories and their retention periods when responding. Resolving a paid balance must not create an indefinite obstacle to deletion. Any handling of rewards or promotional credit follows the disclosed programme terms and cannot override your statutory rights.
Children
The app is intended for adult account holders. A parent or guardian should place and manage orders for a child. If we discover that a child has provided personal data without any required parental or guardian consent, we take appropriate steps to verify the situation and remove information we have no lawful reason to keep. Contact [hello@juzcoffee.com] if this concerns your child.
Social links and changes
When you choose to open Facebook, Instagram, TikTok, YouTube or another external service, that service applies its own privacy terms. Opening a social post does not authorise JUZ Coffee to access your social account. We may update this policy when our services or data practices change. We publish the new effective date, give appropriate notice of material changes, and obtain fresh consent where required before a new use begins.