No MOQ · 1-20 pcs printed in 3-5 working days · Self-collect in Denai Alam

Privacy Policy

Last updated 28 September 2026

What changed: we now describe the order reports we send to Google, Meta, TikTok and OpenAI, our 90-day visit cookie, how long we keep visit records, the Meta ad details we keep with WhatsApp chats, how we tell Google when a visitor from its ads starts a WhatsApp chat, and that our own visit record notes whether you stayed or tapped our phone number.

1. Introduction

BISHH MALAYSIA SDN. BHD. (trading as BISHH) respects your privacy and processes personal data in connection with commercial transactions in accordance with the Personal Data Protection Act 2010 ("PDPA") and related rules, guidelines, and lawful business needs.

This Notice explains what personal data we collect, how we use it, who we may disclose it to, the choices available to you, and how you may contact us regarding your personal data.

2. Categories of personal data

The personal data we process may include:

  • Your name and (if applicable) company name
  • Billing and shipping address
  • Phone number (including WhatsApp number, used for OTP and order updates)
  • Email address
  • Order history and transaction records
  • Uploaded artwork, design files, and previews
  • Chat, WhatsApp, and customer service communication records
  • Payment status information (the payment card/FPX details themselves are processed and stored by the payment gateway, not by BISHH)
  • Device and browser information, IP address, and website usage information
  • Records of your visits to our website: the page you landed on, the site or ad that sent you, and the ad click reference in an ad link (such as Google's click ID)
  • Any other information reasonably required for the purposes below

3. Sources of personal data

Personal data may be collected directly from you through website forms, checkout, account registration, WhatsApp OTP verification, email, social media, live chat, order submissions, and customer support communications. It may also be obtained from payment gateways, couriers, e-commerce platform operators (such as Shopee when you link a Shopee order to your BISHH account), or other service providers involved in your transaction where relevant and lawful.

If you message us on WhatsApp after tapping one of our ads on Facebook or Instagram, Meta tells us which ad you tapped: the ad's ID, headline and link, and a click reference. We keep this with your chat so we can see which ads bring enquiries.

Optional TikTok connection for creators

Added 14 September 2026. If you choose Connect TikTok in your BISHH creator profile, TikTok asks you to authorize access to your basic profile and public videos. We receive your TikTok account identifier, display name, avatar, public video metadata and links, and authorization tokens. We use these to connect your TikTok account to your creator profile and show your name, avatar and up to six recent public videos to visitors of your public BISHH creator page. Connecting is optional.

While connected, we check for updates approximately every two hours and when you select Sync now. Tokens are encrypted on our server and are not shown to visitors. Videos play through TikTok's player; we do not host copies of the video files. Loading profile images, thumbnails or the player contacts TikTok and its delivery providers, which may process browser, device and usage information under their own privacy policies. The player loads when a visitor selects Play.

Disconnect TikTok in your BISHH creator profile settings to stop updates and remove its tokens and synchronized profile and feed from our active connection storage. We also request revocation at TikTok; if that request cannot be confirmed, the dashboard asks you to remove BISHH access in TikTok's account permissions. If TikTok authorization stops working, the feed is hidden when that failure is detected. Minimal connection status and security records may remain subject to the retention provisions below. For help removing your connected TikTok data, contact sales@bishhmalaysia.com.

4. Purposes of processing

BISHH may process your personal data to:

  • Create and manage your account
  • Process and fulfil orders, including custom artwork production
  • Verify payments and prevent fraud
  • Arrange shipping and delivery
  • Communicate order updates via email, WhatsApp, or SMS
  • Respond to enquiries or complaints
  • Handle defects, reprints, refunds, and disputes
  • Improve website functionality and service quality
  • Measure which of our ads lead to enquiries and sales, including by reporting paid orders and WhatsApp chats to the ad networks named in section 6
  • Carry out internal reporting and record-keeping
  • Comply with legal, tax, accounting, regulatory, and enforcement obligations
  • Where permitted and opted-in, send marketing or promotional communications

5. Whether supply is obligatory or voluntary

Some personal data is obligatory for us to accept, process, fulfil, deliver, or support your order. This includes your name, shipping address, phone number, and email. If you do not provide required data, we may be unable to process your order, ship the goods, issue an invoice, respond effectively to a claim, or otherwise provide the requested service.

Other information is voluntary and used to improve your experience or tailor communications (for example, design preferences, marketing opt-ins, and optional profile fields).

6. Disclosure to third parties

Your personal data may be disclosed to the following classes of third parties, identified where known:

  • Payment gateways and banks: Airwallex (Malaysia) Sdn Bhd (licensed Malaysian payment service provider) for processing card / FPX / e-wallet payments, and the acquiring banks behind each method for settlement.
  • Couriers and logistics partners: EasyParcel Sdn Bhd (and its sub-couriers: Poslaju, DHL eCommerce, Skynet, City-Link, etc.), and Shopee Express / Shopee logistics for orders placed via Shopee.
  • Cloud infrastructure and storage providers: Vercel (hosting), Railway (API hosting), Neon (managed Postgres), Cloudflare R2 (object storage for uploaded designs and production assets).
  • Communications providers: Resend (transactional email), WhatsApp Business (OTP and order updates), SMS gateways where used.
  • E-commerce platform operators: Shopee Mobile Malaysia where you place an order via the Shopee marketplace.
  • Analytics and marketing vendors:where used, identified in our Cookie & Tracking Notice. This includes OpenAI (added 24 September 2026): if you accept cookies, its ChatGPT Ads measurement pixel receives your order number, the items and the order total, plus your IP address and basic device and browser details, so we can see which of our ads on ChatGPT led to a sale.
  • Ad networks, for paid orders (added 25 September 2026): when you pay for an order, our own servers report the sale so the network can see which of our ads led to it. This happens whether or not you accepted optional cookies.
    • Google (Google Ads), only for an order that came from one of our Google ads: the ad click reference from the link you clicked, our order number, the order value and the time you paid. No name or contact details. If you start a WhatsApp chat with us from our website after clicking one of our Google ads, we tell Google the ad click reference and the time the chat started. We do not send your name, number or messages.
    • Meta (Facebook and Instagram), for every paid order: a scrambled (hashed) copy of your email address, phone number, first and last name, city, state, postcode and country (and of your BISHH account ID, if you have one), plus your IP address and browser type, the order number, the items and the order value.
    • TikTok, for every paid order: a scrambled (hashed) copy of your email address and phone number, plus your IP address and browser type, the order number, the items and the order value.
    • OpenAI (ChatGPT ads), only for an order that came from one of our ads on ChatGPT: the ad click reference from the link you clicked, our order number, the order value and the time you paid. No name or contact details.
    The Cookie & Tracking Notice (section 2.5) has the details.
  • Professional advisers, auditors, and insurers for the proper conduct of our business.
  • Authorities or regulators where required by law or reasonably necessary to protect legal rights.

7. Marketing and choice

Where marketing communications are sent, BISHH provides a clear method for you to opt out or limit such processing, including an unsubscribe link in every marketing email, reply-based opt-out for WhatsApp, or a contact request to sales@bishhmalaysia.com. Operational and transactional messages relating to your order may still be sent where necessary.

For questions about the order and chat reports to Google, Meta, TikTok and OpenAI (section 6), or to ask us to delete the record of your visits to our website, contact sales@bishhmalaysia.com. Details already sent are held by those networks under their own privacy policies.

8. Cross-border processing

Some service providers used by BISHH may store or process personal data outside Malaysia. These include providers based in the United States (Vercel, Neon, Resend, OpenAI), the United Kingdom or EU (where applicable), and a global edge network (Cloudflare R2). The ad networks named in section 6 (Google, Meta, TikTok, OpenAI) also process data outside Malaysia. Where this occurs, we take reasonable steps to ensure personal data is handled with appropriate safeguards and in accordance with applicable law and guidance, including contractual data-processing commitments with each provider.

9. Security

BISHH takes practical steps to protect personal data from loss, misuse, unauthorised access, modification, disclosure, or destruction, having regard to the nature of the data and the harm that could result from a security incident. These steps include:

  • HTTPS/TLS for all data in transit
  • Encrypted database storage and access controls
  • Role-based staff access and least-privilege principles
  • Secure payment integrations (payment card details never stored on our systems)
  • Regular software updates and security reviews
  • WhatsApp OTP for account verification

10. Data breach notification

In the event of a personal data breach likely to result in significant harm, BISHH will notify the Personal Data Protection Commissioner and affected individuals without undue delay and in any event within the timeframe required under the PDPA and its 2024/2025 amendments.

11. Retention

Personal data is retained only for as long as reasonably necessary for the purposes described in this Notice, including order fulfilment, customer service, dispute handling, reprint history, accounting, tax, legal compliance, and internal business records. Typical retention periods:

  • Order and transaction records: 7 years (aligns with Malaysian tax/accounting record-keeping)
  • Account profile: for the life of the account plus a reasonable dormant period
  • Uploaded artwork: retained while the associated order history is retained, unless removal is requested
  • Marketing consent: until withdrawn
  • Website visit records: 12 months after your last visit, and then deleted. For a visit that led to an order or a WhatsApp chat with us, we keep only which site or ad sent you, which page you landed on and when, without your IP address, browser or ad click reference. The bishh_sid cookie that links your browser to them expires 90 days after your last visit

When no longer required, data is deleted, anonymised, or otherwise disposed of securely.

12. Your rights under PDPA

You have the following rights regarding your personal data:

  • Right to access: request a copy of the personal data we hold about you.
  • Right to correction: request correction of inaccurate or incomplete personal data.
  • Right to withdraw consent: withdraw your consent at any time where processing is based on consent.
  • Right to prevent processing for direct marketing: request us to stop using your data for direct marketing.
  • Right to limit processing: request limitation of specific processing activities.

To exercise any of these rights, contact us at sales@bishhmalaysia.com. We may need to verify your identity before responding and will respond within a reasonable period (targeting 14 days for routine requests).

13. Cookies, analytics and tracking

The website uses cookies and similar technologies for functionality, traffic measurement, and advertising. The ad network tags in your browser load only if you opt in. Our own record of your visits, and the order and chat reports in section 6, do not depend on the cookie banner. See the Cookie & Tracking Notice for full details and the choices available to you.

14. Language

This Notice is published in English. A Bahasa Melayu version is being prepared.

15. Updates to this notice

BISHH may update this Notice from time to time. The latest version is published on the website with the date it was last updated.

16. Contact

For questions, complaints, or to exercise any of your rights under the PDPA, contact:

BISHH MALAYSIA SDN. BHD.
9-1 Jalan Elektron U16/E, Seksyen U16, Denai Alam, 40160 Shah Alam, Selangor, Malaysia
Email: sales@bishhmalaysia.com
Phone: +60 16-357 0637