Privacy policy

Last updated: August 12, 2026

1. Who We Are

S&S Pet Fam ("S&S Pet Fam," "we," "us," or "our") operates the online store located at [www.yourdomain.com], together with all related webpages, content, features, tools, products, and services (collectively, the "Services"). We are established in Malaysia. Our store is powered by Shopify Inc. ("Shopify"), which hosts the Services and processes certain personal information in order to provide and improve the Services.

This Privacy Policy explains how we collect, use, disclose, transfer, and retain your personal information when you visit or use the Services, make a purchase, create an account, or otherwise interact with us.

Please read this Privacy Policy carefully. By accessing or using any part of the Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with it, please do not use the Services. If there is any conflict between our Terms of Service and this Privacy Policy, this Privacy Policy controls with respect to the collection, processing, and disclosure of your personal information.

2. Personal Information We Collect

"Personal information" means information that identifies, relates to, or can reasonably be linked to you. It does not include aggregated or de-identified information that cannot reasonably identify you.

Depending on how you interact with the Services, we may collect:

Contact details — your name, email address, telephone number, billing address, and shipping address.

Order and transaction information — items you view, add to your cart or wishlist, purchase, return, exchange, or cancel; order numbers, value, currency, delivery instructions, tracking information, and order history.

Payment-related information — the type of payment method, the last four digits of your payment card (if applicable), billing postcode, payment confirmation, authorisation codes, transaction status, and refund or dispute records. We do not collect or store your full payment card number, expiry date, or CVV/CVC security code. Payment details are collected and processed directly by our payment processors (such as PayPal) under their own privacy policies and security standards.

Account information — if you create an account: your username, hashed password, saved addresses, and preferences. We cannot access your password in plain text.

Communications with us — the content of your emails, contact-form submissions, live chat messages, and customer support enquiries, including any attachments you choose to send.

Marketing information — where applicable, your subscription status and preferences, your interactions with our emails (such as whether an email was opened or a link was clicked), and your responses to promotions.

Device and technical information — your IP address, device type, operating system, browser type and language, screen resolution, referring and exit pages, time zone, and network connection information.

Usage information — pages viewed, session duration, clicks, scrolling, search terms entered on our site, and the general location (typically country, region, or city) inferred from your IP address. We do not collect precise geolocation data.

Fraud and risk signals — device fingerprints, indicators of suspicious activity, and prior chargeback or abuse history associated with an order, device, or account.

Sensitive personal information. We do not seek to collect sensitive personal information (such as government ID numbers, health data, biometric data, racial or ethnic origin, or religious beliefs). If you voluntarily provide such information — for example, in a message to customer support — you consent to our processing it solely to respond to you, and we will delete it once that purpose is fulfilled unless we are legally required to retain it.

3. Sources of Personal Information

Directly from you — when you place an order, create an account, subscribe to our communications, complete a form, leave a review, or communicate with us.

Automatically through the Services — from your device and browser when you visit the Services, including through cookies, pixels, tags, and similar technologies (see Section 6).

From our service providers — including Shopify, payment processors, shipping carriers, and fraud-prevention providers, when they collect or process personal information on our behalf or in connection with your order.

From our partners and other third parties — including advertising and social media platforms (for example, when you click one of our advertisements or interact with our page on a third-party platform), to the extent permitted by applicable law.

4. How We Use Your Personal Information

(a) To provide the Services and perform our contract with you. To process and fulfil your orders; to take and confirm payment; to arrange shipping, delivery, and customs clearance; to send order confirmations, shipping notifications, and delivery updates; to process returns, exchanges, and refunds; to create and manage your account; and to enable you to submit reviews.
GDPR legal basis: performance of a contract.

(b) To communicate with you and provide customer support. To respond to your enquiries and complaints; to provide after-sales support; and to send service messages such as order status updates and security alerts.
GDPR legal basis: performance of a contract; legitimate interests.

(c) For marketing and advertising. Where you have subscribed or where we are otherwise permitted to do so, to send you marketing and promotional communications by email; to display advertisements to you on third-party platforms and websites; to build audiences for advertising campaigns; to measure the performance of our marketing; and to personalise offers and recommendations based on items you have viewed, added to your cart, or previously purchased. You may opt out at any time — see Sections 8 and 15.
GDPR legal basis: your consent, where required; otherwise our legitimate interests in promoting our business.

(d) To improve, analyse, and secure the Services. To understand how customers use the Services; to measure traffic; to troubleshoot errors; and to maintain the availability, integrity, and performance of the Services.
GDPR legal basis: legitimate interests.

(e) For security, fraud prevention, and risk management. To verify orders; to screen transactions for fraud, payment abuse, or money laundering; to detect and prevent unauthorised or malicious activity; to manage chargebacks and disputes; and to protect the rights, property, and safety of S&S Pet Fam, our customers, and others. We reserve the right to cancel or refuse any order that we reasonably believe to be fraudulent, in violation of our Terms of Service, or otherwise high-risk, without prior notice.
GDPR legal basis: legitimate interests; compliance with legal obligations.

(f) To comply with law and to establish, exercise, or defend legal claims. To comply with applicable tax, accounting, customs, consumer protection, and data protection laws; to respond to lawful requests from courts, regulators, and law enforcement; to enforce our Terms of Service; and to establish, exercise, or defend legal claims.
GDPR legal basis: compliance with legal obligations; establishment, exercise, or defence of legal claims.

(g) For business transactions. To evaluate, negotiate, and complete a merger, acquisition, or sale of assets.
GDPR legal basis: legitimate interests.

Account security is a shared responsibility. If you register an account, you are responsible for keeping your credentials confidential. We strongly recommend using a unique password and not sharing your access details with anyone. We are not responsible for losses arising from your failure to safeguard your credentials.

5. Automated Processing

We use automated tools — including those provided by Shopify and our payment processors — to score orders for fraud risk. An order with a high risk score may be flagged for manual review, and we may cancel or refuse it, or ask you for additional verification, before it is fulfilled. If you believe an automated decision has affected you unfairly, you may contact us at the address in Section 18 to request human review.

6. Cookies and Similar Technologies

We and our service providers use cookies, pixels, tags, web beacons, local storage, and similar technologies ("cookies") on the Services. These fall into the following categories:

Strictly necessary cookies — required for the Services to function, including to maintain your session, keep items in your cart, enable checkout, and protect against security threats. These cannot be switched off through our cookie controls.

Performance and analytics cookies — help us understand how visitors use the Services so that we can measure and improve them.

Functional cookies — remember your preferences, such as your language, currency, or region.

Marketing and advertising cookies — used by us and by advertising partners to build a profile of your interests, to show you relevant advertisements on other websites and platforms, and to measure the effectiveness of our campaigns.

We may use the following third-party technologies on the Services: Shopify Analytics, Meta (Facebook/Instagram) Pixel, TikTok Pixel, and Google Analytics 4 (GA4). Each of these providers processes information in accordance with its own privacy policy. Not all of these technologies may be active at any given time; we deploy them based on our business needs and will update this list as our practices change.

Your choices. Where required by applicable law, we ask for your consent before setting non-essential cookies, and you may change your preferences at any time using the cookie banner or preference centre on the Services. You can also block or delete cookies through your browser settings, though doing so may affect the functionality of the Services.

Global Privacy Control and other opt-out preference signals. Where required by applicable law, we treat a recognised opt-out preference signal transmitted by your browser or device (such as Global Privacy Control) as a valid request to opt out of the sale or sharing of your personal information and of targeted advertising for that browser or device.

7. How We Disclose Personal Information

We do not sell your personal information for money. We may disclose personal information to the following parties for the purposes described in this Privacy Policy:

Shopify — which hosts the Services and provides the underlying commerce platform (see Section 10).

Payment processors — such as PayPal, to process payments, verify transactions, issue refunds, and manage disputes. When you pay, your payment details are submitted directly to the payment processor and processed under its own privacy policy.

Shipping carriers, freight forwarders, and fulfilment providers — to ship, track, and deliver your order and to handle returns. This includes disclosing your name, delivery address, and contact details, and, where required, information needed for customs clearance in your country.

Customs, tax, and border authorities — where required for the lawful import of your order.

Advertising and marketing partners — including Meta, Google, and TikTok, to deliver and measure advertising. Depending on where you live and how these partners process information, this may be treated as a "sale" or "sharing" of personal information, or as "targeted advertising," under applicable law. See Section 8.

Other service providers acting on our behalf — including cloud hosting, IT support, email marketing platforms, and fraud prevention providers, who are permitted to use your personal information only to perform services for us and are bound by contractual confidentiality obligations.

Professional advisers — including lawyers, accountants, and tax advisers, where reasonably necessary and subject to confidentiality obligations.

Courts, regulators, law enforcement, and government agencies — where we believe in good faith that disclosure is required by applicable law, or is necessary to protect our rights, property, or safety, or those of our customers or others.

Acquirers and other parties to a business transaction — in connection with a merger, acquisition, or sale of assets.

Where you direct or consent — for example, when you use a social media widget or ask us to disclose information to a third party.

8. Sale, Sharing, and Targeted Advertising

We do not sell your personal information in exchange for money, and we do not knowingly sell or share the personal information of individuals we know to be under 16 years of age.

However, some privacy laws in the United States define "sale" and "sharing" broadly to include disclosures of personal information to advertising partners for cross-context behavioural or targeted advertising, even where no money changes hands. Where we use the advertising and analytics technologies described in Section 6, our disclosure of identifiers, internet or other electronic network activity, and commercial information to those partners may be treated as a "sale" or "sharing" of personal information, or as processing for "targeted advertising," under those laws.

How to opt out. If you would like to opt out, you may:

— use our Do Not Sell or Share My Personal Information page at [www.yourdomain.com/pages/do-not-sell-my-personal-information];
— reject marketing and advertising cookies through our cookie banner or preference centre;
— transmit a recognised opt-out preference signal such as Global Privacy Control (see Section 6); or
— contact us using the details in Section 18.

Opting out will not affect your ability to purchase from us, and we will not discriminate against you for exercising this right.

9. Notice to California Residents

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA"), may provide you with additional rights. The categories of personal information we collect (as defined by the CCPA) include: identifiers; personal information listed in the California Customer Records statute; commercial information; internet or other electronic network activity information; approximate geolocation data; and inferences drawn from the foregoing.

The sources of that information, the business and commercial purposes for collecting it, and the categories of third parties to whom we disclose it are described in Sections 3, 4, and 7 above. We may have "shared" identifiers, internet activity information, and commercial information with advertising partners for cross-context behavioural advertising as described in Section 8. We do not sell personal information for monetary consideration. We retain personal information as described in Section 14.

To exercise your CCPA rights, please use the methods described in Sections 8 and 15.

10. Our Relationship with Shopify

The Services are hosted and powered by Shopify. Information you submit to the Services is transmitted to and shared with Shopify, and with third parties engaged by Shopify, which may be located in countries other than the country in which you reside.

In addition, we use certain Shopify enhanced features that incorporate data from your interactions with our store, with other Shopify merchants, and with Shopify itself. For these enhanced features, Shopify is responsible for the processing of your personal information, including for responding to requests to exercise your rights.

To learn more, please see the Shopify Consumer Privacy Policy at https://www.shopify.com/legal/privacy/consumers. Depending on where you live, you may exercise certain rights directly with Shopify through the Shopify Privacy Portal at https://privacy.shopify.com/en.

11. Third-Party Websites and Links

The Services may contain links to websites or platforms operated by third parties (including PayPal, advertising platforms, and carrier tracking pages). We do not control those third parties, and this Privacy Policy does not apply to them. We are not responsible for the privacy or security practices of those third parties, or the accuracy or reliability of information found on their sites.

12. Children's Data

The Services are intended for adults. We do not knowingly collect personal information from children under the age of majority in their jurisdiction. As of the date of this Privacy Policy, we do not have actual knowledge that we "sell" or "share" (as defined under applicable United States privacy laws) the personal information of individuals under 16 years of age.

If you are a parent or guardian and believe a child has provided personal information to us, please contact us using the details in Section 18 and we will take reasonable steps to delete it.

13. Security

We maintain administrative, technical, and organisational safeguards designed to protect personal information, including encryption of data in transit using TLS, restricting access to authorised personnel and service providers, and relying on Shopify's platform-level security controls and PCI-DSS compliant payment processors for payment data.

No system is perfectly secure. We cannot and do not guarantee absolute security. Any information you transmit to us is transmitted at your own risk and may not be secure while in transit. Please do not send us full payment card details by email or chat.

Where a personal data breach occurs, we will assess it and notify the relevant authorities and affected individuals to the extent and within the timeframes required by applicable law, including under the Malaysian Personal Data Protection Act 2010 (as amended).

14. Data Retention

We retain personal information for as long as necessary to fulfil the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

In general:

Order and transaction records — retained for at least seven (7) years from the end of the relevant financial year, to comply with Malaysian tax and accounting requirements and to defend against potential claims.

Account information — retained for as long as your account remains active, and for a reasonable period afterwards.

Customer support correspondence — retained for up to three (3) years after resolution, or longer where it relates to a dispute.

Marketing subscription records — retained until you unsubscribe; afterwards we retain a minimal suppression record so that we can honour your opt-out.

Fraud, chargeback, and abuse records — retained for as long as reasonably necessary to protect against repeat fraud and to defend legal claims.

Cookie and analytics data — retained in line with the retention settings of the relevant provider.

Where we are required to delete personal information at your request, we may nevertheless retain the specific records that we are legally required or permitted to keep — for example, transaction and tax records and records needed to establish, exercise, or defend legal claims — and we will restrict our use of that information to those purposes.

15. Your Rights and Choices

Depending on where you live and the law that applies to you, you may have some or all of the following rights. These rights are not absolute and may be declined where applicable law permits.

Right to access / know — to request confirmation of whether we process your personal information and to obtain a copy.

Right to deletion — to request that we delete your personal information, subject to the exceptions in Section 14.

Right to correction — to request that we correct inaccurate personal information.

Right to data portability — to receive certain personal information in a structured, commonly used, machine-readable format.

Right to opt out of sale, sharing, and targeted advertising — see Section 8.

Right to withdraw consent — where we rely on your consent, to withdraw it at any time. Withdrawal does not affect the lawfulness of prior processing.

Right to object and to restrict processing — where the GDPR applies, to object to processing based on our legitimate interests and to request restriction in certain circumstances. You may object to direct marketing at any time and we will stop.

Right to non-discrimination — we will not deny you goods or services, or charge you a different price, because you exercised your privacy rights.

Managing marketing communications. You may unsubscribe from marketing emails at any time using the unsubscribe link in any marketing email we send. If you opt out, we will still send you non-promotional service messages, such as order confirmations, shipping notices, and messages about your account or a dispute.

How to make a request. Email us at sparksshopify@gmail.com with the subject line "Privacy Request." Please state clearly which right you wish to exercise and provide the email address and order number(s) associated with your interactions with us.

Verification. To protect against fraudulent requests, we will take reasonable steps to verify your identity before acting on a request. This may involve asking you to confirm information already in our records or to respond from the email address associated with your account or order. We may refuse to act on a request where we are unable to verify your identity to a reasonable degree of certainty.

Authorised agents. Where applicable law permits, you may use an authorised agent to submit a request on your behalf. We will require written proof of authorisation and may require you to verify your identity directly with us.

Limits on requests. Where permitted by applicable law, we may decline a request, or charge a reasonable fee, where the request is manifestly unfounded, repetitive, or excessive, or where an exemption applies. If we decline, we will tell you why unless prohibited from doing so.

Timing. We will respond within the period required by applicable law — generally within 30 days under Malaysian law, within one month under the GDPR (extendable by two further months for complex requests), and within 45 days under most United States state privacy laws (extendable by a further 45 days where reasonably necessary).

Rights in relation to Shopify. For personal information processed by Shopify as a controller in its own right (see Section 10), you may need to exercise your rights directly with Shopify at https://privacy.shopify.com/en.

16. Notice to Malaysia Residents

We process personal information in Malaysia in accordance with the Personal Data Protection Act 2010, as amended by the Personal Data Protection (Amendment) Act 2024. Providing the personal information marked as mandatory at checkout is necessary for us to process your order; if you do not provide it, we will not be able to supply the Services to you. You may access and correct your personal information, and limit its processing for marketing purposes, by contacting us using the details in Section 18.

17. International Transfers

We are established in Malaysia, and our service providers — including Shopify and PayPal — operate globally. Your personal information will therefore be transferred to, stored in, and processed in countries other than the country in which you live, including Malaysia, Canada, the United States, and Singapore. Those countries may have data protection laws that differ from the laws of your country.

Where we transfer personal information out of the European Economic Area, the United Kingdom, or Switzerland, we rely on recognised transfer mechanisms such as the European Commission's Standard Contractual Clauses or the UK International Data Transfer Agreement, unless the transfer is to a country that has been determined to provide an adequate level of protection, or another lawful exception applies. Where we transfer personal information out of Malaysia, we do so in accordance with the Personal Data Protection Act 2010 (as amended) and the applicable guidelines issued by the Personal Data Protection Commissioner.

18. Contact Us

If you have any questions about this Privacy Policy, or if you would like to exercise any of your rights, please contact us:

S&S Pet Fam
Email: sparksshopify@gmail.com
Postal address: BO1-A-09, Menara 2, KL Eco City, 3, Jln Bangsar, 59200 Kuala Lumpur, Malaysia

We aim to acknowledge privacy-related enquiries within seven (7) business days.

19. Complaints

If you have a complaint about how we handle your personal information, please contact us first so that we have an opportunity to resolve it. If you are in Malaysia, you may also complain to the Personal Data Protection Commissioner (Jabatan Perlindungan Data Peribadi). If you are in the European Economic Area or the United Kingdom, you may complain to your national supervisory authority.

20. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, our Services, or applicable law. When we do, we will post the revised Privacy Policy on the Services and update the "Last updated" date at the top. Your continued use of the Services after a revised Privacy Policy takes effect constitutes your acknowledgement of the revised Privacy Policy, to the extent permitted by applicable law.

21. General

Severability. If any provision of this Privacy Policy is found to be unlawful or unenforceable, that provision will be severed or limited to the minimum extent necessary, and the remaining provisions will continue in full force and effect.

No third-party beneficiaries. This Privacy Policy does not create contractual rights in favour of any person other than as expressly required by applicable law.

Mandatory local law. Nothing in this Privacy Policy limits or excludes any right you have under a mandatory provision of the law applicable to you that cannot be limited or excluded by agreement.

Language. This Privacy Policy is drafted in English. Any translation is provided for convenience only. In the event of any inconsistency between the English version and any translation, the English version prevails.