HARLI + HARPA takes your privacy seriously and works to ensure your personal data is protected at all times. This policy explains how we collect, use, store, and share your information when you use our website or services and sets out what your rights are in relation to that data. 

We are the data user (data controller) in respect of your personal data under the Personal Data Protection Act 2010 (PDPA) and its subsidiary regulations. 

We have appointed a Data Protection Officer (DPO) responsible for overseeing questions about this policy. If you have any questions, please contact the DPO using the details in Section 17.

HARLI + HARPA is an Australian-based business. All personal data we collect is stored and hosted in Australia. We do not store personal data within Malaysia. 

Where personal data is collected from Malaysian residents, it is transferred internationally to Australia. Under the PDPA, personal data may only be transferred outside Malaysia to a place specified by the Minister, or where certain conditions are met (including where the data subject has consented to the transfer, or the transfer is necessary for the performance of a contract between you and us). We rely on the following to ensure your data remains protected when transferred: 

• Your consent to the transfer as part of your use of our services and acceptance of this policy 
• Contractual necessity, where the transfer is required to fulfil your order or provide our services to you 
• Data processing agreements with all third-party providers containing appropriate data protection obligations 
• Technical and organisational safeguards equivalent to those required under the PDPA 

Certain business operations or personnel may be based in or operate from outside Australia. Any access to personal data from outside Australia is strictly controlled and limited to authorised purposes only, with appropriate contractual and technical safeguards in place. 

By using our services, you acknowledge and consent that your personal data will be transferred to and stored in Australia, which may have different data protection laws than Malaysia. If you would like more information about the safeguards we use, please contact us at hello@harliandharpa.com. 

Depending on how you interact with us, we may collect and process the following categories of personal data: 

Identity & Contact Data 

• Full name 
• Email address 
• Telephone number 
• Billing and shipping address 
• NRIC or passport number (only where required, e.g. for certain deliveries or fraud checks) 

Financial & Transaction Data 

• Payment information (processed securely by third-party providers — we do not store your full card details) 
• Purchase and order history 

Technical Data 

• IP address 
• Browser type and version 
• Device identifiers and operating system 
• Time zone and location data 

Profile & Usage Data 

• Account details and preferences 
• Purchase behaviour and browsing activity on our site 
• Marketing preferences 

Communication Data 

• Customer service enquiries 
• Feedback, reviews, and general correspondence 

We do not knowingly collect sensitive personal data (as defined under the PDPA, e.g. health, religious beliefs) unless explicitly required and with your prior express consent.

We collect personal data through: 

• Direct interactions — when you create an account, make a purchase, or get in touch with us 
• Automated technologies — cookies, analytics tools, and server logs as you browse our site (please see our Cookies section below) 
• Third parties — payment providers, analytics platforms, and advertising partners may share data with us 
• Data aggregators — identity and contact data from aggregators based inside or outside Malaysia 

We only process your personal data where we have a lawful basis for doing so under the PDPA. This generally means we have your consent, or the processing falls within an exception recognised by the Act (such as being necessary for the performance of a contract with you, or compliance with a legal obligation). We use your data for the following purposes: 

Performance of Contract Where processing is necessary to fulfil our contract with you, including to: 

• Process and fulfil your orders 
• Provide customer support 
• Manage your account 

Business Operations Where processing supports our legitimate business operations and is consistent with the purpose for which the data was collected, including to: 

• Improve our website, services, and customer experience 
• Prevent fraud and maintain platform security 
• Conduct internal analytics and business operations 

Legal Obligations Where processing is required for us to comply with applicable laws, including: 

• Tax, accounting, and regulatory obligations 
• Responding to lawful requests from authorities 

Consent Where you have given us your explicit consent to: 

• Send you marketing communications 
• Use non-essential cookies 
• Transfer your data internationally (see Section 2) 

You may withdraw your consent at any time by contacting us or using the opt-out options in our communications. Please note that withdrawing consent may affect our ability to provide certain services to you. 

We may send you marketing emails and other communications if you have opted in or given consent as required under the PDPA. You can unsubscribe at any time by clicking the unsubscribe link in any of our emails or by contacting us directly at hello@harliandharpa.com. 

We will never sell your personal data to third parties for their own marketing purposes. 

Subject to your prior express consent, we may share your personal data with trusted third-party partners who may send you marketing communications about their products and services.

We may share your data with trusted third parties who provide services on our behalf, including: 

• Payment processors and financial institutions (such as Stripe or similar providers) 
• Shipping and logistics providers 
• Cloud hosting and IT infrastructure providers 
• Marketing and analytics platforms 
• Professional advisers including legal, accounting, and auditing firms 
• Regulatory or law enforcement authorities where required by law 

All third parties are contractually bound to protect your personal data and are only permitted to process it for the specific purposes we have authorised, consistent with our obligations under the PDPA. 

Because all personal data collected by HARLI + HARPA is stored in Australia, any data collected from Malaysian residents involves an international transfer. Under Section 129 of the PDPA, such transfers are permitted where, among other things: 

• You have consented to the transfer 
• The transfer is necessary for the performance of a contract between you and us 
• The transfer is necessary to protect your vital interests 
• We have taken reasonable steps to ensure the data will not be processed in a manner inconsistent with the PDPA 

We rely primarily on your consent and on contractual necessity, supported by data processing agreements with our third-party providers and appropriate technical and organisational safeguards. No personal data is stored within Malaysia unless explicitly stated otherwise.

We take the security of your personal data seriously and implement robust technical and organisational measures to protect it, in line with the Security Principle under the PDPA, including: 

• SSL/TLS encryption for all data in transit 
• Secure server infrastructure hosted in Australia 
• Role-based access controls and authentication measures 
• Regular security monitoring and vulnerability assessments 
• PCI-DSS compliant payment processing 

No system is completely immune to risk, but we continuously review and improve our safeguards to keep your data as secure as possible. In the event of a data breach that meets the applicable notification thresholds, we will notify the Department of Personal Data Protection and affected individuals in accordance with the PDPA and its regulations. 

In line with the Retention Principle under the PDPA, we only keep your personal data for as long as necessary to fulfil the purposes it was collected for, including to meet legal, regulatory, accounting, or reporting requirements, and to resolve disputes or enforce our agreements. 

Retention periods are determined based on the type of data and the applicable legal requirements. For example, financial and transaction records are typically retained for seven years in line with standard accounting obligations. Once data is no longer needed, we take reasonable steps to destroy or permanently delete it. 

If you are located in Malaysia, you have the following rights under the PDPA in relation to your personal data: 

• Right of access — to request a copy of the data we hold about you, and information about how it is processed 
• Right to correction — to ask us to correct inaccurate, incomplete, misleading, or outdated data 
• Right to withdraw consent — to withdraw your consent to the processing of your data at any time, where processing is based on consent 
• Right to prevent processing likely to cause damage or distress — to request that we stop or do not begin processing your data where it is likely to cause you damage or distress 
• Right to prevent processing for direct marketing — to request that we stop using your data for direct marketing purposes 
• Right to complain — to lodge a complaint with us, or with the Department of Personal Data Protection, regarding our handling of your data 

To exercise any of these rights, please contact us at hello@harliandharpa.com. We will respond to your request within 21 days, in accordance with the PDPA's requirements for data access and correction requests, and may charge a prescribed fee for access requests where permitted by law. 

You also have the right to lodge a complaint with the Department of Personal Data Protection (Jabatan Perlindungan Data Peribadi, JPDP), Malaysia's data protection authority. You can reach them at www.pdp.gov.my. We would, however, appreciate the chance to address any concerns you have directly first — so please do contact us in the first instance. 

We use cookies and similar tracking technologies on our website. Cookies are small files placed on your device that allow us to recognise your browser and remember certain information about your visit. 

We use the following types of cookies: 

• Strictly necessary cookies — essential for the site to function properly; these are always set 
• Analytics cookies — help us understand how visitors use our site so we can improve it 
• Marketing cookies — used to deliver relevant advertising and track campaign performance 

Where cookies are not strictly necessary, we will ask for your consent before setting them. You can manage or withdraw your consent at any time through our cookie settings, or by adjusting your browser preferences. 

Our website and services are not intended for anyone under the age of 18. We do not knowingly collect personal data from children. If you are under 18, please do not use our services without first speaking to a parent or guardian and obtaining their agreement to this policy. 

If we become aware that we have collected personal data from a child without appropriate parental or guardian consent, we will take steps to delete it as soon as possible. 

We may update this Privacy & Security Policy from time to time to reflect changes in our practices or applicable law. Any updates will be posted on this page with a revised date at the top. We encourage you to check back periodically.

15. Contact Us 

If you have any questions about this policy or how we handle your personal data, please get in touch: 

HARLI + HARPA Email: hello@harliandharpa.com Address: 11 Hall Street, Hawthorn, Victoria, Australia 

We have appointed a Data Protection Officer (DPO) to oversee compliance with this policy and applicable data protection laws, including the PDPA. 

To contact our DPO, please write to us at the address above marked FAO: Data Protection Officer, or email hello@harliandharpa.com with "DPO Enquiry" in the subject line.