Privacy Policy
Adapted from the Automattic Privacy Policy, published under Creative Commons Attribution-ShareAlike 4.0. Original available at https://github.com/Automattic/legalmattic. Material changes from the original are: removal of Automattic-specific product references; replacement of GDPR/US-state sections with Malaysian PDPA 2010 (as amended by the Personal Data Protection (Amendment) Act 2024); addition of PDPA s.129 cross-border transfer disclosures; and adaptation of the processor list and service description to match this platform.
Your privacy is critically important to us. We have a few fundamental principles:
- We are thoughtful about the personal information we ask you to provide and the personal information that we collect about you through the operation of our services.
- We store personal information for only as long as we have a reason to keep it.
- We aim to make it as simple as possible for you to control what information about you is shared, and to exercise your rights under applicable law.
- We aim for full transparency on how we gather, use, and share your personal information.
Below is our Privacy Policy, which incorporates and clarifies these principles.
Last updated: 24 August 2026
Who We Are and What This Policy Covers
Formative Digital Solutions (Company No. 202303207394) ("we", "us", or "Provider") operates a cloud-based commerce platform that enables merchants ("Merchants") to run their own online storefronts and sell goods and services to buyers ("Buyers").
This Privacy Policy applies to information we collect about you when you:
- Visit or use any storefront or website powered by our platform;
- Create an account with us as a Merchant or as a Buyer;
- Transact through any storefront powered by our platform; or
- Communicate with us directly (by email, support request, or otherwise).
Throughout this Privacy Policy we refer to our platform and all related websites and services collectively as "Services."
Important: Each Merchant operates their own storefront and is independently responsible for their own data processing practices in connection with their storefront. This Privacy Policy covers data processing carried out by Formative Digital Solutions as data controller. Where a Merchant processes your data as controller, their own privacy policy governs.
Information We Collect
We only collect information about you if we have a reason to do so — for example, to provide our Services, to communicate with you, or to make our Services better.
We collect this information from three sources: (1) information you provide to us directly; (2) information we collect automatically through operating our Services; and (3) information from outside sources.
Information You Provide to Us
Basic account information. We ask for basic information from you to set up an account. For Buyers this means your name, email address, and password. For Merchants this includes business name, contact email, and billing details.
Payment and contact information. When you make a purchase through a storefront on our platform, or when a Merchant pays fees to us, we or our payment partners collect payment and billing information (name, billing address, and payment method details). We do not store card numbers ourselves — card data is processed directly by our payment processing partners, who act as independent data controllers for that data.
Order and transaction information. When you place an order we collect the information necessary to fulfil it: your name, delivery address, email address, phone number, and the details of the goods or services ordered.
Communications with us. If you contact us via email or support channels we store a copy of your communications with us.
Merchant business information. If you are a Merchant, we collect business registration information, banking or payment gateway details (to facilitate Platform Fee collection), and store configuration data.
Information We Collect Automatically
Log information. Like most online service providers, we collect information that web browsers and servers make available, including browser type, IP address, unique device identifiers, referring site, date and time of access, and operating system. We collect log information when you use our Services.
Usage information. We collect information about your usage of our Services — for example, pages viewed, products browsed, items added to cart, and checkout funnel events.
Location information. We may determine the approximate location of your device from your IP address.
Information from cookies and similar technologies. We use cookies and similar technologies to help identify and track visitors, usage, and access preferences for our Services. Please see our Cookie Policy for more information.
Information We Collect from Other Sources
If you log in via a third-party authentication provider (such as Google), we receive the login information that provider shares with us (for example, your email address and name) under that provider's authorisation flow.
Whether you must provide personal data. It is generally voluntary for you to provide personal data to us. However, some personal data is necessary to create an account, complete a purchase, or use the Services — for example, your name, contact details, and payment or delivery information. If you do not provide personal data that is necessary for a particular purpose, we may be unable to provide the relevant part of the Services or complete your transaction.
How and Why We Use Information
Purposes for Using Information
We use information about you for the following purposes:
- To provide our Services. For example, to set up and maintain your account, process payments and orders, fulfil transactions, and provide customer service.
- To ensure quality, maintain safety, and improve our Services. For example, by monitoring how users interact with our Services to identify and fix problems, and to develop improvements.
- To produce aggregated, de-identified insights. We create aggregated, de-identified statistics, analytics, benchmarks, and market insights derived from the use of our Services. This data cannot reasonably be used to identify you, is not personal data, and may be used commercially or shared with our affiliates, business partners, and others. We do not sell personal data.
- To market our Services and measure effectiveness. For example, by communicating with Merchants about new features or offers. We will not send marketing communications to Buyers without consent.
- To protect our Services, our users, and the public. For example, by detecting security incidents; detecting and protecting against malicious, fraudulent, or illegal activity; complying with our legal obligations; and protecting the rights and property of Formative Digital Solutions and others.
- To communicate with you. For example, sending order confirmations, account notices, and (where you have consented) marketing communications. You may opt out of marketing communications at any time.
Legal Bases under the Personal Data Protection Act 2010 (Malaysia)
We collect and process personal data under the following grounds as permitted by the Personal Data Protection Act 2010 ("PDPA"):
- Consent — where you have given us consent to process your data for a specific purpose (for example, receiving marketing communications);
- Contract — where processing is necessary to perform a contract with you (for example, processing your order);
- Legal obligation — where we are required to process your data to comply with a legal requirement (for example, retaining transaction records under the Income Tax Act 1967); or
- Legitimate interests — where processing is necessary for our legitimate interests and those interests are not overridden by your rights (for example, fraud prevention and platform security).
Sharing Information
We share information about you in limited circumstances, and with appropriate safeguards. We do not sell personal data.
Merchants. If you make a purchase or submit an enquiry through a Merchant's storefront, relevant order and contact information is shared with that Merchant to fulfil your order. The Merchant is an independent data controller for the information they receive.
Third-party service providers. We share information with third-party vendors who need it to provide services to us or to you. These include:
| Category | Purpose | Location |
|---|---|---|
| Cloud infrastructure & hosting | Hosting, database, storage, compute, and related infrastructure | Malaysia and/or other jurisdictions |
| Authentication & identity | Account authentication and identity management | Malaysia and/or other jurisdictions |
| Transactional email | Delivery of transactional and notification emails | Malaysia and/or other jurisdictions |
| Observability & monitoring | Error monitoring, logging, performance, and uptime | Malaysia and/or other jurisdictions |
| Product analytics | Usage analytics and product insights | Malaysia and/or other jurisdictions |
| Payment processing | Payment and subscription billing; card, billing address, and transaction data (independent controller for payment data) | Malaysia and/or other jurisdictions |
| File & object storage | Public file storage (e.g. product images, assets) | Malaysia and/or other jurisdictions |
We require all third-party providers to agree to appropriate data protection commitments.
Legal and regulatory requirements. We may disclose information about you in response to a court order, subpoena, or other lawful government request, or where we believe in good faith that disclosure is reasonably necessary to protect rights, property, or safety.
Business transfers. In connection with any merger, acquisition, or sale of all or substantially all of our business, user information would likely be transferred. This Privacy Policy would continue to apply.
Aggregated or de-identified information. We may share aggregated or de-identified information that cannot reasonably be used to identify you — such as statistics, trends, and benchmarks — with our affiliates, business partners, and other third parties, for research, analytics, and commercial purposes.
Cross-Border Transfer of Personal Data
Some of the third-party providers listed above are located outside Malaysia. Transfer of personal data outside Malaysia is subject to section 129 of the PDPA. We transfer personal data outside Malaysia only where:
- the receiving country provides a level of protection substantially similar to that afforded under the PDPA, or appropriate contractual safeguards are in place (including standard data protection clauses or binding commitments from the recipient); and
- we have disclosed such transfer in this Privacy Policy.
By using our Services you consent to the cross-border transfer of your personal data to jurisdictions outside Malaysia to the extent required for the purposes described in this Privacy Policy, in accordance with section 129 of the PDPA.
Each such provider is engaged under data-protection terms, and we have taken reasonable steps to ensure that your personal data will be handled with a standard of protection substantially equivalent to that afforded under Malaysian law.
How Long We Keep Information
We retain personal data for as long as we have a reason to keep it, subject to legal and regulatory retention obligations.
- Order and transaction records — retained for a minimum of seven (7) years from the date of the transaction, as required by Malaysian tax and accounting law.
- Account information — retained for as long as your account is active, and for a reasonable period thereafter to handle queries or disputes. Upon account closure, personal data will be deleted or anonymised within ninety (90) days, except where retention is required by law.
- Log and technical data — retained for approximately thirty (30) days.
- Application monitoring data — retained for 30–90 days per the providers' defaults.
Security
While no online service is 100% secure, we work hard to protect information about you against unauthorised access, use, alteration, or destruction, and take reasonable measures to do so, including encryption in transit (TLS) and at rest for sensitive data, and access controls limiting who within our organisation can access personal data.
In the event of a data breach that is notified to us by a service provider or detected by us that affects personal data, we will notify the Personal Data Protection Commissioner (PDPC) within seventy-two (72) hours of becoming aware, as required by the Personal Data Protection (Amendment) Act 2024. Where the breach is likely to result in significant harm to affected individuals, we will notify those individuals as soon as reasonably practicable.
Your Choices
Opt out of marketing communications. You may opt out of receiving promotional communications from us at any time by following the unsubscribe link in any marketing email, or by contacting us directly. If you opt out, we will still send you transactional messages about your account or orders.
Cookies. You can set your browser to remove or reject cookies. Some features of our Services may not function properly without cookies.
Account closure. You may close your account by contacting us. We will delete or anonymise your personal data within ninety (90) days of closure, subject to retention obligations described above.
Your Rights under the PDPA
Under the Personal Data Protection Act 2010 (as amended), you have the following rights in respect of your personal data held by us:
Right of access (s.30 PDPA). You may request a copy of the personal data we hold about you and information about how it is used. We will respond within twenty-one (21) days of receiving a verifiable request. We may charge a reasonable fee for providing access.
Right to correct (s.31 PDPA). If any personal data we hold about you is inaccurate, incomplete, misleading, or not up-to-date, you may request that we correct it.
Right to withdraw consent (s.38 PDPA). Where processing is based on your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
Right to prevent processing likely to cause damage or distress (s.42 PDPA). You may request that we cease or not begin processing your personal data where such processing is causing or is likely to cause substantial and unwarranted damage or distress to you or another person.
Right to data portability. Where applicable under the PDPA Amendment Act 2024, you may request that we transmit your personal data in a structured, commonly used format to you or to another data controller.
Right to lodge a complaint. If you believe we have not handled your personal data in compliance with the PDPA, you may lodge a complaint with the Department of Personal Data Protection (JPDP) at www.pdp.gov.my.
To exercise any of these rights, please contact us using the details in the "How to Reach Us" section below. We may need to verify your identity before acting on a request.
Privacy Policy Changes
We may update this Privacy Policy from time to time. We will notify you of material changes by posting a notice on the relevant storefront or by emailing you. Your continued use of our Services after the effective date of any change constitutes acceptance of the updated policy.
How to Reach Us
For questions about this Privacy Policy or to exercise your data subject rights, please reach us at:
Formative Digital Solutions Email: privacy@formative.digital
This Privacy Policy is adapted from the Automattic, Inc. Privacy Policy (https://automattic.com/privacy/) under a Creative Commons Attribution-ShareAlike 4.0 International Licence. The original Automattic policy and source files are available at https://github.com/Automattic/legalmattic.