Privacy & Personal Data Protection Policy
Privacy & Personal Data Protection Policy
This Policy explains how Image Magic Printing Sdn Bhd collects, uses, stores, shares and protects personal data when you browse our website, request a quotation, place a printing order, upload artwork, communicate with us or use our services.
Privacy information at a glance
Who we are and the scope of this Policy
Image Magic Printing Sdn Bhd (Registration No. 201701022647 (1236813-K)) is a Malaysian printing company operating the website ImageMagic.com.my, an online ordering system, quotation services, physical customer service, production services and related communication channels.
This Policy applies when you:
- browse our website or use an Image Magic customer account;
- request a quotation, sample, consultation or product information;
- place, pay for, amend, collect or receive a printing order;
- upload artwork, databases, photographs, logos or other files;
- contact us by email, telephone, WhatsApp, website form or social media;
- subscribe to newsletters, promotions or other communications; or
- visit our shop or otherwise interact with our business.
This Policy should be read together with our Terms & Conditions, Return, Reprint & Refund Policy, Delivery Schedule and any product-specific notice.
Our roles as data controller and data processor
When Image Magic is the data controller
Image Magic decides why and how customer account, quotation, order, payment-reference, communication, website and delivery information is processed. For that information, Image Magic acts as the data controller.
When Image Magic processes data for a customer
Corporate customers may supply personal data for variable-data printing, personalised certificates, tickets, labels, mailers, name cards, identification products, event materials or other customised work. When we process that data only according to the customer's documented production instructions, Image Magic may act as a data processor and the customer remains the data controller.
- The customer must have a lawful basis and provide any required privacy notice or consent to the individuals concerned.
- Image Magic will use the supplied data only for the agreed order, quality control, delivery and related support, unless law requires otherwise.
- Requests from individuals about customer-controlled variable data may need to be directed to the customer who supplied it.
Personal data we may collect
| Category | Examples | Why it may be needed |
|---|---|---|
| Identity and contact data | Name, company, job title, email, telephone, WhatsApp number and contact person. | To identify you, communicate, quote, support and fulfil an order. |
| Account and authentication data | Username, encrypted password records, account preferences, verification status and login activity. | To create and secure your account and provide account functions. |
| Order and billing data | Products, specifications, quantity, billing address, company registration or tax information, invoice and transaction references. | To administer orders, payment, accounting, tax, invoices and refunds. |
| Delivery data | Recipient name, address, postcode, telephone number, instructions, courier and tracking records. | To pack, dispatch, deliver, investigate loss or damage and arrange collection. |
| Artwork and production data | Logos, photographs, names, addresses, text, participant lists, serial numbers, QR codes, barcodes and print files. | To check, prepare, personalise, print, finish and reproduce the ordered product. |
| Communication data | Emails, WhatsApp messages, calls, forms, quotations, complaints, proofs, approvals and support notes. | To respond, keep order instructions, resolve problems and maintain service records. |
| Technical and usage data | IP address, browser, device, pages viewed, session, cookies, referring page, cart and checkout activity. | To operate, secure, analyse and improve the website and online ordering process. |
| Marketing preference data | Newsletter consent, communication preference, campaign response and opt-out records. | To send permitted communications and respect your choices. |
We do not normally need health, biometric, political, religious, offence-related or other sensitive personal data for ordinary printing orders. Where sensitive personal data is genuinely required, we will process it only with explicit consent or as otherwise permitted by applicable law.
How we collect personal data
We may obtain personal data:
- directly from you when you register, order, upload, pay, enquire, approve artwork or contact us;
- from your employer, organisation, authorised representative, event organiser, agency or another person arranging the order;
- from payment gateways, banks, couriers, delivery providers and authorised service providers in connection with a transaction;
- automatically through the website, cookies, logs, security tools and similar technologies; and
- from publicly available sources where appropriate and permitted by law.
If you provide personal data about another person, you confirm that you are authorised to do so and that the person has received any notice or given any consent required for the intended use.
Why we process personal data
We may process personal data for purposes including:
Quotations and orders
To prepare quotations, verify specifications, create accounts and administer orders.
Artwork and production
To receive, inspect, prepare, proof, print, personalise, finish, pack and quality-check products.
Payment and accounting
To verify payments, issue invoices and receipts, prevent fraud and maintain accounting records.
Delivery and collection
To arrange courier, Lalamove, own-fleet or self-collection fulfilment and tracking.
Support and claims
To answer questions, manage proofs, complaints, reprints, returns, refunds and investigations.
Security and improvement
To protect accounts and systems, analyse performance, diagnose problems and improve services.
We may also use personal data to comply with legal, tax, accounting, audit, regulatory or court requirements; establish or defend legal rights; manage suppliers; enforce our terms; and send marketing communications where you have consented or where otherwise permitted by law.
Depending on the circumstances, processing may be based on your consent, steps requested before entering a contract, performance of an order or contract, compliance with legal obligations, protection of vital interests, administration of justice, or another basis permitted under Malaysian law.
Required and optional information
Some information is necessary to provide a quotation, create an account, process payment, produce the goods or complete delivery. Mandatory fields are normally identified in the relevant form or checkout.
If required information is not provided, we may be unable to:
- create or verify your account;
- prepare an accurate quotation;
- accept or produce the order;
- issue an invoice or confirm payment;
- deliver the product or contact the recipient; or
- investigate a complaint, refund, damaged parcel or lost shipment.
Optional information may help us personalise support or improve service, but you may choose not to provide it unless it later becomes necessary for your request.
Customer artwork and third-party personal data
Customer artwork may contain personal data such as names, photographs, signatures, addresses, identification numbers, employee information, event-participant details, barcodes or personalised messages.
- You retain your rights in customer-supplied artwork and content.
- Image Magic does not claim an irrevocable or perpetual ownership right over your private artwork or personal data.
- You grant us only the limited permission needed to open, inspect, technically prepare, reproduce, print, finish, package, deliver, support and, where necessary, share the file with an authorised production supplier.
- We do not intentionally publish customer artwork or use it in public marketing or a portfolio without permission.
- You are responsible for ensuring that you have the authority to provide and print personal data belonging to other people.
Who we may disclose personal data to
We may disclose only the personal data reasonably necessary to the following classes of recipients:
| Recipient class | Examples of purpose |
|---|---|
| Image Magic staff and authorised users | Sales, administration, prepress, production, finishing, packing, delivery, finance, management, IT and customer support. |
| Production and fulfilment suppliers | Approved external factories, specialist finishers or subcontractors needed to manufacture or complete an order. |
| Technology and hosting providers | Website, online ordering, cloud storage, email, shared inbox, communications, cybersecurity, backup and analytics services. |
| Payment and financial providers | Fiuu or another payment gateway, banks, card networks, e-wallet providers and fraud-prevention services. |
| Delivery providers | GDEX, DHL, Lalamove, other couriers, own-fleet drivers and logistics providers. |
| Professional advisers | Accountants, auditors, insurers, lawyers, consultants and debt-recovery providers where necessary. |
| Authorities and legal recipients | Government, regulators, law-enforcement agencies, courts or parties required or permitted by law. |
| Business transfer parties | A genuine purchaser, investor, successor or adviser in a merger, restructuring or transfer, subject to appropriate confidentiality and legal safeguards. |
Service providers are expected to use personal data only for the agreed service, protect it appropriately and comply with applicable data-protection obligations. We do not sell customer personal data.
Payments, transaction data and fraud prevention
Online card, banking and e-wallet payments may be processed by Fiuu or another payment provider shown during checkout. The provider may collect and process payment information under its own privacy terms and security controls.
- Image Magic does not normally receive or store your full card number, card PIN, online-banking password, TAC or OTP.
- We may retain the payment method, paid amount, transaction status, reference number and limited verification information needed for the order, accounting or a refund.
- Manual bank-transfer and DuitNow receipts may contain names, account fragments, reference numbers and payment details.
- We may use transaction and device information to detect duplicate payments, fraud, chargebacks or unauthorised activity.
Communications, WhatsApp, automation and marketing
Customer-service communications
When you communicate through email, telephone, WhatsApp, website forms or social media, the message and related account information may be processed by Image Magic and authorised communication-platform providers so that we can respond, route the enquiry, prepare a quotation or support an order.
Automation and AI-assisted support
We may use authorised automation or AI-assisted tools to classify enquiries, retrieve product information, draft responses, identify an order, route messages or reduce repetitive work. Staff may review or take over a conversation. These tools are not intended to make decisions that produce legal or similarly significant effects about you without appropriate human involvement.
Direct marketing
With your consent, or where otherwise permitted, we may send newsletters, product updates, offers, reminders or event information by email, telephone, SMS, WhatsApp or another selected channel.
- You can unsubscribe using the link in an email where available.
- You can reply with an opt-out request or contact us at any time.
- We will retain enough information to record and respect your opt-out.
- Service messages about an active quotation, order, payment, artwork, delivery or claim are not marketing messages.
Cookies and similar technologies
Our website may use cookies, local storage, pixels, logs and similar technologies.
| Type | Purpose | Effect if disabled |
|---|---|---|
| Strictly necessary | Account login, security, cart, checkout, language, session and core website functions. | The website, cart, account or checkout may not work correctly. |
| Preference and functionality | Remember choices and improve convenience. | You may need to re-enter preferences. |
| Analytics and performance | Understand page use, errors, traffic and service performance. | We receive less information for improvement. |
| Advertising or marketing, where enabled | Measure campaigns, limit repeated adverts or show more relevant promotions. | Advertising may be less relevant; core ordering should remain available unless the technology is essential. |
You can manage cookies through available website controls and your browser settings. Blocking all cookies may prevent login, cart, checkout, order tracking or other essential functions. Third-party services may set their own cookies and are governed by their privacy notices.
Cross-border transfer of personal data
Some authorised service providers, cloud systems, communication platforms, payment services or production-support tools may store or process personal data outside Malaysia, including in Singapore or another jurisdiction.
Where personal data is transferred outside Malaysia, Image Magic will take reasonable steps to use a transfer permitted under section 129 of the Personal Data Protection Act 2010, as amended. Depending on the circumstances, this may include:
- a destination with substantially similar law or an adequate level of protection;
- your consent where required;
- a transfer necessary to perform or arrange your order or a contract requested by you;
- contractual, organisational and technical safeguards with the recipient; or
- another condition allowed by Malaysian law.
Protection standards in another country may differ from Malaysia. We assess the service, purpose, data involved and safeguards before using an overseas provider where required.
How long we retain personal data
We retain personal data only for as long as reasonably needed for the purpose for which it was collected, an active business relationship, dispute resolution, security, backup, legal claims and applicable legal, tax, accounting, audit or regulatory requirements.
| Record type | General retention approach |
|---|---|
| Account and contact data | While the account or relationship remains active and for a reasonable period afterward, subject to legal and operational needs. |
| Orders, invoices and payment records | For the periods required for accounting, tax, audit, claims, fraud prevention and legal compliance. |
| Artwork and production files | May be retained temporarily for production, support or a possible reprint, but are not permanent storage. Files may be deleted during periodic or annual housekeeping, or earlier where appropriate. |
| Communications and approvals | For as long as needed to document instructions, approvals, complaints, claims or service history. |
| Marketing records | Until consent is withdrawn, you opt out, the campaign purpose ends or retention is no longer justified, while preserving an opt-out record. |
| Website and security logs | For a limited period appropriate to security, diagnostics, analytics and legal requirements. |
Security measures and personal data breaches
Security measures
We use reasonable administrative, physical and technical measures appropriate to the nature of the data and our operations. These may include role-based access, passwords, staff controls, secure connections, backups, system monitoring, access restrictions, supplier controls and procedures for disposing of records.
Payment providers and other service providers maintain their own security measures. No website, transmission, cloud service or storage system can be guaranteed to be completely secure.
Your responsibilities
- Use a strong, unique password and keep it confidential.
- Log out from shared devices.
- Check recipients before sending files or personal data.
- Do not send passwords, PINs, TACs or OTPs.
- Notify us promptly if you suspect unauthorised account access or an incorrect disclosure.
Personal data breaches
If a personal data breach occurs, we will investigate, contain and mitigate it. Where required by applicable law, we will notify the Personal Data Protection Commissioner as soon as practicable and notify affected individuals without unnecessary delay where the breach causes or is likely to cause significant harm.
Your personal data rights and choices
Subject to applicable law, identity verification and permitted exceptions, you may:
| Right or request | What it means |
|---|---|
| Access | Ask whether we process your personal data and request access to a copy in an intelligible form. |
| Correction | Ask us to correct data that is inaccurate, incomplete, misleading or not up to date. |
| Withdraw consent | Withdraw consent for processing based on consent. This does not affect processing already carried out and may affect our ability to continue a service. |
| Stop direct marketing | Require us to stop using your personal data for direct marketing. |
| Prevent certain processing | Object to processing likely to cause damage or distress, subject to the conditions and exceptions under law. |
| Data portability | Request electronic transmission of eligible personal data to another data controller, subject to technical feasibility, compatible format and applicable requirements. |
| Deletion or account closure request | Ask us to delete data or close an account. We will assess the request subject to legal, accounting, security, contractual and operational retention duties. |
| Complaint | Contact us about a concern and, where appropriate, complain to the Personal Data Protection Commissioner of Malaysia. |
Send a written request to [email protected] with the subject Privacy Request. Include your name, contact information, account or order number where relevant, the right you wish to exercise and enough detail for us to locate the data.
We may request proof of identity, authority or additional information, charge a permitted fee, or refuse/limit a request where the law allows. We will respond within the applicable legal period.
Children and personal data relating to minors
Our website and online ordering services are intended for persons aged 18 or above. A person under 18 should use the services only through a parent, guardian or authorised adult.
Printing orders may legitimately include photographs, names or other information relating to children—for example, school materials, event certificates, family photographs or personalised products. The customer supplying that information confirms that they have the authority, consent or other lawful basis required for the intended printing and disclosure.
If you believe a minor has created an account or supplied personal data without appropriate authority, contact us so that we can review the matter.
Third-party websites, social media and services
Our website or communications may link to payment gateways, courier tracking, Google Maps, social media, file-transfer services, design tools or other third-party websites. Those parties independently control their own websites, cookies and privacy practices.
Review the relevant third-party privacy notice before providing personal data. Image Magic is not responsible for a third party's independent processing, but this does not remove any responsibility that Image Magic cannot lawfully exclude for its own processing or choice of service provider.
Policy changes, contact details and complaints
Changes to this Policy
We may update this Policy to reflect changes to our services, technology, suppliers, operations or legal requirements. The revised version will be published on this page with a new “Last updated” date. Material changes may also be communicated through the website, account, email or another reasonable channel.
Contact Image Magic
Image Magic Printing Sdn Bhd
Registration No. 201701022647 (1236813-K)
Lot 3.34, 3.35 and 3.86, Level 3, Wisma Cosway
88 Jalan Raja Chulan, 50200 Kuala Lumpur, Malaysia
Privacy and personal data requests:[email protected]
Telephone:+603 2072 6323
WhatsApp:+6012 651 2849
Complaint to the regulator
If you believe your personal data has been processed contrary to applicable Malaysian law, you may lodge a complaint with the Personal Data Protection Commissioner of Malaysia.
Need to make a privacy request?
Email us with your name, contact details, account or order number where relevant, and a clear description of the access, correction, withdrawal, marketing opt-out, portability or other request.
[email protected]
+603 2072 6323
+6012 651 2849
Level 3, Wisma Cosway
88 Jalan Raja Chulan
50200 Kuala Lumpur, Malaysia
Operational accuracy: This Policy should be reviewed whenever Image Magic changes its website, payment gateway, cloud hosting, WhatsApp or AI tools, courier arrangements, production suppliers, marketing technologies, file-retention practice or privacy contact details.