RareStash Privacy Policy

Last updated: 13 October 2026

This Privacy Policy explains how RareStash (“we”, “us”, “our”) collects, uses, discloses, stores, and otherwise processes personal data when you use the RareStash website, application, and related services (the “Platform”). It is intended to comply with the Personal Data Protection Act 2010 of Malaysia (“PDPA”), its regulations, and applicable codes of practice.

RareStash is the data user in respect of personal data we control. By creating an account, making a purchase, requesting delivery, or otherwise using the Platform, you consent to processing as described here, to the extent consent is the applicable lawful basis under the PDPA. This Policy should be read together with our Terms of Service.

1. Personal Data We Collect

“Personal data” means information that relates directly or indirectly to you and from which you may be identified. Depending on how you use the Platform, we may collect:

• Identity and contact data: name, username, email address, mobile number, date of birth (if provided), and similar identifiers.
• Account data: login credentials (stored in hashed or equivalent protected form), profile details, referral codes, and preferences.
• Transaction data: pack purchases, wallet top-ups, points, vouchers, redemptions, inventory records, buyback or delivery requests, and order history.
• Payment-related data: payment method chosen, transaction status, amount, and references returned by the payment provider. Full payment-card numbers, PINs, and online-banking passwords are processed by licensed third-party payment providers (for example DuitNow QR or FPX / online banking). We do not store complete card PAN or banking secrets.
• Delivery data: recipient name, address, and phone number when you request physical shipment.
• Technical and usage data: IP address, device and browser type, approximate location derived from IP, log files, crash reports, cookies or similar technologies, and how you use the Platform.
• Communications: messages you send to support, complaints, and records we keep for disputes or enforcement.

We may also generate data about you in our systems, such as account risk scores, inventory allocations, and promotional eligibility.

2. How We Collect Personal Data

• Directly from you when you register, top up, buy, or contact us.
• Automatically when you use the Platform (logs, cookies, device data).
• From payment providers, banks, couriers, and fraud-prevention partners, limited to what is needed to complete or secure a transaction.
• From a person who refers you, if they share a referral identifier with us (they should only do so with your knowledge).

If you provide personal data about another person (for example a delivery recipient), you confirm you have that person's authority to do so and that they have been informed of this Policy.

3. Purposes of Processing

We process personal data to:

• Create, authenticate, and maintain your account.
• Process orders, wallet top-ups, pack openings, points, vouchers, and redemptions.
• Arrange physical delivery and handle returns where applicable.
• Provide customer support and respond to complaints.
• Detect, prevent, and investigate fraud, abuse, money-laundering risk, chargebacks, and security incidents.
• Comply with Malaysian law, including requests from courts, police, Bank Negara Malaysia, the Personal Data Protection Commissioner, or other authorities where required or permitted.
• Improve, test, and secure the Platform.
• Send service messages about your account, orders, and security.
• Send marketing about RareStash products or promotions where we have any consent the PDPA requires, or where another permitted basis applies. You may withdraw marketing consent at any time.

If we need to use personal data for a new purpose that is not compatible with the above, we will notify you and, where the PDPA requires, obtain consent, unless another exception applies.

4. Disclosure to Third Parties

We do not sell your personal data. We may disclose it to:

• Payment service providers, acquiring banks, and operators of DuitNow, FPX, or similar schemes, solely to process or reconcile payments.
• Couriers and logistics partners for physical delivery.
• Cloud hosting, email, analytics, and IT security vendors who process data on our instructions.
• Professional advisers (lawyers, auditors, insurers).
• Companies in our group, if any, for the purposes in Section 3.
• A buyer or successor if we restructure, merge, or transfer the business, subject to appropriate safeguards.
• Authorities, courts, or enforcement agencies where required or permitted by law, or to protect our rights, users, or the public.

Those parties may have their own terms and privacy notices. We require processors who handle personal data for us to protect it and use it only for the agreed purpose, consistent with the PDPA.

5. Transfer Outside Malaysia

Some vendors (for example cloud or email providers) may process personal data on servers outside Malaysia. Where we transfer personal data outside Malaysia, we will do so in a manner consistent with the PDPA, including any conditions on transfer to places that may not have substantially similar data-protection laws.

6. Retention

We keep personal data only as long as necessary for the purposes in Section 3, and thereafter as required for:

• Accounting, tax, and audit obligations.
• Limitation periods for legal claims and chargeback windows.
• Regulatory or law-enforcement retention duties.

When data is no longer needed, we will delete it or irreversibly anonymise it, unless a longer period is required by law. Backup copies may persist for a limited time until rotated.

7. Security

We implement reasonable technical and organisational measures appropriate to the nature of the data, including access controls, encrypted transport where appropriate, and hashed storage of passwords. No method of transmission or storage is completely secure. You must keep your password confidential and protect your devices. If you believe your account is compromised, contact us immediately.

8. Your Rights under the PDPA

Subject to the PDPA and its exceptions, you may:

• Request access to your personal data that we hold, and information about how it is being used or processed.
• Request correction of personal data that is inaccurate, incomplete, misleading, or not up to date.
• Limit the processing of your personal data in circumstances the PDPA allows (for example withdrawing consent for marketing).
• Withdraw consent where processing is based on consent, without affecting processing already lawfully carried out. Withdrawal may mean we cannot continue to provide some or all of the Platform.

To exercise these rights, contact us using the details in Section 12. We may need to verify your identity. We may refuse a request on grounds permitted by the PDPA (for example where it is frivolous, would disclose another person's data, or would impair a lawful investigation). We may charge a prescribed fee for access where the PDPA allows.

Closing your account does not automatically erase all records. We may retain what the law or this Policy requires.

9. Cookies and Similar Technologies

We use cookies and similar technologies that are necessary to operate the Platform (for example session, authentication, and security). We may also use cookies to remember preferences or understand how the Platform is used. You can control cookies in your browser settings. Blocking some cookies may prevent login or checkout from working.

10. Children

The Platform is not directed at persons under eighteen (18) years of age. We do not knowingly collect personal data from children. If you believe we have collected such data, contact us and we will take reasonable steps to delete it, subject to any legal retention duty.

11. Complaints

If you have a privacy concern, contact us first and allow a reasonable time to respond. You may also lodge a complaint with the Personal Data Protection Commissioner of Malaysia in accordance with the PDPA.

12. Contact

For access, correction, withdrawal of consent, or other PDPA requests, contact us through Contact Us or email rarestashsupport@gmail.com. Please include your account email so we can identify you.

13. Changes to This Policy

We may update this Privacy Policy from time to time. The “Last updated” date will change. Where a change is material, we may provide additional notice on the Platform. Continued use after the update constitutes awareness of the revised Policy, except where the PDPA requires a different form of notice or consent.

This Policy describes how RareStash handles personal data under Malaysian law. It is not legal advice. Your statutory rights under the PDPA continue to apply.