Privacy Policy

Picklefox Loyalty Programme

Operated by Wonder Fox PLT

Effective date: July 2026  |  Last updated: July 2026

1. Who We Are

The Picklefox Loyalty Programme (“Programme”) is operated by Wonder Fox PLT (“we”, “us”, “our”), a limited liability partnership registered in Malaysia. We are the data controller responsible for the personal data you provide when participating in this Programme.

Contact: shop@picklefox.com

2. Scope of This Policy

This policy applies to personal data collected through:

• The Picklefox Loyalty web portal (the “Portal”)
• In-store enrolment at Picklefox retail locations
• Purchases made through the Picklefox Shopify online store where a loyalty account is linked

This policy does not apply to third-party websites or services we may link to.

3. What Personal Data We Collect

We collect only the data necessary to operate the Programme.

Data you provide directly:

• First name and last name — Personalisation, identification
• Email address — Account authentication, Programme communications
• Phone number — Account identification, in-store support
• Date of birth — Eligibility verification, birthday rewards (future)
• Marketing consent preference — Determining whether to send promotional communications

Data collected automatically through your activity:

• Purchase amounts (from Shopify) — Calculating points earned
• Points transaction history — Programme ledger, balance display
• Tier status (Bronze, Silver, Gold, Platinum) — Tier-based benefits eligibility
• Enrolment date and source — Programme administration
• Last activity timestamp — Account maintenance

Data we do not collect:

We do not collect payment card details, full Shopify order contents beyond purchase totals, or any sensitive personal data as defined under the Personal Data Protection Act 2010 (PDPA).

4. How We Use Your Personal Data

We process your personal data only for the following purposes:

a) Programme operation (contractual basis)

To manage your loyalty account, calculate and credit points for qualifying purchases, track your tier status, and enable you to redeem rewards. This processing is necessary to provide the Programme to you.

b) Account authentication (contractual basis)

To verify your identity and send you secure sign-in links (magic links) to access the Portal. These are transactional communications, not marketing.

c) Marketing communications (consent basis)

To send you updates about rewards, promotions, and exclusive member offers — but only if you have explicitly opted in. We use a pre-unchecked opt-in; your silence or inaction is not consent. You may withdraw consent at any time via your Profile page in the Portal.

d) Programme improvement (legitimate interests)

To understand how members use the Programme and to improve its features and offerings. We do not use your data for automated decision-making that produces legal or similarly significant effects on you.

5. How We Share Your Personal Data

We do not sell your personal data. We share it only with the following parties, strictly for the purposes described in this policy.

Service providers:

• Supabase — database and authentication infrastructure. Data is stored in a hosted cloud environment. Supabase processes data on our behalf under a data processing agreement.
• Resend — email delivery service. Your email address is passed to Resend solely to deliver authentication and Programme communications.
• Shopify — purchase data flows from Shopify to our system via webhook when an order is marked as paid. Shopify is an independent data controller for data held on its platform.

We require all service providers to maintain appropriate security standards and to process data only on our instructions.

Legal disclosure:

We may disclose your data if required to do so by Malaysian law, court order, or regulatory authority.

6. Data Retention

We retain your personal data for as long as your loyalty account is active. If your account has had no activity for 3 years, we may delete or anonymise your data, with prior notice where possible.

Points transaction records are retained for the life of the account as they form an immutable financial ledger.

If you request deletion of your account, we will delete or anonymise your personal data within 30 days, except where retention is required by law or legitimate business need (e.g. fraud prevention records).

7. Data Security

We take reasonable steps to protect your personal data from unauthorised access, loss, misuse, or disclosure. These include:

• Encrypted data storage at rest
• Secure HTTPS connections for all data in transit
• Authentication via time-limited magic links (no passwords stored)
• Access controls limiting which personnel can access production data

No method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security, but we are committed to maintaining appropriate safeguards.

8. Your Rights Under the PDPA

Under the Personal Data Protection Act 2010 (Malaysia), you have the following rights:

Right of access

You may request a copy of the personal data we hold about you.

Right of correction

You may correct inaccurate or incomplete personal data. You can update your name, phone number, and date of birth directly in the Portal under Your Profile at any time.

Right to withdraw consent

Where we process your data on the basis of consent (marketing communications only), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal. To opt out, toggle the preference in Your Profile → Communication Preferences.

Right to limit processing

In certain circumstances, you may request that we restrict processing of your personal data.

How to exercise your rights:

Email us at privacy@picklefox.com with your request. We will respond within 21 days. We may need to verify your identity before processing the request.

9. Cookies and Tracking

The Portal uses session cookies to maintain your authenticated state. These are strictly necessary for the Portal to function and do not require consent. We do not use advertising or tracking cookies.

10. Children

The Programme is not intended for persons under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has enrolled, please contact us and we will remove the account.

11. Changes to This Policy

We may update this policy from time to time. We will notify you of material changes by displaying a notice in the Portal. Continued use of the Programme after changes take effect constitutes your acceptance of the updated policy. The effective date at the top of this page reflects when the current version took effect.

12. Contact and Complaints

Wonder Fox PLT
Email: shop@picklefox.com