Privacy Policy

This policy explains how SupplyBunny (operated by Sbunny Group Sdn Bhd (Co. No. 1182632-P), "we", "us") collects, uses, and shares information when you use supplybunny.com or any related service. It is governed by the Personal Data Protection Act 2010 of Malaysia ("PDPA").

1. What we collect

• Account information: name, email, mobile number, business name, billing and delivery addresses.
• Order information: products ordered, quantities, prices, payment status, delivery confirmations, communications with suppliers.
• Usage data: IP address, device type, browser, pages visited, referrer, search queries, and similar analytics collected via cookies and tags.
• Communications: messages sent through our website, WhatsApp, or email when you contact us or our support agents (including Alice).

We do not knowingly collect sensitive personal data (as defined by PDPA s. 4) — such as data on your physical or mental health, political opinions, religious beliefs, or any offence you may have committed — and we do not ask for it.

2. How we use it

• To process and fulfill your orders.
• To communicate with you about your orders, account, and services.
• To recommend products, promotions, and content relevant to your business.
• To detect, prevent, and respond to fraud, abuse, or security incidents.
• To send marketing messages where you have consented — you can withdraw consent at any time by replying STOP via WhatsApp or unsubscribing from emails.
• To comply with legal, tax, and regulatory obligations.

3. Who we share it with

• Suppliers — order details necessary to fulfill your order (delivery address, contact, items).
• Payment processors — including iPay88, for processing transactions.
• Delivery partners — to coordinate handover and last-mile delivery.
• Analytics and marketing services — Google Analytics, Google Tag Manager, Mailchimp, and similar tools that help us understand and improve the service.
• Authorities — when required by law, court order, or to protect our rights or the safety of others.

We do not sell your personal information. We do not share it for third-party advertising beyond the cookie-based ad partners listed above.

4. Transfers outside Malaysia

Some of the third-party services listed in Section 3 — including Google Analytics, Google Tag Manager, and Mailchimp — store and process data on servers located outside Malaysia (primarily in the United States and Singapore). By using the service, you consent to your personal data being transferred to and processed in these jurisdictions, subject to reasonable safeguards applied by those providers. Such transfers are made in accordance with PDPA s. 129 and only to the extent necessary to deliver the service.

5. How long we keep it

We retain account and order records for as long as your account is active and for a further period needed to meet legal, tax, and accounting obligations — typically up to seven years after your last transaction. Marketing preferences and analytics data are retained for shorter periods aligned with industry practice.

6. Cookies

We use cookies and similar technologies for: keeping you signed in, remembering your cart, measuring how the site is used, and delivering relevant marketing. You can control cookies through your browser settings — disabling them may affect certain features (for example, signing in or keeping items in your cart).

7. Your rights and how to exercise them

Under the PDPA you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete personal data.
• Withdraw consent you previously gave — including consent to marketing — at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.
• Limit or object to the processing of your personal data for direct marketing.
• Request deletion of your personal data, subject to legal obligations that require us to retain certain records (for example, tax and accounting records).

To exercise any of these rights, message Alice on WhatsApp via the button at the bottom of any page. We may need to verify your identity before acting on a request. We will respond within 21 days as required by PDPA.

8. Data integrity and security

We take reasonable steps to keep personal data accurate, complete, and up to date — you can help us by reviewing and updating your account details through your profile page. We use industry-standard safeguards — encrypted connections, access controls, and regular reviews — to protect your information from unauthorised access, loss, or disclosure. No system is 100% secure; you accept residual risk when using the service.

9. Children

SupplyBunny is a B2B service intended for users 18 and over. We do not knowingly collect data from children.

10. Changes

We may update this policy from time to time. The current version will always be posted at this URL with a revised "last updated" date. Your continued use of the service after a change constitutes acceptance of the updated policy.

11. Contact

Questions about this policy, or to submit a data access or deletion request? Message Alice on WhatsApp via the button at the bottom of any page.