Privacy Notice
1. Who handles your data
This Notice describes personal-data processing by Ofdast Network (002908949X), operator of LokalFlow, at No.52, Jalan CVR 8, Country Villas Resort, 77200, Bemban, Melaka. Contact our privacy contact at hi@respawned.my. We act as controller for account administration, platform billing, our security and compliance records, complaints and other purposes we determine. A Merchant normally controls its customer-order data, and we process that data on its instructions to operate its storefront. For our own legally required records, platform-security investigations or complaint handling, we may separately act as controller. Roles depend on actual processing, not a label. Merchants must issue their own notices. This Notice is available in Bahasa Malaysia and English; Bahasa Malaysia prevails if there is a difference, without reducing legal rights.
2. Data categories and sources
Depending on the functions used, we process account and business contacts, login and authentication information, business identifiers and verification material, platform subscription and transaction references, catalogue content, customer names and contact details, delivery addresses, order items and amounts, payment status or payment evidence, shipment references, customer reviews, support requests and complaint evidence. Technical data may include IP address, device/browser details, session identifiers, event times and security or error logs. We receive data from you, the Merchant or its authorised staff, the Buyer, connected payment/delivery providers, device interactions, complainants and lawful public or regulatory sources. Verification requests must be relevant and proportionate. Do not provide banking passwords or unnecessary full card details.
3. Why we process data
We process relevant data to open and administer accounts; provide storefronts and orders; connect payments and delivery; send transaction and service notices; provide support; operate requested AI or voice features; manage billing; investigate abuse, fraud and complaints; comply with law; and establish or defend legal claims. Processing relies on consent where required or a specific applicable statutory permission, such as necessity for a contract with the individual, legal compliance or administration of justice. We assess the applicable basis for each purpose and use only relevant data. Optional marketing requires the permission applicable to that communication and has an opt-out.
4. Required information and choices
Fields identified as required are needed for the stated account, compliance or transaction purpose. Without necessary contact, delivery or payment-reference information, the relevant account or order may not be provided or completed. Optional profile fields, marketing choices and voice features may be declined. Permission to use a microphone or location is separate from accepting platform terms; refusing it may disable that feature, not ordinary browsing. A privacy notice informs you about processing and is not blanket consent to every possible use. Where we require a separate consent, we will identify the purpose and consequences of withdrawal.
5. Recipients and disclosures
Data is disclosed as necessary to the relevant Merchant and authorised staff; hosting, storage, content-delivery and support suppliers; payment processors; delivery/booking providers; transactional messaging services; AI or speech providers when those functions are used; professional advisers; and competent authorities where a lawful basis exists. Product and review content you choose to publish is visible to storefront visitors; private order information is not public catalogue content. Connected providers may act as independent controllers for their own lawful functions. We do not sell personal data or use private Merchant order data to build unrelated marketing lists. A business transfer would require appropriate safeguards and notice where required. We do not disclose data merely because someone informally requests it.
6. AI voice location and cookies
Requested AI functions may process prompts, catalogue text, images and order-related input with the relevant provider. Voice ordering may involve microphone audio and/or a transcript processed by the browser or speech provider and the order service. Review recognised information before confirming. Do not submit sensitive or confidential data unnecessary for the feature. We do not authorise unrestricted use of private customer data for general model training through these Terms. Provider-specific processing and retention must be explained in the feature notice where applicable. Location features use location you supply or permit for the stated function. Cookies and similar storage support sessions, security, language, cart or referral features where enabled; see the Cookie Notice for choices. Optional analytics or advertising tools require applicable notice and permission before activation.
7. International processing
Some suppliers may process data outside Malaysia. Before a transfer we must identify an applicable condition under section 129 of the PDPA and apply appropriate contractual and operational safeguards. Acceptance of platform terms alone is not treated as unlimited permission for all overseas transfers. Request information about relevant recipients and locations through hi@respawned.my. Where a transfer relies on your consent, we explain that transfer and obtain the required consent. If a service cannot be provided without a particular lawful transfer, we explain the consequence of declining it.
8. Retention and deletion
We retain personal data only for the purposes for which it is needed and applicable legal periods. Required marketplace supplier, transaction and advertisement records are retained for three years where the 2024 electronic trade regulations apply. Financial records are retained for applicable statutory periods. Other account, order, support, security and backup records follow a documented retention schedule based on necessity and legal obligations. Closure or deletion requests do not immediately erase records needed for a lawful hold, complaint, tax or regulatory obligation. Retained records are restricted to those purposes and deleted or anonymised when no longer needed. Contact us for the retention applicable to your data and account; backups are removed through their controlled expiry process.
9. Security and incidents
We must maintain reasonable safeguards appropriate to the data, including access controls, confidentiality, secure transmission and incident handling, and require appropriate protection from processors. No system is risk-free. Where a breach occurs, we investigate, contain it and make notifications to the Commissioner, affected individuals and relevant Merchants as required by applicable law and regulatory directions. A Merchant acting as controller retains its own notification duties. Report suspected compromise promptly to hi@respawned.my without sending passwords or unnecessary personal data.
10. Your rights and complaints
Subject to applicable conditions, you may request access or correction, withdraw consent, require direct marketing to stop, object to processing causing or likely to cause unwarranted substantial damage or distress, and request portability where technically feasible and compatible. You may also request deletion or restriction; these are assessed against the law and retention duties, not an unconditional right to erase all records. Send a request to hi@respawned.my. We verify identity proportionately, explain any lawful refusal or permitted fee, and respond within applicable statutory deadlines. Withdrawal may prevent the affected service but does not invalidate earlier lawful processing. For Merchant-controlled data, contact the Merchant; we will assist routing requests. You may complain directly to Malaysia’s Personal Data Protection Commissioner through www.pdp.gov.my without first exhausting our process.
11. Children sensitive data and updates
Merchant accounts are for adults. Do not submit children’s data or sensitive personal data unless necessary, lawful and supported by required permissions and safeguards. Ordinary purchase records can sometimes reveal health or other sensitive information; such data still requires appropriate protection. If you believe data was collected improperly, contact us for investigation and appropriate deletion or restriction. Material changes to this Notice will be communicated through suitable account or site notices. A new purpose requiring consent will not be implemented merely by posting a revised notice.