1) What we collect
We may collect the following categories of personal data:
Identity & Contact – name, IC/passport (if provided for invoicing/financing), phone/WhatsApp number, email, billing/shipping address.
Order & Payment – order details, invoices, payment method (we do not store full card numbers), bank-in slips/transaction refs.
Vehicle & Fitment – car brand/model, year, VIN/chassis, engine/gearbox codes, photos you send for compatibility checks.
Communications – messages, call notes, emails, social DMs; your interactions with our customer support.
Technical & Usage – IP address, device/browser info, cookies, pages viewed, clicks, referring/exit pages, and approximate location.
Marketing Preferences – opt-ins for email/SMS/WhatsApp promotions.
Media – photos/videos you upload (e.g., of parts, receipts).
CCTV (if visiting our yard) – video footage for security and loss prevention.
2) How we collect data
Directly from you (checkout, WhatsApp, phone, email, forms).
Automatically via cookies/SDKs (site analytics, ads, fraud prevention).
From third parties (payment providers, couriers, marketplaces like Shopee/Lazada when you buy from our official stores).
3) Why we use your data (Purposes)
We process personal data for:
Sales & Fulfilment – processing orders, payments, shipping/returns, warranty claims.
Customer Support – product advice, fitment checks, after-sales communications.
Security & Fraud Prevention – verify identity, prevent chargebacks/abuse, protect our staff/customers/assets.
Marketing – send promotions, new arrivals, and updates only if you consent (opt-in) or as permitted by law; you can opt-out anytime.
Analytics & Improvements – measure traffic, improve site features, fix bugs.
Legal/Compliance – tax/accounting, responding to lawful requests.
4) Our legal basis (PDPA principles)
We collect/ use data where one or more of these apply:
Your consent (e.g., marketing opt-in, optional photos/files you send).
Contract necessity (to process your order, deliver items, handle warranty).
Legal obligation (invoices, accounting, compliance with authorities).
Legitimate interests (site security, fraud prevention, service improvement)—balanced against your rights.
5) Cookies & similar technologies
We use cookies/SDKs to operate the site and measure effectiveness. Categories:
Strictly necessary – cart/session, checkout, security.
Performance/analytics – traffic stats (e.g., first‑party analytics, Google Analytics).
Advertising/retargeting – e.g., Meta Pixel/Google Ads to show relevant ads.
Cookie banner text (example):
“By clicking Accept, you agree we may use cookies for site performance, analytics, and ads as described in our Privacy Policy. Click Manage to choose.”
Your choices: You can reject non‑essential cookies via our banner/settings and browser controls. Disabling certain cookies may impact site features.
6) Payments
We use third‑party payment processors (e.g., FPX/card gateways, e‑wallets). They receive your payment info directly; we do not store full card numbers. Their use of your data is governed by their own privacy policies.
7) Sharing & disclosure
We may share personal data with:
Couriers & logistics – to deliver your order (name, address, phone, item details).
Payment providers & banks – to process payments and prevent fraud.
IT/Cloud & analytics partners – website hosting, email/SMS/WhatsApp tools, analytics, backups.
Professional advisors – auditors, accountants, lawyers (as needed).
Marketplaces & social platforms – if you interact with our official stores/pages there.
Authorities – if required by law or to protect rights, safety, or property.
We do not sell your personal data.
8) International transfers
Some service providers may be located outside Malaysia. Where data is transferred, we take reasonable steps to ensure it is protected with appropriate safeguards and contractual terms.
9) Data retention
We keep data only as long as necessary for the purposes above:
Orders, invoices, and accounting: 7 years (or as required by law).
Warranty/claims records: duration of warranty + 2 years.
Marketing consents and opt‑outs: until you withdraw consent, then we record the opt‑out.
CCTV: typically 30–90 days unless needed for investigations.
When no longer needed, we securely delete or anonymise data.
10) Your rights (PDPA)
Subject to conditions in PDPA, you may:
Access the personal data we hold about you.
Correct inaccurate or incomplete data.
Withdraw consent where processing is based on consent (e.g., marketing).
Object to certain processing or request restriction where applicable.
Opt‑out of direct marketing at any time (use the unsubscribe link or WhatsApp “STOP”).
Requests can be made via hello@echooneautosparepart.com. We may need to verify your identity before acting on a request.
11) WhatsApp, Calls & Messaging
If you contact us by WhatsApp or phone, your number and message content may be processed to serve you. WhatsApp messages are end‑to‑end encrypted in transit; however, metadata may be processed by WhatsApp. Please avoid sending sensitive info unless necessary.
12) Children
Our products are not directed to children. We do not knowingly collect data from persons under 18. If you believe a minor provided data, contact us to delete it.
13) Security
We use reasonable administrative, technical, and physical safeguards to protect data (access controls, HTTPS, limited retention, employee training). No method is 100% secure; please keep your account/WhatsApp device secure.
14) Links to other sites
Our site may link to third‑party sites or platforms (Shopee, Lazada, Facebook, Instagram, Google Maps). We are not responsible for their privacy practices.
15) Changes to this Policy
We may update this Policy from time to time. The “Last updated” date will change. Material changes may be highlighted on the Site.
16) Contact us (DPO)
Questions or requests about your personal data?
Email: hello@echooneautosparepart.com
Phone/WhatsApp: +60 10-278 8002
Address: LOT PT 24290, BATU 6 3, 4, Jalan Kapar, 41400 Klang, Selangor