Privacy Policy

1. Introduction

KABO (“we,” “our,” or “us”) operates the website and digital customer loyalty platform available at kabo.my (the “Service”). This Privacy Policy outlines how we collect, use, store, disclose, and safeguard your personal data in accordance with the Malaysian Personal Data Protection Act 2010 (PDPA). By using our Service, registering an account, or subscribing to our platform, you consent to the data practices described in this policy.

2. Information We Collect

We collect information that identifies, relates to, or describes you or your business (“Personal Data”). The types of information we collect include:

• Account Registration Data: Store name, account owner's full legal name, business address, email address, and phone number when registering a merchant profile.
• Merchant Customer Data: Customer phone numbers and basic program activity details (e.g., stamp logs, reward redemptions, and private feedback submissions) provided when merchants process rewards via the POS counter interface.
• Billing & Payment Information: Payment processing status, subscription histories, mandate identifiers, and billing schedules. Sensitive card numbers or bank credentials are processed directly by our secure payment partner (Curlec / Razorpay) and are never stored on our servers.
• Technical & Usage Data: Internet Protocol (IP) addresses, browser types, device categories, operating systems, and page interaction logs recorded automatically when visiting our platform.

3. How We Use Your Information

We utilize collected Personal Data for the following purposes:

• To provision, maintain, and optimize your KABO merchant account and digital counter tools.
• To process subscription billing transactions, mandating auto-debit payments via Curlec/Razorpay.
• To route customer feedback and manage automated review systems configured by store owners.
• To communicate service updates, account notices, system warnings, and technical support responses.
• To detect, prevent, and address security breaches, fraudulent activity, or technical malfunctions.

4. Disclosure of Personal Data

We strictly do not sell, rent, or trade your Personal Data to third parties. We may disclose your data only in the following limited circumstances:

• Third-Party Service Providers: Trusted third-party vendors who provide infrastructure, authentication, payment processing, or hosting services (such as Supabase, Vercel, and Curlec/Razorpay) solely to enable platform functionalities.
• Legal Compliance: When required to comply with applicable Malaysian laws, court orders, government regulations, or requests from law enforcement authorities.
• Business Transfers: In connection with or during negotiations for any merger, acquisition, sale of assets, or reorganization of our business entity.

5. Payment Security & Data Storage

Your data is encrypted in transit using SSL/TLS protocols and stored securely on cloud database infrastructure governed by modern access control policies. Payment transactions are securely executed through Curlec (a Razorpay entity), adhering to PCI-DSS Level 1 compliance standards. We do not directly capture, process, or store sensitive banking credentials or credit card numbers on KABO infrastructure.

6. Data Retention & Your Rights

We retain Personal Data only for as long as necessary to fulfill the purposes outlined in this policy or as required by law. Under the PDPA, you have the right to:

• Request access to your Personal Data stored in our database.
• Request correction or updating of any inaccurate or outdated Personal Data.
• Withdraw your consent or request account deletion, subject to legal or contractual obligations regarding subscription history.

7. Cookies and Tracking Technologies

We use essential session cookies and local storage items to maintain authenticated user logins, securely tokenise requests, and preserve UI preferences. You can configure your browser to decline non-essential cookies; however, doing so may impact platform navigation and features.

8. Changes to This Privacy Policy

We reserve the right to update or modify this Privacy Policy at any time. Any changes will be posted on this page with an updated “Last Updated” date. Continued use of the platform after updates take effect constitutes your acknowledgement and acceptance of the revised terms.

9. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or how your personal data is handled under the PDPA, please contact our Data Protection Office at: