Privacy & Cookies Policy

Last Updated: 24/08/2026

We, Cavenzi Design Sdn Bhd (SSM Reg. No. 200401000148) (“Cavenzi”, “we”, “us” or “our”), take your privacy seriously and are committed to providing a safe online and customer service experience.

We believe in being transparent about our practices. This Privacy & Cookies Policy (“Policy”) explains how we collect, use, process, store and disclose your Personal Data, including when you interact with our website, stores, customer service channels, WhatsApp Business services, social media channels and other services, and the choices and rights available to you.

1. This Policy

1.1

This Policy describes how your information, including Personal Data, will be collected, processed, used, stored and shared in connection with your use of our website (“Site”), products, services, customer service channels and other interactions with us (collectively, “Services”), our purposes and legal basis for doing so, as well as your rights and choices regarding the information you provide to us.

This Policy is intended to meet the requirements of the Personal Data Protection Act 2010, including its statutory re-enactments, amendments, regulations, guidelines and orders, collectively referred to as the Personal Data Protection Act (“PDPA”).

1.2

We reserve the right to modify, amend and/or update this Policy from time to time, including to reflect changes to our Services, technology, business practices or applicable laws.

You should periodically visit this page to review the current Policy. Where appropriate, we may notify you of material changes through our Site, customer communication channels or other reasonable means and update the “Last Updated” date above. Changes will not apply retrospectively unless required or permitted by law.

1.3

By using our Site or Services, communicating with us, or voluntarily providing Personal Data to us, you acknowledge that you have read and understood this Policy.

Where consent is required under applicable law, we will obtain such consent as appropriate.

1.4

If you have questions about this Policy, our privacy practices, or wish to exercise your rights regarding your Personal Data, please contact our Data Protection Officer (“DPO”) at:

Email: privacy@cavenzi.com
Address: 25, Jalan Kasturi 3, Plaza Kasturi, Off Jalan Balakong, 43200 Cheras, Selangor, Malaysia
Telephone / WhatsApp: 013-3238 987

2. Your Rights

2.1

Subject to the PDPA and other applicable laws, you may have the right to:

Request access to your Personal Data. Subject to exceptions provided under the PDPA, you may request a copy of Personal Data that we hold about you.
Request correction of your Personal Data. You may request correction of incomplete, inaccurate, misleading or outdated Personal Data held by us. We may refuse an access or correction request where permitted under the PDPA.
Request deletion or erasure. Where applicable and subject to legal, regulatory, contractual and legitimate business retention requirements, you may request that we delete Personal Data that we no longer require.
Withdraw consent. Where processing is based on your consent, you may withdraw that consent by contacting us. Withdrawal may affect our ability to provide certain Services to you.
Limit processing. You may request that we limit certain processing of your Personal Data, including requesting that we stop sending marketing or promotional communications to you, subject to applicable law.

3. How to Exercise Your Rights

3.1

If you wish to exercise any of the rights described above, please:

submit your request in writing to our DPO Contact;
provide sufficient information for us to verify your identity, where reasonably required; and
identify the right you wish to exercise and the Personal Data concerned.

3.2

We will endeavour to respond to legitimate requests within the period required by applicable law.

We may request additional information where necessary to verify your identity, clarify your request or protect Personal Data from unauthorised disclosure.

Where permitted by law, we may charge a reasonable administrative fee or decline to comply with requests that are manifestly unfounded, repetitive or excessive.

4. Types of Data We Collect

4.1 Personal Data You Provide Directly to Us

We may collect Personal Data that you voluntarily provide during your dealings with us through channels including:

our Site;
our retail outlets or customer service channels;
telephone calls;
email;
WhatsApp;
social media and messaging platforms;
enquiries, quotations and orders;
warranty or after-sales service requests;
delivery arrangements;
account registration;
promotions, competitions, surveys or events; and
other transactions or communications with us.

“Personal Data” means information relating directly or indirectly to an individual who is identified or identifiable from that information alone or together with other information that we possess or are likely to have access to.

Depending on your interaction with us, Personal Data may include your:

name;
telephone or mobile number;
WhatsApp identifier or profile information made available to us through WhatsApp;
email address;
postal or delivery address;
identification information where legitimately required;
transaction and purchase information;
product enquiries and preferences;
warranty or service information;
photographs or other media voluntarily provided to us;
payment-related information;
correspondence and customer service history; and
other information that you voluntarily provide to us.

4.2 WhatsApp and Messaging Data

When you communicate with us through WhatsApp Business or another messaging platform, we may receive and process information including:

your mobile telephone number;
your WhatsApp account or user identifier;
your profile name and other profile information made available by the platform;
the date and time of communications;
message contents;
images, documents, audio, video or other media that you voluntarily send to us;
message delivery and status information;
information relating to your enquiry, order, delivery, warranty or customer service request; and
technical information made available by the messaging platform.

We use this information to receive, understand and respond to your communications and to provide customer service and other Services requested by you.

WhatsApp services are provided by Meta Platforms and/or its affiliated entities. Your use of WhatsApp is also subject to WhatsApp’s and Meta’s applicable terms, policies and privacy practices.

4.3 Personal Data from Third-Party Sources

We may receive Personal Data from third-party sources where permitted by law, including our affiliates, business partners, social media and messaging platforms, delivery partners, payment providers, analytics providers, identity verification or compliance providers and other service providers.

4.4 Non-Identifiable or Aggregated Data

When you interact with our Site or Services, we may collect or generate aggregated, statistical or otherwise non-identifiable information.

We may use this information to understand customer behaviour, improve our Services, analyse trends, measure performance and conduct research.

Where non-identifiable information is combined with other information in a manner that enables an individual to be identified, we will treat the combined information as Personal Data in accordance with this Policy.

5. Consent and Withdrawal

5.1

By voluntarily providing your Personal Data to us and interacting with our Services, you acknowledge the collection and processing of your Personal Data for the purposes described in this Policy.

Where applicable law requires consent for particular processing activities, we will obtain that consent.

5.2

Where processing is based on your consent, you may withdraw your consent by notifying us in writing.

Following receipt of a valid withdrawal request, we will take reasonable steps to cease the relevant processing and, where appropriate, delete or anonymise the relevant Personal Data unless continued retention or processing is required or permitted for legal, regulatory, accounting, contractual, security or legitimate business purposes.

5.3

You may decline to provide certain Personal Data. However, doing so may prevent us from providing certain Services or responding adequately to your request.

6. How We Use Your Personal Data

6.1

Our primary purposes in collecting and processing Personal Data are to provide, facilitate, personalise, secure and improve our Site, products, Services and customer relationships.

We may use Personal Data for purposes including:

providing, operating, updating and maintaining our Site and Services;
processing enquiries, quotations, orders, payments, deliveries, returns, warranties and after-sales services;
maintaining customer, transaction and business records;
communicating with you through telephone, email, WhatsApp, social media or other channels;
responding to questions, complaints, feedback, enquiries and customer service requests;
providing product information, availability information, specifications, recommendations and other customer assistance;
authenticating or verifying information where reasonably necessary;
conducting research, analytics, surveys, market analysis and service improvement;
improving and personalising your customer experience;
protecting our customers, employees, systems and business against fraud, misuse, security threats and prohibited or unlawful activity;
complying with applicable laws, legal processes, regulatory requirements and legitimate requests from authorities;
carrying out internal administrative, operational, accounting, auditing and management activities;
administering loyalty, rewards, promotional or membership programmes;
conducting credit reference checks or assessing creditworthiness where reasonably required in connection with relevant products or Services;
communicating marketing and promotional information where permitted by law and subject to your applicable communication preferences; and
other purposes reasonably related to the above and to the management of our business and relationship with you.

6.2 Automated and AI-Assisted Customer Service

We may use automated systems and artificial intelligence-assisted tools to support our customer service operations, including communications conducted through WhatsApp or other digital channels.

Such systems may assist us with activities including:

identifying the nature of an enquiry;
retrieving relevant product or service information;
answering frequently asked questions;
searching our internal knowledge resources;
generating suggested responses;
routing enquiries to appropriate personnel;
maintaining conversation context;
summarising communications for customer service purposes; and
improving the efficiency and consistency of customer support.

Where automated or AI-assisted tools are used, Personal Data may be processed by systems operated by us or by authorised technology and service providers acting on our behalf, subject to appropriate safeguards and applicable law.

We do not intend to rely solely on automated systems to make decisions that produce significant legal or similarly significant effects on individuals without appropriate human involvement where required by applicable law.

Customers may request assistance from a member of our staff where human intervention is reasonably available and appropriate.

6.3 WhatsApp Customer Service

Where you contact us through WhatsApp, we may use WhatsApp’s business messaging services and related technologies to:

receive and respond to messages;
provide automated or assisted responses;
provide customer support;
provide information about our products and Services;
manage enquiries, orders, deliveries or after-sales matters;
send transactional or service-related notifications;
maintain relevant customer service records; and
where permitted, send promotional or marketing communications in accordance with applicable requirements.

Communicating with us through WhatsApp may involve the transmission and processing of information through Meta’s infrastructure as well as our own systems and authorised service providers.

6.4

If we intend to process Personal Data for a materially different purpose that is incompatible with this Policy, we will provide appropriate notice and obtain consent where required by applicable law.

7. Use of Cookies and Similar Technologies

7.1 Cookies

We may use cookies and similar technologies to improve our Site and Services.

A cookie is a small data file that may be stored on your computer or electronic device when you visit a website.

Cookies may help us to:

recognise your browser or device as a previous visitor;
remember preferences;
understand how visitors use our Site;
measure traffic, page views and other usage statistics;
conduct research and statistical analysis;
improve our content, products and Services;
customise marketing and advertising where permitted;
measure the effectiveness of communications and campaigns; and
make your online experience more efficient.

Information obtained through cookies may include IP addresses, browser information, device information and usage data.

Where cookie information identifies or can reasonably be linked to an individual, we will treat it as Personal Data.

Where required, we will obtain consent before using non-essential cookies.

You may control cookies through your browser or device settings. Blocking certain cookies may affect the functionality of our Site.

7.2 Third-Party Cookies

Certain third-party service providers may use cookies or similar technologies in connection with services provided through our Site.

Such third parties may have their own privacy policies and practices governing their technologies and processing activities.

7.3 Log Files

When you access our Site or digital Services, servers and supporting infrastructure may automatically record technical information such as:

IP address;
browser type;
device information;
referring or exit pages;
requested URLs;
timestamps;
domain information; and
usage and interaction information.

We may use this information for security, troubleshooting, analytics, administration and service improvement.

7.4 Pixels, Web Beacons and Similar Technologies

We may use pixels, web beacons or similar technologies to understand how users interact with our Site, advertisements or electronic communications.

Where such technologies involve Personal Data, their use will be governed by this Policy and applicable law.

8. How We Share Your Information

8.1

We do not sell Personal Data as part of our ordinary business.

We may disclose or provide access to Personal Data where reasonably necessary for the purposes described in this Policy, including to:

Our Affiliates and Business Partners. Authorised affiliates and business partners that assist us in providing our Services, managing customer relationships, customer support, deliveries or other business functions.
Technology and Service Providers. Providers supporting our websites, applications, customer service systems, WhatsApp integrations, hosting, cloud or server infrastructure, databases, backups, security, analytics, communications, artificial intelligence or automation systems, payment processing, identity verification, delivery services and other operational functions.
Messaging and Communications Platforms. Providers such as Meta and WhatsApp where their infrastructure is used to facilitate communications between you and us.
Professional Advisers. Lawyers, accountants, bankers, auditors, insurers and other professional advisers where access to Personal Data is reasonably necessary for them to provide their services.
Governmental Authorities and Agencies. Authorities, regulators, law enforcement bodies or courts where disclosure is required or permitted by law or reasonably necessary to protect our legal rights, customers, employees, systems or business.
Successors and Corporate Transaction Parties. Parties involved in an actual or proposed merger, acquisition, restructuring, financing, sale, transfer or other corporate transaction involving our business or assets.
Data Centres and Infrastructure Providers. Providers operating servers, cloud infrastructure or data centres within or outside Malaysia.
Payment Providers. Financial institutions, payment gateways, merchants, card organisations and related providers where necessary to process or verify payments.
Delivery and Fulfilment Providers. Logistics, transportation, installation and other service providers where necessary to fulfil an order or customer request.
Other Authorised Parties. Other persons or organisations where you have authorised disclosure or where disclosure is otherwise permitted by applicable law.

Service providers acting on our behalf are expected to process Personal Data only for appropriate purposes connected with the services they provide to us and subject to applicable contractual, confidentiality and security requirements.

8.2

As our business develops, we may buy, sell, restructure or transfer businesses or assets. Personal Data may form part of an actual or proposed corporate transaction, subject to applicable legal requirements and appropriate safeguards.

8.3

We may share aggregated, anonymised or otherwise non-identifiable information for analytics, research, business planning or other lawful purposes where such information does not identify an individual.

8.4

Where you validly request deletion or correction of Personal Data, we will take reasonable steps, where required and appropriate, to communicate the request to relevant service providers or recipients.

8.5 International Transfers

Some of our service providers, technology providers, messaging platforms, cloud infrastructure, servers or data centres may be located outside Malaysia.

As a result, Personal Data may be transferred to, accessed from or stored in jurisdictions outside Malaysia.

Where Personal Data is transferred internationally, we will take reasonable steps to ensure that the transfer and processing are carried out in accordance with applicable Malaysian data protection requirements and that appropriate safeguards are applied where required.

9. Period of Retention

We retain Personal Data only for as long as reasonably necessary for the purposes for which it was collected and for legitimate legal, regulatory, accounting, tax, security, contractual and business requirements.

This may include customer service and WhatsApp communications where retention is reasonably necessary to:

continue an enquiry or transaction;
provide after-sales or warranty support;
maintain appropriate business records;
investigate complaints or disputes;
prevent fraud or abuse;
maintain security; or
comply with legal obligations.

When Personal Data is no longer reasonably required, we will take appropriate steps to delete, destroy or anonymise it in accordance with our retention practices and applicable law.

10. Accuracy of Your Personal Data

You are responsible for ensuring, where reasonably practicable, that Personal Data you provide to us is accurate, current, complete and not misleading.

Please notify us where relevant Personal Data changes or requires correction.

11. Information About Others

If you provide Personal Data relating to another individual, you represent that you are authorised to provide that information to us and, where required, have informed that individual about the relevant processing or obtained the appropriate consent.

You should not provide Personal Data belonging to another person unless you are authorised to do so.

You acknowledge that such Personal Data may be collected, processed, stored and disclosed by Cavenzi Design Sdn Bhd in accordance with this Policy and applicable law.

12. Security

12.1

We use reasonable physical, organisational and technical safeguards designed to protect Personal Data against accidental or unlawful loss, misuse, unauthorised access, collection, disclosure, alteration or destruction.

Measures may include, where appropriate:

access controls;
authentication;
encryption in transit;
restricted administrative access;
server and application security controls;
logging and monitoring;
backups;
security updates;
separation of systems and services; and
confidentiality obligations for personnel and service providers.

12.2

While we take reasonable measures to protect Personal Data, no Internet transmission, messaging platform, information system or storage technology can be guaranteed to be completely secure.

You should therefore exercise reasonable care when sending sensitive information through electronic communications.

12.3

Our infrastructure or that of our authorised service providers may be located outside Malaysia.

Where Personal Data is processed outside Malaysia, we will take reasonable steps to ensure that such processing is conducted consistently with this Policy and applicable legal requirements.

13. Monitoring and Checking

13.1

We may monitor and, where appropriate, record communications with customers, including telephone calls, emails, WhatsApp conversations and other customer service communications, for purposes such as:

customer service;
quality assurance;
training;
security;
fraud prevention;
complaint handling;
auditing;
system improvement; and
legal or regulatory compliance.

13.2

Where appropriate and permitted by law, information may be analysed using automated or AI-assisted systems to support customer service, quality assurance, security, fraud prevention or operational improvement.

13.3

We may preserve the contents of emails, WhatsApp communications, contact forms and other electronic messages that we receive where reasonably necessary for the purposes described in this Policy.

13.4

Authorised employees and service providers may access communications where reasonably necessary to provide customer service, maintain systems, investigate suspected misuse, perform audits or fulfil other legitimate business purposes.

14. Third-Party Platforms and External Services

14.1

Our Site and Services may contain links to, integrate with or operate through third-party platforms and services, including social media networks, messaging platforms, payment providers and other external services.

Examples may include WhatsApp and other services provided by Meta.

These third parties operate their own services and may independently collect or process Personal Data according to their own terms and privacy policies.

This Policy governs Cavenzi’s processing of Personal Data and does not replace the privacy policies applicable to independent third-party platforms.

We encourage you to review the relevant third party’s privacy information where appropriate.

14.2 Unsolicited Information

If you voluntarily submit information that we have not requested, we may process that information where reasonably necessary to understand or respond to your communication.

However, you should avoid sending unnecessary sensitive Personal Data through WhatsApp, email, social media or other customer service channels.

15. Children and Minors

Our products and Services are generally intended for adults purchasing or enquiring about furniture and related products.

We do not knowingly seek to collect Personal Data from children through our Site or automated customer service systems without appropriate involvement of a parent or guardian where required.

If you believe that a child has provided Personal Data to us in circumstances where this should not have occurred, please contact our DPO.

16. Marketing Communications

Where permitted by applicable law, we may use relevant contact information to communicate promotions, offers, product information or other marketing communications.

You may request that we stop sending direct marketing communications by:

using an unsubscribe or opt-out mechanism provided in the communication, where available;
replying with an applicable opt-out request;
contacting our customer service team; or
contacting our DPO.

Opting out of marketing communications does not prevent us from sending necessary transactional, customer service, security, warranty, delivery or other non-marketing communications relating to your dealings with us.

17. Governing Law and Dispute Resolution

Irrespective of the country from which you access or use our Site or Services, to the extent permitted by applicable law, this Policy shall be governed by the laws of Malaysia.

You agree to submit to the jurisdiction of the courts of Malaysia in relation to disputes arising in connection with this Policy, subject to any rights or remedies available under applicable law.

18. Conflict

Where this English-language Privacy & Cookies Policy conflicts with a corresponding translated version published by us, the English-language version shall prevail to the extent permitted by applicable law.

19. Contact Us

For privacy enquiries, requests or complaints relating to this Policy or the processing of your Personal Data, please contact:

Data Protection Officer
Cavenzi Design Sdn Bhd
25, Jalan Kasturi 3, Plaza Kasturi
Off Jalan Balakong
43200 Cheras, Selangor
Malaysia

Email: privacy@cavenzi.com
Telephone / WhatsApp: 013-3238 987