01 Data Controller & Owner

The data controller responsible for your personal data is:

Milkyway Beauty Sdn Bhd
Kajang, Selangor, Malaysia
Website: candylens.com
Email: admin@candylens.com

02 Data We Collect

Data you provide directly

• Account & order data: First name, last name, email address, phone number, shipping address (street, city, state/province, postcode, country)
• Prescription data: Sphere (power), base curve, diameter, and left/right eye designation — provided when ordering powered lenses
• Payment data: Processed directly and securely by Stripe. We do not store full card numbers on our servers
• Communications: Messages sent to us via contact forms or email
• Reviews: Any product review content submitted via Judge.me

Data collected automatically

• Usage data: Pages visited, time on site, referral source, browser type, device type
• IP address and approximate location
• Cookies and tracking data — see Section 5 for details

03 How We Use Your Data

We will never use your data for purposes incompatible with those listed above without first seeking your consent.

04 Third-Party Services

We use the following trusted third-party services to operate our store. Each acts as a data processor on our behalf and is contractually bound to protect your data.

We do not transfer your personal data to countries without appropriate safeguards in place.

05 Cookies

Cookies are small text files stored on your device when you visit our website. We use the following types:

Essential cookies

Required for the website to function — shopping cart session, login state, and checkout process. You cannot opt out of these without breaking core site functionality.

Analytics cookies (Google Analytics)

Help us understand how visitors use the site. Data is aggregated and anonymised where possible.

Marketing & preference cookies

Used to remember your preferences and, if you have consented, to personalise content and offers.

06 Data Retention

We retain your personal data only for as long as necessary for the purposes set out in this policy, or as required by law.

• Order & transaction records: 7 years (Malaysian tax and accounting law requirements)
• Customer account data: For the life of your account, plus 2 years after last activity
• Marketing email consent: Until you unsubscribe or withdraw consent
• Analytics data: 26 months (Google Analytics default)
• Support communications: 3 years from the date of resolution

You may request deletion of your data at any time — see Section 8 for your rights.

07 Data Sharing & Selling

We share data only in the following limited circumstances:

• With service providers listed in Section 4, strictly to operate our business
• With shipping carriers, solely to deliver your order
• When required by law, court order, or government authority
• To protect the rights, property, or safety of CandyLens, our customers, or others

In the event of a business sale or merger, customer data may be transferred as part of the business assets. We will notify affected customers in advance.

08 Your Rights

Regardless of your location, you have the following rights over your personal data:

To exercise any of these rights, email us at admin@candylens.com. We will respond within 30 days.

You may unsubscribe from marketing emails at any time by clicking "Unsubscribe" in any email we send.

09 Data Deletion Requests

You may request permanent deletion of your personal data from our systems at any time, including data collected through third-party sign-in methods (such as Google or Facebook Login).

How to request deletion

Email admin@candylens.com with the subject line "Data Deletion Request", using the same email address associated with your CandyLens account. We will verify your identity before processing the request.

What happens next

• We will delete your personal account data (name, email, address, order history, prescription data, and any social sign-in profile data) within 30 days of a verified request
• Order and transaction records may be retained beyond deletion where required by Malaysian tax and accounting law (see Section 6, Data Retention), but will no longer be linked to an active account
• If you signed in using Google or Facebook Login, disconnecting or deleting your account will also remove the associated authentication data we hold; you may separately manage what CandyLens can access via your Google or Facebook account settings

10 EU Customers — GDPR

If you are located in the European Union, GDPR applies to our processing of your personal data. In addition to the rights in Section 8, you have the right to:

• Withdraw consent at any time where processing is based on consent, without affecting the lawfulness of prior processing
• Lodge a complaint with your local Data Protection Authority if you believe we have mishandled your data

11 Security

We take reasonable technical and organisational measures to protect your data, including:

• SSL/TLS encryption on all pages (HTTPS)
• Payment processing via PCI-DSS compliant Stripe — we never store raw card data
• Cloudflare WAF for traffic filtering and DDoS protection
• Access controls limiting who within our team can access customer data

No method of internet transmission is 100% secure. In the event of a data breach affecting your rights, we will notify you and relevant authorities as required by law.

12 Children's Privacy

Our website is not directed at children under the age of 13. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with data without parental consent, please contact admin@candylens.com and we will delete it promptly.

13 Changes to This Policy

We may update this Privacy Policy from time to time. The "Last Updated" date at the top will reflect any changes. For significant changes, we will notify customers by email where reasonably practicable. Your continued use of the website after changes constitutes acceptance of the updated policy.

14 Contact Us

For any privacy-related questions, requests, or concerns:

Milkyway Beauty Sdn Bhd
Kajang, Selangor, Malaysia
Email: admin@candylens.com

We aim to respond to all privacy requests within 30 days.