Tingkap Photo

Legal

Privacy Notice

Last updated: 11 September 2026

Tingkap Photo ("Tingkap Photo", "we", "us" or "our") provides Mirror Photobooth rental and related event photography services in Johor, Malaysia.

This Privacy Notice explains how we collect, use, store, disclose and protect your personal data when you visit our website, check availability, submit a booking, communicate with us, or use our services.

We handle personal data in accordance with the Personal Data Protection Act 2010 (Act 709) ("PDPA") and applicable Malaysian data protection requirements.

1. Who We Are

Tingkap Photo is responsible for the personal data collected and processed in connection with our services.

2. Personal Data We Collect

Depending on how you interact with us, we may collect the following personal data:

Information you provide to us

  • Full name
  • Phone number
  • Event date
  • Event type
  • Event venue name and address
  • Estimated number of guests
  • Additional booking notes or information you choose to provide
  • Alternate contact person's name and phone number, where provided
  • Payment receipt images or screenshots submitted as proof of payment
  • Information contained in communications between you and Tingkap Photo

Technical and website information

When you use our website, certain technical information may be processed automatically, such as information necessary to operate your booking session and maintain website functionality. We use minimal browser storage, as described further in Section 9 of this Notice.

Payment information

We do not ask you to provide or store your bank card number, banking password, online banking login credentials or full banking credentials.

Payments are made directly through your own bank using the payment method provided by Tingkap Photo. You may then provide us with a payment receipt or screenshot so that we can verify your payment. Payment receipts may contain information such as your name, transaction reference, bank name or other transaction details. Please avoid providing information that is not necessary for payment verification.

3. How We Collect Your Personal Data

We generally collect personal data directly from you when you:

  • Check event availability through our website;
  • Submit a booking request;
  • Provide information during the booking process;
  • Upload a payment receipt;
  • Contact us by phone, WhatsApp or other communication channels;
  • Provide information relating to your event or booking; or
  • Otherwise communicate with us regarding our services.

We may also receive limited information from another person who provides your details to us in connection with an event booking, such as an alternate contact or event organiser.

Where you provide another person's personal data to us, you should ensure that you are authorised to provide that information and, where appropriate, have informed that person that their information will be shared with Tingkap Photo.

4. Why We Use Your Personal Data

We use your personal data only for purposes reasonably connected with providing and managing our services, including to:

  • Check event availability;
  • Create and manage your booking;
  • Confirm your event date, venue and service requirements;
  • Calculate applicable transport or travel charges based on your event location;
  • Verify payments and confirm bookings;
  • Contact you regarding your booking or service;
  • Respond to questions, requests and customer enquiries;
  • Allow you to check your booking status using your booking reference and phone number;
  • Coordinate event arrangements and service delivery;
  • Maintain appropriate business and payment records;
  • Resolve disputes or investigate issues relating to our services;
  • Protect the security and integrity of our website and booking system; and
  • Comply with applicable legal or regulatory obligations.

We will not use your personal data for unrelated purposes unless permitted or required by applicable law, or where we have obtained the appropriate consent.

5. Booking Reference and No Customer Account

Tingkap Photo does not require you to create a password-protected customer account.

Instead, your booking may be associated with an anonymous, unique identifier generated by our booking system. This allows us to manage your booking without requiring you to create or maintain a username and password.

Where our website allows you to look up your booking, you may be asked to provide your booking reference and phone number.

Please keep your booking reference and phone number secure and do not intentionally share them with unauthorised persons.

6. Who We Share Your Personal Data With

We do not sell, rent or trade your personal data.

We may disclose or provide access to personal data where reasonably necessary for the purposes described in this Notice, including to:

Our authorised staff

Our authorised administrative staff may access personal data where necessary to process bookings, verify payments, communicate with customers and provide our services.

Technology and service providers

We use third-party technology providers to operate our website and booking system, including:

  • Supabase — database and file-storage services;
  • Vercel — website hosting and related infrastructure; and
  • Other service providers that may be necessary to operate our booking, communication or business systems.

These providers may process personal data on our behalf as necessary to provide their services to us.

WhatsApp / Meta

If you choose to communicate with Tingkap Photo through WhatsApp, information contained in those communications will be processed through WhatsApp and Meta's systems. Your use of WhatsApp is also subject to WhatsApp's and Meta's own terms and privacy practices.

Legal or regulatory requirements

We may disclose personal data where reasonably necessary to comply with applicable laws, legal proceedings, lawful requests, regulatory requirements, or to protect our rights, customers, property or safety.

7. International or Cross-Border Processing

Some of our technology and service providers may process or store personal data using infrastructure located outside Malaysia.

Where personal data is transferred outside Malaysia, we will take reasonable steps to ensure that the transfer and subsequent processing are handled in accordance with applicable Malaysian data protection requirements.

By using our website or services, you acknowledge that your personal data may be processed by our service providers in jurisdictions where their infrastructure or services operate.

8. How We Protect Your Personal Data

We take reasonable technical and organisational measures to protect your personal data against:

  • Unauthorised access;
  • Unauthorised disclosure;
  • Loss or misuse;
  • Unauthorised alteration or destruction; and
  • Other reasonably foreseeable security risks.

For example, payment receipt images are stored in a private storage area and are not intended to be publicly accessible. Access to these files is restricted to authorised administrative use and may use short-lived access links when a receipt needs to be reviewed for payment verification.

However, no method of electronic transmission, storage or processing can be guaranteed to be completely secure. While we take reasonable steps to protect your information, we cannot guarantee absolute security.

9. Cookies and Browser Storage

Our website uses minimal browser storage to support normal website and booking functionality. This may include information used to:

  • Keep your anonymous booking session active;
  • Preserve a booking draft if you accidentally refresh the page or navigate away;
  • Remember basic display or website preferences; and
  • Support the proper operation of the booking system.

We do not use third-party advertising or behavioural tracking cookies for the purposes of serving personalised advertisements.

You may manage or delete browser storage through your browser settings. However, disabling certain browser storage may affect the functionality of the booking system.

10. Data Retention

We retain personal data only for as long as reasonably necessary to fulfil the purposes for which it was collected, including:

  • Providing and managing your booking;
  • Maintaining appropriate business and payment records;
  • Handling customer enquiries;
  • Resolving disputes;
  • Protecting our legal interests; and
  • Complying with applicable legal or regulatory obligations.

When personal data is no longer required, we will take reasonable steps to delete, destroy or anonymise it, subject to applicable legal, accounting, operational or dispute-resolution requirements.

The actual retention period may vary depending on the type of information and the circumstances in which it was collected.

11. Your Rights

Subject to applicable laws and any relevant conditions or exceptions under the PDPA, you may have rights in relation to your personal data, including the right to:

  • Request access to personal data that we hold about you;
  • Request correction of inaccurate, incomplete or outdated personal data;
  • Withdraw consent where processing is based on consent;
  • Make enquiries or complaints about how your personal data is handled; and
  • Exercise other rights available to you under applicable Malaysian data protection law.

If you withdraw consent or request deletion of information that is necessary for an active booking, we may not be able to continue providing certain services or complete the booking.

To exercise your rights or make a request, please contact us using the details in Section 15.

We may need to verify your request before taking action to protect your personal data and prevent unauthorised disclosure.

12. Direct Marketing

Tingkap Photo does not sell your personal data to third parties.

If we introduce direct marketing communications in the future, we will handle such communications in accordance with applicable requirements and provide an appropriate means for you to opt out where required.

13. Children's Privacy

Our booking services are intended for adults who arrange or book events. We do not knowingly request personal data directly from children for the purpose of making a booking.

However, event-related information may incidentally include information about children attending an event. Where this occurs, we expect the person providing the information to have the appropriate authority to provide it.

14. Changes to This Privacy Notice

We may update this Privacy Notice from time to time to reflect changes to our services, technology, business practices or applicable legal requirements.

When we make changes, we will update the "Last updated" date shown at the top of this page.

We encourage you to review this Notice periodically to understand how we handle personal data.

15. Contact Us

If you have any questions about this Privacy Notice, wish to request access or correction of your personal data, wish to withdraw consent, or have a concern about how your personal data is handled, please contact us:

We will endeavour to respond to reasonable privacy-related requests within a reasonable period.

If you believe your personal data has been mishandled and you are unable to resolve the matter with us, you may also contact the Personal Data Protection Department (JPDP), Malaysia through its official channels.

16. Bahasa Malaysia Version

This Privacy Notice is intended to be made available in both English and Bahasa Malaysia.

Where there is any discrepancy between the English and Bahasa Malaysia versions, the version specified by Tingkap Photo as the governing version shall apply, subject to applicable law.