Template notice: This document is placeholder template content. It MUST be reviewed and approved by a qualified legal or compliance professional, in every market you sell into, before launch.

Privacy Policy

DC Laboratory ("DC LABX", "we", "us") is the data controller for personal data collected through dc-labx.com. This policy explains what we collect, why, how long we keep it and what rights you have. We handle personal data in line with the Personal Data Protection Act 2010 (Malaysia) and, where it applies to you, comparable law in your own country.

1. What we collect

You give us:

• name, email address, telephone number, delivery and billing address;
• account credentials (we store a one-way hash of your password, never the password itself);
• order contents and any delivery notes;
• payment receipts you upload for manual bank transfer, including any bank reference you enter;
• messages you send us through the contact or enquiry forms;
• your consent records at checkout, including age and lawful-use confirmations.

We collect automatically:

• IP address, browser user agent and timestamps, for security, fraud prevention, rate limiting and audit logging;
• essential cookies needed to keep you signed in and to hold your cart.

We do not ask for, and you should not send us, health or medical information. We do not collect special category data.

2. Why we use it, and on what basis

| Purpose | Basis |
| --- | --- |
| Taking and fulfilling your order | Performance of a contract with you |
| Verifying payment against our bank account | Performance of a contract; legal obligation |
| Order, delivery and payment notifications | Performance of a contract |
| Fraud prevention, security and audit logging | Legitimate interests; legal obligation |
| Accounting and tax records | Legal obligation |
| Marketing email | Your consent, which you may withdraw at any time |
| Batch verification look-ups | Legitimate interests in product safety |

We do not sell personal data, and we do not use it for automated decision-making that produces legal effects for you.

3. Payment receipts

Receipts you upload are treated as sensitive. They are stored privately, never in a publicly accessible location, under randomised filenames that cannot be guessed. Access is limited to authorised finance and support staff, and every staff access is recorded in our audit log. Receipts are automatically deleted after the retention period configured for our store, unless we must keep them longer for an active dispute or an accounting obligation.

4. Who we share it with

• Couriers, to deliver your order (name, address, telephone).
• Payment providers and our bank, to process and verify payment.
• Our email provider, to send transactional messages.
• Hosting and infrastructure providers, who process data on our instructions.
• Authorities, where we are legally required to disclose.

Processors act on our instructions under contract. Because we ship internationally, your data may be transferred to and processed in other countries, including some without equivalent data protection law; where that happens we rely on appropriate safeguards and your consent to the transfer necessary to fulfil your order.

5. How long we keep it

• Order, invoice and payment records: for the period required by tax and accounting law.
• Payment receipts: the configured retention period, then secure deletion.
• Account data: while your account is open, and for a limited period afterwards.
• Audit and security logs: a limited period proportionate to their security purpose.
• Marketing consent records: until you withdraw consent, plus a record of the withdrawal.

6. Your rights

You may request access to your personal data, correction of inaccurate data, deletion, restriction of processing, a portable copy, or withdrawal of consent to marketing. You can start a data export or account deletion request from Account → Settings, or email us. We verify identity before acting on a request, and respond within the period required by applicable law.

Deletion is not always immediate or complete: we may need to keep certain records to meet legal, tax or dispute obligations, and we will tell you when that applies.

7. Security

We protect personal data with encryption in transit, hashed passwords, role-based access control, private storage for uploaded documents, rate limiting, audit logging and least-privilege staff accounts. No system is perfectly secure, and we cannot guarantee absolute security, but we take reasonable and appropriate measures and will notify you and the relevant authority of a qualifying personal data breach as required by law.

8. Children

The Site is not directed at children. We do not knowingly collect data from anyone under 18. If you believe a child has given us data, contact us and we will delete it.

9. Cookies

We use only cookies that are strictly necessary for the Site to work — keeping you signed in and remembering your cart. If we later add analytics, we will ask for your consent first and update our Cookie Policy.

10. Changes

We may update this policy. Material changes will be notified on the Site.

11. Contact

Data protection enquiries and rights requests: support@dc-labx.com