Privacy Policy

Last updated: 30 September 2026

1. Who we are

This is Lathre's notice under Malaysia's Personal Data Protection Act 2010 (PDPA). It explains how Lathre ("we", "us") collects, uses and protects your personal data when you visit our website, message us, or place an order.

Questions about this policy or your data? Email lathrestudio@gmail.com.

2. What we collect

Depending on how you interact with us, we may collect:

• Contact details: your name, email address, phone number and delivery address, when you place an order or sign up for our emails.
• Order and payment information: what you bought, your order history, and the payment slip or bank transfer receipt you send us, which may show your name, bank and transaction reference. We don't collect card details.
• Messages: what you send us by email, WhatsApp or Instagram.
• Referral information: if you take part in Share the Ritual, your referral link, the coupons you earn, and which orders were placed using your link.
• Technical and usage data: such as your IP address, browser type and the pages you visit, collected automatically through the tools in Section 4.

3. How we collect it

• Directly from you, when you order, sign up, or message us.
• Automatically, through cookies and similar technologies when you browse our site.
• From the platforms we use, such as Shopify, WhatsApp and Instagram, when you interact with us there.

4. Cookies and tracking tools

Our site uses Shopify's analytics and checkout cookies, which are needed to run the store, process orders and understand site traffic. We don't currently use other analytics or advertising tools, and we don't run paid advertising. If that changes, we'll update this policy first.

You can control cookies through your browser settings and, where shown, our cookie banner. Turning off non-essential cookies won't stop you browsing or ordering.

5. Why we use your data

We use your personal data to:

• process and deliver your orders and provide customer service;
• send order confirmations and shipping updates;
• run the Share the Ritual referral programme, including applying discounts and coupons;
• send you news about Lathre by email, only if you've opted in at sign-up or checkout. You can unsubscribe at any time using the link in any email;
• improve our website and products based on how visitors use our site;
• meet legal and tax obligations, and prevent fraud.

6. Who we share it with

We don't sell your personal data. We share it only with the services that help us run Lathre:

• Shopify, our online store platform.
• WhatsApp, which we use to receive payment slips and messages.
• Courier and shipping partners, who receive your name, address, phone number and email to deliver your order.
• Smile.io, which powers our referral programme.
• Our email service provider, for order and marketing emails.
• Authorities, where the law requires it.

7. Where your data is stored

Shopify and our other providers may store or process data on servers outside Malaysia. We only use providers who protect personal data to a standard consistent with the PDPA.

8. How long we keep it

We keep order and accounting records, including payment slips, for up to seven years, in line with Malaysian tax and accounting requirements. Your email on our marketing list is kept until you unsubscribe or ask us to delete it. Messages are kept for as long as needed to deal with your query.

9. Children

Our products and website are not directed at children, and we don't knowingly collect personal data from anyone under 18. If you believe a child has given us their data, contact us and we'll delete it.

10. Your rights

Under the PDPA you can:

• ask to access the personal data we hold about you;
• ask us to correct inaccurate data;
• withdraw your consent to marketing at any time;
• ask us to limit or stop processing your data, subject to legal exceptions;
• ask for your data to be transferred to another provider, where the law allows;
• complain to the Personal Data Protection Commissioner of Malaysia if you believe your data has been mishandled.

To make a request, email lathrestudio@gmail.com. We'll respond within 21 days.

11. How we protect it

We take reasonable technical and organisational steps to protect your data, including relying on Shopify's secure checkout and limiting access to customer data to what we need to run Lathre.

12. Changes to this policy

We may update this policy from time to time. The "Last updated" date above shows when.

13. Contact

Email lathrestudio@gmail.com or message us on Instagram at @lathre.co.