Privacy Policy

1. Who we are

Inflo Vision (Partnership), Malaysia. Registration: 202503276795. Address: 19-2, Lorong Mayang Pasir 5, Taman Sri Tunas, 11950 Bayan Lepas, Pulau Pinang. Privacy contact: contact@bomy.my.

2. Personal data we collect

• Account: email address, name, and phone number.
• Transactional: shipping address, order history, and payment status.
• Technical: session cookies and IP address for security and session continuity.

3. Why we collect it

• Account management and authentication.
• Order fulfilment, including dispatch and post-purchase support.
• Marketing communications, only with your opt-in.
• Fraud prevention and platform integrity.
• Legal and regulatory compliance.

4. Legal basis under PDPA 2010

We rely on your consent, the performance of a contract with you (for example, processing your orders), and our legal obligations as a marketplace operator in Malaysia.

5. Disclosure and subprocessors

We share limited personal data with the following categories of subprocessors:

• Payment processing: a licensed payment service provider
• Shipping and delivery: Pos Laju
• Support tooling: email-based customer support managed by Inflo Vision
• Hosting and infrastructure: our cloud infrastructure provider

6. Cross-border transfers

Some processors are located outside Malaysia; transfers comply with PDPA 2010 cross-border requirements and with the additional safeguards introduced by the 2024 Amendment Act.

7. Retention windows

Account data is retained while the account is active and for 24 months after the last sign-in. Inactive accounts are flagged for deletion after 36 months. Order records are retained for 7 years in line with tax and accounting requirements.

8. Your rights under PDPA

• Access your personal data we hold.
• Request correction of inaccurate data.
• Withdraw consent for processing that relies on consent.
• Lodge a complaint with us or with the relevant authority.

9. Complaints and escalation

We respond to data-protection inquiries within 7 business days. You may contact us first; if your concern remains unresolved, you may contact the Personal Data Protection Commissioner.

10. Data breach process

Material breaches are reported to affected users and to the Department of Personal Data Protection in accordance with the notification requirements of the Act. Breach contact: contact@bomy.my.

11. Cookies

BOMY uses essential cookies for session management and authentication. No analytics or marketing cookies are set in the current pre-launch period. When we add analytics or marketing cookies in future, we will update this section and surface a consent control before they are deployed.

12. Changes to this policy

We may update this policy from time to time. Material changes will be highlighted on this page and, where appropriate, notified to account holders by email.

13. Contact

Questions about this policy can be sent to contact@bomy.my.