Privacy Notice

GWS TCG (gwstcg.com) is a Malaysian online retailer of sealed Pokémon TCG products, operated by GWS TCG ENTERPRISE (SSM registration number: 202603162423 (003862471-H)). For anything in this notice, the fastest way to reach us is hello@gwstcg.com or the WhatsApp number listed on our contact page.

This notice is issued under the Personal Data Protection Act 2010 and applies to everyone who browses our store, places an order (with or without an account), or subscribes to our emails.

Selaras dengan Akta Perlindungan Data Peribadi 2010, notis ini menerangkan bagaimana GWS TCG mengumpul, menggunakan, menyimpan dan mendedahkan data peribadi anda — termasuk tujuan pemprosesan, pihak ketiga yang terlibat (seperti penyedia hos data, perkhidmatan e-mel dan kurier penghantaran), tempoh penyimpanan, serta hak anda untuk mengakses, membetulkan dan menarik balik persetujuan terhadap data peribadi anda. Sebarang pertanyaan boleh diajukan kepada hello@gwstcg.com. Sekiranya terdapat percanggahan antara versi Bahasa Inggeris dan versi Bahasa Malaysia notis ini, versi Bahasa Inggeris akan diguna pakai.

• Contact and delivery details: your name, email address, phone number and shipping address.
• Order history: what you bought, when, for how much, and the delivery and payment status of each order.
• Account credentials (optional): accounts are optional — guest checkout is always available. If you create one, your login credentials are managed by Supabase Auth; we never see or store your password in plain text.
• Payment references: payment is currently by DuitNow or bank transfer, so we hold transfer references needed to verify your payment. We never store card numbers — we do not process card payments today, and when cards arrive they will be handled by a payment provider, not stored by us.
• Email preferences: whether you have subscribed to our newsletter or restock alerts.

• To process, fulfil and deliver your orders.
• To arrange delivery through our couriers and give you tracking.
• To send transactional email — order confirmations, payment verification, shipping updates.
• To send marketing email (newsletter, restock alerts) only if you subscribed. Every marketing email contains an unsubscribe link, and unsubscribing takes effect immediately.
• To prevent fraud, bot purchasing and payment abuse.
• To meet our legal obligations, such as tax record-keeping.

We share personal data only with the service providers who make the store work, and only what each one needs:

• Supabase — hosts our database and authentication.
• Cloudflare — hosts the website and serves it through its CDN.
• Resend — delivers our transactional and marketing email.
• Delyva and the assigned courier(J&T, Pos Laju, DHL eCommerce and others) — receive your name, phone number and address to deliver your parcel.
• Banks — payment verification happens through ordinary bank transfer records.

We never sell your personal data, and we do not share it with advertisers or data brokers. Some of the providers above store data outside Malaysia; we only use providers with appropriate security practices.

We use essential cookies only: a cart token so your cart survives page loads, and a session cookie if you sign in. We currently run no advertising trackers or third-party analytics cookies. If that ever changes, this notice will be updated first.

• Order records: kept for at least 7 years, as Malaysian tax law requires business records to be retained.
• Newsletter and restock alerts: kept until you unsubscribe, after which your address is removed from the mailing list.
• Accounts: kept until you ask us to delete your account. Order records tied to past purchases are retained for the tax period above even after account deletion.

Under the PDPA you have the right to:

• Access the personal data we hold about you.
• Correct data that is inaccurate or out of date.
• Withdraw consent to processing — for example, unsubscribing from marketing at any time.
• Limit processing of your data, including for direct marketing.

To exercise any of these rights, email hello@gwstcg.com. We respond within 21 days, as the PDPA requires. We may ask you to verify your identity first — that protects your data from anyone pretending to be you.

Your data is encrypted in transit (HTTPS everywhere), access is role-based, and our back-office ERP is restricted to authorised staff only. No system is ever perfectly secure, but we deliberately keep the amount of data we hold small — the less we collect, the less there is to protect.

Our store is not directed at children under 13, and children under 13 may not create accounts. We do not knowingly collect personal data from children under 13 — if you believe a child has provided us data, contact us and we will delete it.

If you have a concern about how we handle your data, contact us first at hello@gwstcg.com — we take this seriously and will respond quickly. You also have the right to lodge a complaint with the Jabatan Perlindungan Data Peribadi (JPDP), Malaysia's Personal Data Protection Department. In the event of a data breach that puts your personal data at real risk, we will notify affected customers and the relevant authorities.

We may update this notice as the store evolves — for example when card payments launch. The effective date at the top of this page always reflects the current version, and material changes will be highlighted on the site.