Privacy Policy

1. Data Controller

The data controller responsible for your personal data is:

• Company Name: One Eighty Event Sdn Bhd
• Registration No.: 201901006113 (1315440-P)
• Platform: www.NoJoke.com.my
• Privacy Contact: privacy@nojoke.com.my

2. Personal Data We Collect

3. Purposes of Data Processing

We process your personal data for the following purposes and legal bases under the PDPA:

• Account Registration and Management — To create and manage your account (Contractual Necessity)
• Transaction Processing — To process purchases, payments, refunds, and order fulfilment (Contractual Necessity)
• Points System Administration — To track, calculate, and apply NoJoke Points (Contractual Necessity and Legitimate Interest)
• Customer Support — To respond to inquiries, resolve disputes, and provide technical assistance (Legitimate Interest)
• Platform Security — To detect, prevent, and investigate fraud, abuse, and security threats (Legitimate Interest and Legal Obligation)
• Legal Compliance — To comply with applicable laws, including tax, anti-money laundering, and regulatory requirements (Legal Obligation)
• Marketing and Promotions — To send promotional emails, event invitations, and personalised offers (Consent — you may withdraw at any time)
• Platform Improvement — To analyse usage patterns and improve Platform features and performance (Legitimate Interest)
• Offline Events — To manage event registrations, attendance, and related Points (Contractual Necessity and Consent)
• Member Recruitment — To process membership applications and maintain member records (Contractual Necessity)

4. Cookies and Tracking Technologies

We use the following types of cookies and tracking technologies on the Platform:

• Essential Cookies — Required for core Platform functionality (login sessions, shopping cart). Cannot be disabled.
• Performance Cookies — Collect anonymised analytics data to help us understand usage patterns (e.g., Google Analytics)
• Functional Cookies — Remember your preferences (language, currency, accessibility settings)
• Marketing Cookies — Track your browsing to deliver relevant advertisements across the web

You may control non-essential cookies through your browser settings or a cookie consent tool presented when you first visit the Platform. Note that disabling certain cookies may impair some Platform features.

5. Data Sharing and Disclosure

We share your personal data with third parties only as described below:

6. Cross-Border Data Transfers

Some of our third-party service providers may be located outside Malaysia. When we transfer personal data internationally, we ensure such transfers comply with the PDPA's requirements and that appropriate safeguards are in place, including contractual protections equivalent to those required under Malaysian data protection law.

7. Data Retention

We retain your personal data for as long as necessary to fulfil the purposes set out in this Policy, subject to the following principles:

• Account data is retained for the duration of your account and for up to seven (7) years after account closure for legal and compliance purposes
• Transaction and financial records are retained for a minimum of seven (7) years as required by Malaysian tax and commercial law
• Marketing data is retained until you withdraw consent or request deletion
• Event participation data is retained for five (5) years
• Technical logs may be retained for up to twelve (12) months for security purposes

After applicable retention periods, personal data is securely deleted or anonymised.

8. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, and destruction, including:

• SSL/TLS encryption for all data transmitted to and from the Platform
• Encrypted storage of sensitive personal data
• Role-based access controls limiting internal access to personal data
• Regular security assessments and vulnerability testing
• PCI-DSS compliant payment processing through licensed third-party gateways
• Staff training on data protection obligations

In the event of a personal data breach that poses a risk to data subjects, we will notify affected Users and the relevant authorities in accordance with applicable Malaysian law and best practices, and within seventy-two (72) hours of becoming aware of the breach where required.

9. Your Rights Under the PDPA

As a data subject under the Personal Data Protection Act 2010 (Malaysia), you have the following rights:

• Right of Access — You may request a copy of the personal data we hold about you
• Right of Correction — You may request correction of inaccurate or incomplete personal data
• Right to Withdraw Consent — You may withdraw consent to processing at any time (this does not affect lawfulness of prior processing)
• Right to Limit Processing — You may request that we limit processing of your data in certain circumstances
• Right to Object — You may object to processing for direct marketing purposes at any time

To exercise any of these rights, submit a written request to privacy@nojoke.com.my. We will respond within twenty-one (21) days. We may require you to verify your identity before fulfilling your request. Certain legal obligations may limit our ability to fully comply with some requests.

10. Children's Privacy

The Services are not directed at children under the age of eighteen (18). We do not knowingly collect personal data from minors. If we become aware that we have collected personal data from a person under 18 without appropriate parental consent, we will take steps to delete that data promptly. If you believe we have inadvertently collected such data, please contact us at privacy@nojoke.com.my.

11. Direct Marketing

With your consent, we may use your contact details to send you marketing communications about NoJoke products, services, events, and promotions. You may opt out of marketing communications at any time by:

• Clicking the 'Unsubscribe' link in any marketing email
• Updating your notification preferences in your account settings
• Contacting us at privacy@nojoke.com.my

Opting out of marketing communications does not affect delivery of essential transactional communications.

12. Third-Party Platforms and Social Media

Our Platform may include features that allow you to interact with social media platforms (e.g., sharing reviews, social login). When you interact with these features, the third-party platform may collect personal data about you. We encourage you to review those platforms' privacy policies. NoJoke is not responsible for the privacy practices of third-party platforms.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. We will notify registered Users of material changes via email or prominent notice on the Platform. The revised Policy takes effect from the date indicated at the top of the document. Continued use of the Services after the effective date constitutes acceptance of the updated Policy.

14. Complaints and Regulatory Authority

If you believe your personal data has been handled in breach of the PDPA, you have the right to lodge a complaint with the Department of Personal Data Protection (JPDP), Malaysia:

• Website: www.pdp.gov.my
• Email: aduan@pdp.gov.my
• Telephone: +603-8911 5150

We encourage you to contact us first at privacy@nojoke.com.my so we may attempt to resolve your concern directly before escalating to regulatory authorities.

15. Contact Our Data Protection Officer

For all personal data, privacy, and data protection matters, please contact:

• Organisation: One Eighty Event Sdn Bhd
• Registration No.: 201901006113 (1315440-P)
• Role: Data Protection Contact
• Email: privacy@nojoke.com.my
• Platform: www.NoJoke.com.my