1. Who is responsible for your data?
Data controller: RYU AQUATIC CENTRE (SSM registration 202203226648 (PG0532015-H)), operating Japan Koi Malaysia.
Address: 566, Lorong Berlian 8/1, Taman Bukit Kaya, 70200 Seremban, Negeri Sembilan, Malaysia.
Privacy contact: Jonathan, Info@ryuaquaticcentre.com, 012-685 5565.
2. Personal data we may collect
- Identity and contact details, such as your name, telephone number, email address, Telegram or WhatsApp profile name and username.
- Enquiry and preference information, including koi interests, pond information, messages, photographs or videos you choose to send and appointment requests.
- Transaction and customer records, including koi selected, auction or reservation details, payment status or reference, proof of transfer, invoices, receipts and communication history.
- Collection and delivery information, including recipient name, delivery address, telephone number, preferred delivery method and delivery status.
- Technical data that may be recorded by our hosting or service providers, such as IP address, browser and device type, requested pages, date and time, referring page and basic security logs.
We do not need your password, PIN, one-time password, full payment-card details or online-banking login. Please redact unrelated financial information from payment proof. We do not intentionally request sensitive personal data unless it is genuinely necessary and permitted by law.
3. Where the data comes from
We normally receive personal data directly from you when you contact us, join or interact with our auction channel, arrange a viewing, reserve or purchase a koi, request delivery or communicate after a sale. We may also receive relevant delivery status from a courier, bus operator, air-cargo operator, Lalamove or Grab Express; payment confirmation from a payment provider or bank record; and technical data from our website and service providers.
If you give us another person’s information—for example, a delivery recipient—you must have authority to do so and should show that person this notice.
4. Why we process personal data
- To answer enquiries and provide information about koi, auctions, viewing, collection and delivery.
- To manage auction participation, reservations, sales, payments, invoices, customer service and delivery.
- To maintain accurate customer, transaction, accounting and tax records.
- To verify transactions, prevent fraud, secure our accounts and investigate misuse or incidents.
- To improve our website, content, services and customer experience using aggregated or limited technical information.
- To send auction alerts, new-arrival information or other direct marketing only where you have chosen to receive it or where otherwise permitted by law.
- To comply with legal duties, resolve disputes and establish, exercise or defend legal rights.
We process personal data with consent where consent is required and otherwise only as permitted under applicable Malaysian law. We do not currently use solely automated decisions or customer profiling.
5. Website, WhatsApp, Telegram and analytics
Website and analytics
With your permission, we use Google Analytics 4 to measure page visits, browser/device information and clicks to Telegram or WhatsApp. Google receives technical information, including your IP address when its services are contacted, and processes analytics data under its own privacy practices, potentially outside Malaysia. We do not intentionally send enquiry messages, telephone numbers, email addresses or customer records to Analytics. Advertising consent is denied and Google signals and ad personalisation are disabled in our tag configuration. Before consent, no Google Analytics tag or analytics request is loaded. You may decline without losing website functionality. Analytics preferences in the footer lets you withdraw; this stops future collection and clears accessible first-party Analytics cookies, but does not erase data already received by Google. Your choice is stored on this browser for 180 days. Analytics cookies are configured for up to 180 days; browser settings may shorten this. Google property retention is controlled separately by the business. Hosting access/security logs remain separate. Fonts are self-hosted. See Google’s privacy policy.
When you open a WhatsApp enquiry, your use of WhatsApp is also governed by Meta/WhatsApp’s own terms and privacy practices. We may receive your telephone number, profile name and everything you choose to include in the conversation, then use that information to respond and maintain relevant enquiry or transaction records.
Telegram
When you join or interact with our Telegram auction channel, Telegram processes information under its own privacy practices. Depending on your Telegram settings and activity, we may see your username, profile information and channel or message interactions. Leaving or muting the channel controls future channel notifications but does not automatically delete a transaction or enquiry record already held by us.
If you prefer not to use WhatsApp or Telegram, contact us by telephone or email.
6. Who we may disclose data to
We disclose only what is reasonably necessary to:
- our authorised personnel who handle enquiries, auctions, customer records and deliveries;
- website, hosting, cloud, content-management and communications providers, including providers used to deliver fonts, code and public website content;
- WhatsApp/Meta and Telegram when you choose those platforms;
- courier, bus, air-cargo, Lalamove, Grab Express or other delivery providers selected for your order;
- banks, payment providers, accountants, auditors, insurers, legal advisers and other professional advisers where relevant;
- regulators, courts, law-enforcement or other authorities where required or permitted by law; and
- a genuine successor or purchaser in a business reorganisation, subject to appropriate confidentiality and legal requirements.
We do not sell or rent personal data.
7. Processing outside Malaysia
Some technology and communications providers—including WhatsApp/Meta, Telegram and the website hosting provider—may process or store technical or communication data outside Malaysia. Where we arrange a cross-border transfer, we will take reasonable precautions and rely on a condition permitted by the Malaysian Personal Data Protection Act 2010, such as adequate protection, substantially similar law, contractual necessity or consent where required.
8. What is required and what is optional?
You may browse without sending us an enquiry, although standard technical logs may be generated automatically. Providing enquiry information is voluntary, but we may be unable to reply without a contact method. For a reservation, sale, collection or delivery, the relevant identity, contact, payment and fulfilment details are necessary; without them we may be unable to complete the transaction. Direct marketing is optional and is not a condition of receiving customer service.
9. How long we keep data
- Enquiries that do not become transactions: normally up to 24 months after the last meaningful contact.
- Customer, transaction, invoice, payment, accounting and tax records: normally at least seven years from the end of the relevant year, or longer where law, an audit, a dispute or enforcement requires it.
- Marketing preferences: until you withdraw, unsubscribe or the channel is no longer used, with a minimal suppression record retained where necessary to respect your choice.
- Technical and security logs: for the period configured by the relevant hosting or service provider and only as long as reasonably needed for security and operations.
We securely delete, anonymise or separate data from active use when it is no longer required.
10. How we protect data
We use reasonable organisational, technical and physical safeguards appropriate to the nature of the data, including access controls, account protection, limited disclosure, secure service providers and deletion or anonymisation procedures. No internet or messaging service can be guaranteed completely secure. If a personal data breach occurs, we will assess it and notify the Personal Data Protection Commissioner and affected individuals where required by law.
11. Your choices and rights
Subject to the PDPA and applicable exceptions, you may ask to access or correct your personal data, withdraw consent, limit certain processing, stop direct marketing, request deletion where the data is no longer required, or request data portability where that right applies. Withdrawal does not affect processing already carried out lawfully and may prevent us from completing a requested service.
Send a request to Info@ryuaquaticcentre.com with the subject “PDPA request”, or contact Jonathan at 012-685 5565. We may verify your identity and may charge a legally permitted fee for an access request. To stop WhatsApp marketing, reply “STOP”; for Telegram, leave or mute the channel.
You may also contact or lodge a complaint with the Personal Data Protection Commissioner of Malaysia.
12. Children
Our services are intended for adults. A person under 18 should ask a parent or legal guardian to contact us and supervise any enquiry or transaction. If we learn that a child’s data was provided without appropriate authority, we will take reasonable steps to remove it.
13. Changes to this notice
We may update this notice when our services, providers or legal obligations change. The current version and effective date will remain available on this page. Material changes will be highlighted through an appropriate channel where reasonably practicable.