Privacy Policy

PRIVACY POLICY

Last updated: 9 August 2026

1. Introduction

Spoora ("Spoora", "we", "us", or "our") respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how Spoora collects, uses, discloses, stores, and protects personal data when you visit or use our website, place an order, create an account, contact us, subscribe to communications, or otherwise interact with our website and services.

Spoora operates in Malaysia and processes personal data in connection with its commercial activities in accordance with applicable Malaysian personal data protection laws, including the Personal Data Protection Act 2010 (Act 709), as amended from time to time.

Our online store is operated using Shopify, which provides the e-commerce platform used to sell and manage products through our website. Spoora also uses AutoDS in connection with its dropshipping and order-management operations.

If you are located outside Malaysia, additional privacy rights or requirements may apply depending on the laws applicable to you.

2. Who We Are

The entity responsible for the processing of your personal data is:

Spoora
Country: Malaysia
Privacy contact: support@spoora.com

For questions about this Privacy Policy, your personal data, or how we handle your information, please contact us at:

support@spoora.com

If Spoora is operated by a Malaysian registered company or business entity under a legal name different from "Spoora", the registered legal entity name should be used in place of "Spoora" where legally required.

3. Personal Data We May Collect

Depending on how you interact with Spoora, we may collect the following categories of personal data.

3.1 Information You Provide to Us

This may include:

  • Full name

  • Email address

  • Telephone or mobile number

  • Billing address

  • Shipping or delivery address

  • Account information

  • Order and purchase information

  • Product information relating to your order

  • Payment-related information necessary to process your transaction

  • Information contained in customer service enquiries or messages

  • Marketing preferences

  • Reviews, feedback, or other content you voluntarily submit

  • Any other information you voluntarily provide to us

You should provide personal data that is accurate and necessary for the relevant purpose.

3.2 Information Collected Automatically

When you visit or use our website, certain technical information may be collected automatically by Spoora, Shopify, or other services used to operate our website.

This may include:

  • IP address

  • Browser type and version

  • Operating system

  • Device information

  • Date and time of access

  • Pages viewed

  • Referring website or URL

  • Website interaction and usage information

  • Approximate location information derived from technical data, where applicable

  • Information relating to website security and performance

  • Cookie and similar technology information

The specific information collected may depend on your device, browser settings, Shopify configuration, applications, cookies, and other technologies used on our website.

Where appropriate, we may use anonymisation or pseudonymisation measures to reduce the ability to identify individuals.

4. How We Collect Personal Data

We may collect personal data when you:

  • Visit or browse our website;

  • Create or use a customer account;

  • Place an order;

  • Make or attempt to make a payment;

  • Enter information during checkout;

  • Contact us by email or through our website;

  • Subscribe to marketing communications;

  • Request customer support;

  • Submit a product review or other content;

  • Participate in promotions or other activities offered through our website; or

  • Otherwise voluntarily provide information to us.

We may also receive information from service providers involved in operating our store, processing payments, fulfilling orders, providing delivery services, preventing fraud, providing analytics, or supporting our business operations.

5. Shopify

Our online store is hosted and operated using Shopify, an e-commerce platform provided by Shopify.

Shopify provides technology and infrastructure that enables us to operate our online store, including functions relating to products, checkout, customer accounts, orders, payments, security, and other e-commerce services.

When you use our Shopify-powered store, certain personal data may be processed through Shopify in connection with your interaction with our store.

Shopify may process personal data in accordance with its own privacy policies, contractual obligations, and applicable laws. Shopify may act as a service provider or processor for merchants in relation to certain services.

Spoora remains responsible for determining how customer personal data is used by Spoora for the purposes described in this Privacy Policy.

For more information, please review Shopify's Privacy Policy.

6. Purposes for Processing Personal Data

We may collect and process personal data for purposes including:

  • Operating and maintaining our website;

  • Providing products and services;

  • Processing and fulfilling orders;

  • Processing payments;

  • Arranging shipping and delivery;

  • Providing order updates and tracking information;

  • Managing customer accounts;

  • Responding to customer enquiries;

  • Providing customer support;

  • Processing returns, refunds, exchanges, or complaints;

  • Preventing fraud, abuse, and unauthorised activity;

  • Maintaining website and transaction security;

  • Improving our website, products, and services;

  • Understanding website usage and performance;

  • Managing our business operations;

  • Sending marketing communications where permitted by applicable law;

  • Maintaining business and transaction records;

  • Complying with legal and regulatory obligations;

  • Establishing, exercising, or defending legal claims; and

  • Any other purpose disclosed to you at or before the time your personal data is collected.

We will not use your personal data for unrelated purposes unless permitted by applicable law or you have provided the necessary consent where consent is required.

7. Notice, Choice and Consent

Where required by applicable Malaysian law, we will provide appropriate notice regarding the collection and use of your personal data.

Where consent is required, we will obtain the appropriate consent before processing personal data for the relevant purpose.

Where processing is permitted under another lawful basis recognised by applicable law, we may process personal data without obtaining separate consent where legally permitted.

Where processing is based on consent, you may withdraw your consent by contacting us at:

support@spoora.com

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

8. Orders, Payments and Dropshipping Fulfilment

When you place an order through Spoora, we may process personal data necessary to complete and fulfil the transaction.

This may include:

  • Your name;

  • Email address;

  • Telephone number;

  • Billing information;

  • Shipping address;

  • Order details;

  • Product information;

  • Delivery information; and

  • Payment-related transaction information.

Spoora uses AutoDS as a dropshipping and order-management service.

Where necessary to fulfil an order, relevant customer and order information may be processed through AutoDS and transmitted to the applicable supplier, manufacturer, fulfilment provider, or shipping provider.

This information may be used to:

  • Prepare and process your order;

  • Arrange fulfilment;

  • Arrange shipment;

  • Deliver products to you;

  • Provide tracking information;

  • Handle delivery problems or returns; and

  • Provide customer support relating to your order.

The specific supplier or fulfilment provider involved may depend on the product purchased and the supplier selected through our dropshipping system.

We only provide personal data that is reasonably necessary for the relevant fulfilment or business purpose.

9. Payment Processing

Payments may be processed through third-party payment service providers integrated with our Shopify store.

Depending on the payment method selected at checkout, the payment provider may collect and process payment information directly.

Spoora generally does not need to receive or store complete payment card information where payment processing is handled directly by the relevant payment provider.

Payment providers may process personal data according to their own privacy policies, terms, and applicable legal requirements.

You should review the privacy notice of the payment provider used for your transaction where appropriate.

10. Service Providers and Third Parties

We may use third-party service providers to help operate Spoora.

Depending on the services actually used by Spoora, these providers may include:

  • Shopify, which provides our e-commerce platform and related services;

  • AutoDS, which provides dropshipping, product, order-management, and fulfilment-related services;

  • Payment service providers;

  • Product suppliers and manufacturers;

  • Fulfilment providers;

  • Shipping and delivery providers;

  • Website and technology providers;

  • Email and communication providers;

  • Customer-support providers;

  • Analytics providers;

  • Advertising and marketing providers;

  • Security and fraud-prevention providers; and

  • Professional advisers.

The specific third-party providers involved may vary depending on the products, services, payment methods, suppliers, and technologies used by Spoora.

We disclose personal data to third parties only where reasonably necessary for the relevant business purpose, to provide a service you have requested, to fulfil an order, or where otherwise permitted or required by applicable law.

Where a third party processes personal data on our behalf, we will take reasonable steps to require appropriate security and data-protection measures consistent with applicable law.

11. Disclosure of Personal Data

We may disclose personal data where:

  • You have consented to the disclosure;

  • Disclosure is necessary to provide a product or service you requested;

  • Disclosure is necessary to process or fulfil an order;

  • Disclosure is necessary for payment or delivery;

  • Disclosure is necessary for customer support;

  • Disclosure is necessary to prevent fraud or protect website security;

  • Disclosure is necessary for legitimate business operations;

  • Disclosure is required or authorised by applicable law;

  • Disclosure is necessary to protect our rights, property, or safety, or those of others; or

  • Another lawful basis for disclosure applies.

Categories of recipients may include Shopify, AutoDS, payment providers, suppliers, fulfilment providers, shipping providers, technology providers, professional advisers, government authorities, regulators, and other service providers involved in operating our business.

12. Cookies and Similar Technologies

Spoora and services used on our website, including Shopify, may use cookies, pixels, tags, scripts, and similar technologies.

These technologies may be used to:

  • Operate and secure the website;

  • Remember preferences;

  • Maintain shopping carts and checkout functionality;

  • Understand website usage;

  • Measure website performance;

  • Improve our website and services;

  • Detect fraud or security threats; and

  • Where applicable, support advertising and marketing activities.

Cookies may include:

Session cookies, which are generally deleted when you close your browser; and

Persistent cookies, which remain on your device for a defined period.

Where required by applicable law, we will provide appropriate notice or obtain consent before using non-essential cookies or similar technologies.

You can control or disable cookies through your browser settings. However, disabling certain cookies may affect website functionality, including shopping cart or checkout features.

If Spoora introduces additional analytics, advertising, or third-party tracking technologies, this Privacy Policy and/or a separate cookie notice may be updated accordingly.

13. Direct Marketing

Where permitted by applicable law, Spoora may send information about products, promotions, special offers, new products, or other updates.

Where consent is required, we will obtain the appropriate consent before sending direct marketing communications.

You may unsubscribe from marketing emails by using the unsubscribe mechanism contained in the communication or by contacting:

support@spoora.com

Unsubscribing from marketing communications does not prevent us from sending essential communications relating to orders, transactions, customer accounts, security, or services you have requested.

14. Data Security

Spoora takes reasonable steps to protect personal data against loss, misuse, unauthorised access, disclosure, alteration, or destruction.

Security measures may include, depending on the circumstances:

  • Access controls;

  • Authentication measures;

  • Encryption or secure transmission technologies;

  • Restricted access to personal data;

  • Monitoring and security controls;

  • Backups;

  • Security procedures; and

  • Appropriate contractual safeguards with service providers.

Shopify and other service providers may maintain additional security measures relating to their respective platforms and services.

However, no method of electronic transmission or storage is completely secure. We therefore cannot guarantee absolute security of personal data.

15. Personal Data Breaches

If Spoora becomes aware of a personal data breach, we will assess and manage the incident in accordance with applicable Malaysian law and relevant requirements or guidance issued by the Personal Data Protection Commissioner.

Where notification to the Commissioner or affected individuals is legally required, Spoora will make the appropriate notification within the applicable timeframe and in the required manner.

We may also take reasonable steps to contain, investigate, remediate, and prevent recurrence of the incident.

16. Retention of Personal Data

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected or as required for legitimate business and legal purposes.

This may include retaining information to:

  • Fulfil orders;

  • Provide customer service;

  • Maintain transaction and accounting records;

  • Meet tax and legal requirements;

  • Resolve disputes;

  • Prevent fraud and misuse;

  • Maintain business records; and

  • Establish, exercise, or defend legal claims.

Different categories of information may be retained for different periods.

When personal data is no longer required, we will take reasonable steps to securely delete, destroy, or anonymise it, subject to applicable legal and regulatory requirements.

Third-party service providers, including Shopify, AutoDS, suppliers, payment providers, and fulfilment providers, may have their own retention periods and policies for information they process.

17. International Transfers of Personal Data

Some of the service providers, suppliers, fulfilment partners, or technology providers used by Spoora may be located outside Malaysia.

Because Spoora uses Shopify, AutoDS, and third-party suppliers and service providers to operate its dropshipping business, personal data may be transferred to, stored in, or accessed from countries outside Malaysia where necessary to provide our services and fulfil customer orders.

Such recipients may include:

  • Shopify;

  • AutoDS;

  • Product suppliers or manufacturers;

  • Fulfilment providers;

  • Payment service providers;

  • Shipping and logistics providers; and

  • Other technology or service providers necessary to operate Spoora.

Where personal data is transferred outside Malaysia, Spoora will take the measures required by applicable Malaysian law concerning cross-border transfers of personal data.

The location and identity of the relevant supplier or fulfilment provider may depend on the product purchased and the fulfilment arrangements applicable to that order.

18. Your Privacy Rights

Subject to applicable law and any relevant conditions or exceptions, you may have rights relating to your personal data, including the right to:

  • Request information about whether we process your personal data;

  • Request access to personal data held by us;

  • Request correction of inaccurate or incomplete personal data;

  • Withdraw consent where processing is based on consent;

  • Request that certain processing be stopped where applicable;

  • Object to direct marketing;

  • Request deletion or other action where applicable under law;

  • Request data portability where the relevant legal requirements apply; and

  • Exercise any other rights available under applicable Malaysian law.

The rights available to you may depend on the circumstances and applicable legal requirements.

To exercise a privacy-related right, contact:

support@spoora.com

We may need to verify your identity before processing a request to protect your personal data from unauthorised access or disclosure.

19. Data Portability

Where a right to data portability applies under applicable Malaysian law, you may request that your personal data be transmitted to another data controller in accordance with applicable legal requirements.

Any such request may be subject to requirements concerning technical feasibility, compatible formats, verification, and applicable legal exceptions.

20. Children

Our website and services are not intended to knowingly collect personal data from children in circumstances where parental or guardian involvement is required by applicable law.

If you believe that a child has provided personal data to Spoora in circumstances where the collection was not appropriate, please contact:

support@spoora.com

We will assess the situation and take appropriate action where required by applicable law.

21. Third-Party Websites and Services

Our website may contain links to third-party websites, applications, payment services, social media platforms, or other services.

Third-party websites and services operate independently from Spoora and may have their own privacy policies, terms, and data-processing practices.

Spoora is not responsible for the privacy practices, security, or content of third-party websites or services.

We recommend reviewing the privacy policy of any third-party service before providing personal data to that service.

22. Changes to This Privacy Policy

Spoora may update this Privacy Policy from time to time to reflect changes to:

  • Our business;

  • Our website;

  • Products or services;

  • Shopify, AutoDS, or other technology providers;

  • Data-processing practices;

  • Security measures; or

  • Applicable laws and regulations.

When we make changes, we will update the "Last updated" date at the beginning of this Privacy Policy.

Where required by law, we will provide additional notice or obtain consent before implementing material changes.

23. Contact Us

If you have questions about this Privacy Policy, wish to exercise a privacy-related right, want to withdraw consent, or have a concern about how Spoora handles personal data, please contact:

Spoora
Country: Malaysia
Email: support@spoora.com

We will consider and respond to privacy-related requests in accordance with applicable law.

Last updated: 9 August 2026