Privacy Policy

1. Who we are

Catzonia (“we”, “us”, “our”) is operated by Catzonia Hostails Sdn Bhd, a Malaysian-incorporated company. We are the data controller for personal data collected through catzonia.com and the CatzoApp ecosystem. Our registered office is in Selangor, Malaysia.

2. What we collect

• Identity & contact: your name, mobile number (E.164), email (optional), and date of birth (used as our IC-substitute for the digital waiver).
• Cat profile: cat name, skin condition, fur condition, your spa-picker selections, and any notes you add.
• Booking & payment: outlet, date/time, service, deposit transactions (handled by Billplz — we receive only the transaction reference and status).
• Device & usage: IP address, browser type, referrer URL, UTM parameters, and pages viewed. We use Cloudflare for delivery and security.
• Advertising measurement: cookies and identifiers used to measure whether our advertising leads to bookings.

3. Why we collect it

• To complete and remember your bookings — this is contract necessity.
• To verify identity at the outlet without asking for IC numbers (date of birth + booking record).
• To send transactional WhatsApp or email confirmations — only those tied to your booking.
• To improve the website — aggregate analytics only.
• To send messages about your booking, and occasional Catzonia news. Booking records your agreement to receive these; tell us and we will stop. Job applicants choose separately, using a tick box.
• To measure the effectiveness of our advertising.

4. How we share data

• CatzoApp / outlet POS: your booking flows to the outlet that will serve your cat. This is the same Catzonia organisation.
• Billplz: our payment processor for deposits. They are a Malaysia-licensed payment service provider.
• Supabase: our database provider. Data is stored in their EU/Singapore region with row-level security.
• Our WhatsApp messaging provider: the minimum content required for transactional messages (name, booking reference, outlet). Named on request.
• Advertising platforms: limited measurement data — pages viewed, device and browser information, and whether a deposit was paid. Currently Meta (Facebook and Instagram). We do not share your name, phone number, email address or payment details. Meta’s own policy: facebook.com/privacy/policy
• We do not sell your data or rent it.

5. Retention

Booking records: 7 years (Malaysian tax requirement). Cat care notes: 3 years after your last visit. Marketing consent: until you withdraw. Server logs: 90 days. After retention, records are anonymised or deleted.

6. Your rights (PDPA Malaysia 2010 + GDPR-equivalent)

• Access: ask for a copy of the data we hold about you.
• Correction: ask us to fix anything wrong.
• Withdrawal of consent: tell us to stop marketing messages at any time. To stop advertising measurement, block or clear cookies — see the Cookie Policy.
• Erasure: ask us to delete — we’ll honour it for everything outside the 7-year tax retention requirement.
• Portability: we’ll send your data as JSON if you ask.
• Complain: to us, then to Malaysia’s Personal Data Protection Commissioner if unresolved.

7. Cookies

See our Cookie Policy for the cookie list, purposes, and how to refuse non-essential cookies.

8. Children

Catzonia bookings are for owners aged 18 and over. We do not knowingly collect data from anyone under 18. If you are a parent or guardian and believe a minor has supplied us with data, write to us and we will delete it.

9. Changes

We update this policy when our practices change. The version code and date at the top change with it. Earlier versions are available on request.

10. Job applicants

When you apply for a role at Catzonia through catzonia.com/careers, we process your application data solely to consider you for employment — not for bookings or marketing. This section explains how.

• What we collect from you: your name, WhatsApp number, email (if given), and the answers you choose to share in the application — your outlet preferences, availability, talents, and short responses. We do not ask for your IC number, date of birth, or full home address; a town or area and state is all we request.
• Resume & Mini Profile: if you upload a resume we store and read it to understand your background. If you prefer not to, the Mini Profile collects the same essentials through simple questions instead.
• Video & audio: any optional pitch, grooming, or voice recordings you submit are processed only to evaluate your application. They are stored privately and served through short-lived, signed links — never a public URL.
• AI assistance: AI-assisted transcription and summarisation of applications is planned but not yet active. If and when we enable it, it will only ever support a human reviewer — it will not decide the outcome on its own — and we will update this policy first.
• Who can see it: our HR team reviews applications. A hiring supervisor may be granted restricted, read-only access to a single candidate through a private link and PIN; that access is time-limited, logged, and never exposes your contact details or other candidates.
• How long we keep it: we keep applicant data for up to 24 months after the hiring decision, then delete or anonymise it. If you do not consent to being kept for future roles, we delete or anonymise it sooner — once the role you applied for is filled. If you are hired, the records we need are transferred to our authorised HR employee system and the rest is cleared. Applicant videos are not retained indefinitely. We apply the shortest period that is practical.
• Future opportunities: keeping your application for future roles is optional and only happens if you tick that box. You can change your mind at any time.
• Withdraw & your rights: you can withdraw your application, or ask us to access, correct, or delete your applicant data, at any time by writing to [email protected]. Unsuccessful applications are not kept beyond the retention periods above.

11. Contact

Privacy queries: [email protected]
Postal: Catzonia Hostails Sdn Bhd, Data Protection Officer, Selangor, Malaysia.