Catzonia Policy

Privacy Policy

Version privacy-2026-07-v2 Last updated 19 July 2026

In short. We collect only what we need — to run your bookings and spa visits, keep your cat’s care record, and, if you apply for a role with us, to consider your application (see Job applicants). We never sell your data. You can ask for your data, correct it, or delete it at any time by writing to [email protected].

1. Who we are

Catzonia (“we”, “us”, “our”) is operated by Catzonia Sdn. Bhd., a Malaysian-incorporated company. We are the data controller for personal data collected through catzonia.com and the CatzoApp ecosystem. Our registered office is in Selangor, Malaysia.

2. What we collect

  • Identity & contact: your name, mobile number (E.164), email (optional), and date of birth (used as our IC-substitute for the digital waiver).
  • Cat profile: cat name, skin condition, fur condition, your spa-picker selections, and any notes you add.
  • Booking & payment: outlet, date/time, service, deposit transactions (handled by Billplz — we receive only the transaction reference and status).
  • Device & usage: IP address, browser type, referrer URL, UTM parameters, and pages viewed. We use Cloudflare for delivery and security.
  • Analytics: PostHog (product analytics) and Google Tag Manager. Meta, TikTok and Google pixels fire only with your consent.

3. Why we collect it

  • To complete and remember your bookings — this is contract necessity.
  • To verify identity at the outlet without asking for IC numbers (date of birth + booking record).
  • To send transactional WhatsApp or email confirmations — only those tied to your booking.
  • To improve the website — aggregate analytics only.
  • To send marketing — only when you have ticked the marketing-consent box.

4. How we share data

  • CatzoApp / outlet POS: your booking flows to the outlet that will serve your cat. This is the same Catzonia organisation.
  • Billplz: our payment processor for deposits. They are a Malaysia-licensed payment service provider.
  • Supabase: our database provider. Data is stored in their EU/Singapore region with row-level security.
  • WhatsApp via Murpati: only the bare-minimum content (name, booking reference, outlet) for transactional messages.
  • We do not sell your data, rent it, or share it with advertisers in identifiable form.

5. Retention

Booking records: 7 years (Malaysian tax requirement). Cat care notes: 3 years after your last visit. Marketing consent: until you withdraw. Server logs: 90 days. After retention, records are anonymised or deleted.

6. Your rights (PDPA Malaysia 2010 + GDPR-equivalent)

  • Access: ask for a copy of the data we hold about you.
  • Correction: ask us to fix anything wrong.
  • Withdrawal of consent: stop marketing or analytics tracking at any time.
  • Erasure: ask us to delete — we’ll honour it for everything outside the 7-year tax retention requirement.
  • Portability: we’ll send your data as JSON if you ask.
  • Complain: to us, then to Malaysia’s Personal Data Protection Commissioner if unresolved.

7. Cookies

See our Cookie Policy for the cookie list, purposes, and how to refuse non-essential cookies.

8. Children

Catzonia bookings are for owners aged 18 and over. We do not knowingly collect data from anyone under 18. If you are a parent or guardian and believe a minor has supplied us with data, write to us and we will delete it.

9. Changes

We update this policy when our practices change. The version code at the top changes; we keep an archive of older versions on request. Material changes are announced via in-product banner.

10. Job applicants

When you apply for a role at Catzonia through catzonia.com/careers, we process your application data solely to consider you for employment — not for bookings or marketing. This section explains how.

  • What we collect from you: your name, WhatsApp number, email (if given), and the answers you choose to share in the application — your outlet preferences, availability, talents, and short responses. We do not ask for your IC number, date of birth, or full home address; a town or area and state is all we request.
  • Resume & Mini Profile: if you upload a resume we store and read it to understand your background. If you prefer not to, the Mini Profile collects the same essentials through simple questions instead.
  • Video & audio: any optional pitch, grooming, or voice recordings you submit are processed only to evaluate your application. They are stored privately and served through short-lived, signed links — never a public URL.
  • AI assistance: AI-assisted transcription and summarisation of applications is planned but not yet active. If and when we enable it, it will only ever support a human reviewer — it will not decide the outcome on its own — and we will update this policy first.
  • Who can see it: our HR team reviews applications. A hiring supervisor may be granted restricted, read-only access to a single candidate through a private link and PIN; that access is time-limited, logged, and never exposes your contact details or other candidates.
  • How long we keep it: we keep applicant data for up to 24 months after the hiring decision, then delete or anonymise it. If you do not consent to being kept for future roles, we delete or anonymise it sooner — once the role you applied for is filled. If you are hired, the records we need are transferred to our authorised HR employee system and the rest is cleared. Applicant videos are not retained indefinitely. We apply the shortest period that is practical.
  • Future opportunities: keeping your application for future roles is optional and only happens if you tick that box. You can change your mind at any time.
  • Withdraw & your rights: you can withdraw your application, or ask us to access, correct, or delete your applicant data, at any time by writing to [email protected]. Unsuccessful applications are not kept beyond the retention periods above.

11. Contact

Privacy queries: [email protected]
Postal: Catzonia Sdn. Bhd., Data Protection Officer, Selangor, Malaysia.