Legal
Privacy policy
Last updated 16 September 2026
This policy explains what personal data KLEK collects, why we collect it, how long we keep it and what you can ask us to do with it. It is written to meet our obligations under Malaysia's Personal Data Protection Act 2010 (PDPA).
It covers the KLEK mobile app, this website, and the admin portal our campaign partners use.
1. Who we are
Operator details are not configured. Set COMPANY_LEGAL_NAME,
COMPANY_REGISTRATION_NO and COMPANY_ADDRESS —
a privacy notice must identify the data user.
For anything in this policy, contact us at hello@klek.co.
2. What we collect
Account details
Your name, email address and password (stored only as a cryptographic hash, never in readable form). Optionally a profile photo, if you upload one.
Your collection and activity
The campaigns you join, the stickers you collect and their serial numbers, points earned and spent, rewards redeemed, and event check-ins.
Device and session information
The devices signed in to your account, so you can see and revoke active sessions. If you enable the biometric lock, your fingerprint or face data is checked by your device and never leaves it — we neither receive nor store it.
Delivery details
A shipping address, only when you redeem a reward that has to be physically posted to you.
Payment details
When you pay, your card number and your online banking credentials go directly to our payment processor. They never pass through our systems and we never store them. We keep only what we need to recognise the payment: the amount, the date, the method, and a reference from the processor.
We do not currently take payment on this website. We will name our processor here before online payment goes live.
We are required to keep transaction records for seven years.
Messages you send us
Anything you submit through the contact, partner enquiry or launch notification forms on this website.
3. Why we use it
- To create and secure your account, and to verify your email address.
- To record which stickers you own and keep serial numbers unique and traceable.
- To award and redeem points, and to deliver rewards you claim.
- To send you campaign updates, reward alerts and reminders you have opted into.
- To detect fraud and counterfeit serials.
- To keep the transaction records the law requires.
- To reply to you when you contact us.
4. Who we share it with
We do not sell your personal data. We share it only in these situations:
- Campaign partners see that a participant claimed a serial from their campaign, and aggregate figures about their own campaign's performance. They do not get your full account record.
- Our payment processor which receives what it needs to take your payment and to investigate a dispute or chargeback. It may in turn pass that to your bank, your card issuer or the e-wallet you used.
- Other service providers who host our infrastructure and deliver our email, acting on our instructions.
- Authorities, where we are legally required to disclose.
5. What is public
The serial verification lookup on this site is deliberately public, so that anyone holding a sticker can check it. For a claimed serial it shows the campaign, the partner and the display name of the collector who claimed it. It never shows an email address, a phone number, an address or any payment detail.
If you would rather your display name did not appear there, contact us and we will anonymise it.
6. How long we keep it
We keep your account data for as long as your account is open. If you close it, we delete or anonymise your personal data, except records we are required to retain — principally transaction records kept for statutory financial and tax purposes, and the ownership history of a serial number, which stays on record so verification continues to work.
7. Your rights under the PDPA
You may ask us to:
- give you a copy of the personal data we hold about you;
- correct anything inaccurate or out of date;
- stop using your data for direct marketing, at any time;
- limit how we process your data, or delete it where we are not required to keep it.
Email hello@klek.co and we will respond within the period the PDPA allows. We may ask you to confirm your identity first.
8. Security
Passwords are hashed, traffic is encrypted in transit, access to the admin portal is restricted by role, and sensitive actions — purchases and reward redemptions — require a verified email address. You can review and revoke your signed-in devices at any time from your profile.
9. Children
KLEK is not intended for children under 13. If you believe a child has given us personal data, contact us and we will remove it.
10. Changes
If we change this policy we will update the date at the top of this page, and tell you in the app when the change is significant.