On this page
1. About this notice and how to contact us
This notice explains how information about you is handled when you use the Goldfinch Jewelry website or arrange a purchase through our customer service team. In this notice, “you” means the visitor or customer, and “we”, “us” and “our” refer to Goldfinch Jewelry Sdn Bhd (Company Registration No. 201301045454 (1075278-W)), operating under the Goldfinch Jewelry brand and responsible for the personal information described in this notice. Our Headquarter and PJ Office addresses are set out under Questions or assistance below.
For questions about your information or to make a privacy request, email info@goldfinchjewelry.com, call +60 11-5894 5358, or use our contact page. Ask for the person responsible for privacy and include enough information for us to understand your request. Do not send passwords or unnecessary identity documents.
2. Information and sources
Information may come from you, your authorised representative, your account activity, correspondence and relevant payment/delivery or verification records. Account information includes name, email, phone, date of birth for adult eligibility, protected password records, verification and sign-in records, device information and account dates. The service also stores saved addresses or identification details where provided, wishlist/cart selections, enquiries and order-related records.
Customer-service transactions may involve identity-document details, address, quotation, payment reference, receipt, delivery information, return evidence and relevant verification records. Network addresses and technical request information are used in request/security handling; hosting or service-provider logs may separately exist. Browser storage is described in the cookies and marketing notice.
Optional behavioural profiling and partner marketing sharing are not enabled. If we introduce additional optional tracking, we will explain the information collected, its purposes and your choices before use, and obtain consent where required.
For cart-based bullion enquiries, we also record the five-minute cart snapshot reference and time, the submitted item prices, the server-recorded enquiry time and the ten-minute price-hold expiry. A direct product enquiry has no cart snapshot; its submitted price and ten-minute expiry are recorded from the enquiry time. These records support customer service, quotation review and dispute handling; a WhatsApp draft does not prove a message was sent.
3. Purposes and necessary information
We use information for account access, responding to enquiries, preparing quotations, verifying and recording purchases, payment reconciliation, delivery/collection, customer support, returns, dispute handling, fraud prevention and applicable legal/tax obligations. Identity information is considered separately under the KYC and e-Invoice notice; it is not a marketing identifier.
Information genuinely needed for a requested service or legal obligation may be mandatory for that purpose. If you do not provide it, we may be unable to open your account, verify your purchase, issue the requested document or arrange delivery. We will explain the information needed and how not providing it affects your request. Optional marketing consent is separate and is not required to make a purchase.
4. Adult eligibility and optional promotions
New website accounts require a real date of birth showing age 18 or above. This supports our adult-account policy; a self-declared date is not proof of identity or a substitute for transaction-specific KYC. Birthday promotions use month/day only and require a separate optional choice and a selected promotional channel.
In your account Profile, separately choose email newsletters, WhatsApp promotions and birthday offers, or unsubscribe from all optional promotions. Choices are off by default. We record the choice, time and notice version; registration and terms acceptance do not subscribe you. Website marketing audiences exclude withdrawn choices. For help stopping promotions received outside your website account, contact us using the privacy contact details above. Optional behavioural profiling and partner marketing sharing remain disabled. Service and legally necessary messages are separate.
5. Recipients and international handling
Depending on the service, relevant recipients may include authorised staff, the identified selling entity, hosting/IT and email providers, payment institutions, approved verification providers, couriers/insurers, professional advisers and competent authorities where lawful. We limit information shared to what is needed for the relevant purpose. Your full identity document is not needed by every recipient.
Choosing WhatsApp sends the message you submit to that service and the receiving business account. Their platform terms and processing also apply. Do not send identity images or payment secrets unless a justified, approved collection method has been confirmed. Hosting, communications and other providers may process data outside Malaysia. You can contact us for information about overseas handling relevant to your data and the safeguards that apply. This notice does not give unrestricted permission to transfer your information overseas.
6. Account closure, retention and protection
To delete your website account, go to Security and select Delete account. In the confirmation window, enter your current password, read the deletion and retention notice and acknowledge it using the checkbox, request the one-time code sent to your registered email, then enter the code and confirm deletion. Cancelling the window does not delete your account. This removes your login, profile, saved addresses, wishlist and cart, signs you out on your devices and removes you from website marketing lists. Closing your account does not cancel existing purchases.
We may still need to keep records of purchases, e-Invoices, accounting, identity checks, disputes or legal obligations. These records remain accessible only for authorised business purposes. Opening a new account with the same email address will not automatically restore access to your previous purchase records.
Retention depends on the type of information, the reason it is needed, applicable recordkeeping requirements and any unresolved dispute or legal hold. Closing your account is not a reason for us to keep information indefinitely. We retain limited records of consent, withdrawal and account closure where needed to demonstrate how we handled your choices, subject to applicable retention requirements and review. Contact us to ask which records remain, why they are needed, how long they will be retained, and how deletion or anonymisation applies to records in other systems or backups. Closing your website account does not instantly erase every copy held elsewhere.
Please report suspected account misuse or unauthorised disclosure promptly. Do not send passwords or verification codes when reporting a concern. Security measures reduce risk, but no website can guarantee complete protection from every attack.
7. Your requests and complaints
Subject to applicable law and verification, you may request access, correction, withdrawal of consent, cessation of direct marketing and other applicable rights, including portability where its requirements apply. Contact us with sufficient information to locate your record and explain the request. We may need proportionate identity verification; do not send excessive identification by default. We will explain any lawful limitation, applicable fee or information needed and handle requests within applicable statutory time limits.
You may also complain to Malaysia’s Personal Data Protection Commissioner through JPDP. This does not require waiving other remedies. English and Bahasa Malaysia versions are provided. Material changes to purposes or recipients require appropriate notice and, where required, a fresh choice; this notice is not consent to unspecified future profiling.