Websumo Solutions (Co. Reg. No. 201803015504) ("WhatsMenu", "we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use the WhatsMenu platform and services. Please read this policy carefully.
This policy applies to two groups of data subjects:
For merchant data, WhatsMenu acts as the data user (controller). For end-customer data entered or collected through a merchant's WhatsMenu storefront, WhatsMenu acts as a data processor on behalf of the merchant, who remains the data user.
1. INFORMATION WE COLLECT
1.1 Information Provided by Merchants
1.2 Information Collected from End-Customers (via Merchant Storefronts) When an end-customer interacts with a merchant's WhatsMenu storefront or ordering flow, we may process on the merchant's behalf:
1.3 Information Collected Automatically
1.4 Information from Third Parties
2. HOW WE USE INFORMATION
2.1 Service Provision
2.2 Business Operations
2.3 Communication
2.4 Use of End-Customer Data End-customer data processed through a merchant's storefront is used solely to provide the ordering and platform services to that merchant. We do not use end-customer data for our own marketing purposes, nor do we sell or rent it to third parties.
3. INFORMATION SHARING
3.1 With Your Consent We may share your information with third parties when you explicitly consent to such sharing.
3.2 Service Providers We work with trusted third-party service providers who assist us in:
These providers are bound by contractual obligations to handle data consistently with this policy and applicable law.
3.3 Between Merchants and End-Customers Information entered by end-customers on a merchant's storefront (e.g., name, phone, address, order details) is shared with that specific merchant for the purpose of fulfilling the order. WhatsMenu does not share this data with other merchants on the platform.
3.4 Legal Requirements We may disclose information when required by law, including:
3.5 Business Transfers In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of the transaction. We will notify affected users where required by law.
4. DATA RETENTION AND DELETION
4.1 Retention Period We retain information for as long as necessary to:
4.2 Merchant Account Deletion Upon merchant account termination, we will delete or anonymize the merchant's personal data and the end-customer data stored within that merchant's account within 90 days, except where retention is required by law (e.g., tax records) or for legitimate business purposes (e.g., fraud prevention, unresolved disputes).
4.3 End-Customer Deletion Requests End-customers who wish to have their data removed from a merchant's WhatsMenu storefront should contact the merchant directly, as the merchant is the data user. Where we receive such requests directly, we will forward them to the relevant merchant and assist where reasonably possible.
5. PDPA RIGHTS
As a Malaysian company, we comply with the Personal Data Protection Act 2010 (PDPA) and its subsequent amendments. You have the following rights:
5.1 Access and Correction
5.2 Withdrawal of Consent
5.3 Data Portability
5.4 Response Timeline We will respond to verified data subject requests within 21 days of receipt, in line with PDPA requirements. In complex cases requiring extension, we will notify you in writing.
5.5 Complaints
6. SECURITY MEASURES
6.1 Technical and Organisational Measures We implement appropriate measures to protect information:
6.2 Incident Response In the event of a data breach likely to cause significant harm:
7. INTERNATIONAL TRANSFERS
7.1 Cross-Border Transfers Your data may be processed and stored in countries outside Malaysia, including where our cloud infrastructure and service providers (e.g., Stripe, hosting providers) operate. Primary processing regions currently include Malaysia, Singapore, and the United States.
7.2 Safeguards We ensure adequate protection through:
7.3 Third-Party Services When data is processed by third-party services (e.g., Stripe, Meta, Google), those providers' privacy policies also apply. We encourage you to review them.
8. COOKIES AND TRACKING
8.1 Types of Cookies and Trackers We use:
8.2 Cookie Management You can control cookie settings through your browser preferences or through any cookie consent tool provided on our website. Disabling certain cookies may affect platform functionality. Withdrawing consent to non-essential cookies will not affect the lawfulness of processing carried out before withdrawal.
9. CHILDREN'S PRIVACY
The WhatsMenu platform is intended for business use by merchants and adult end-customers. We do not knowingly collect personal information from individuals under the age of 18 without parental or guardian consent, as required under Malaysian law. If you believe a minor's data has been collected without appropriate consent, please contact us and we will take steps to remove it.
10. POLICY CHANGES
10.1 Policy Updates We may update this Privacy Policy from time to time. We will notify you of any material changes by:
10.2 Continued Use Your continued use of our platform after policy changes constitutes acceptance of the updated policy.
11. CONTACT INFORMATION
For any questions, concerns, or requests regarding this Privacy Policy or your personal data, including PDPA access, correction, or withdrawal requests, please contact us:
Websumo Solutions (Co. Reg. No. 201803015504) G-09, Jalan Pandan Prima 1, Dataran Pandan Prima, 55100 Kuala Lumpur, Malaysia Email: support@whatsmenu.my
Last updated on: 15 March 2026