Privacy Policy

Last updated: 24 June 2026

JoAndrew (operated by J.A. COSMEHEALTH, registered in Malaysia) takes your privacy seriously. This page explains what data we collect, why, how long we keep it, and your rights under Malaysian law (PDPA 2010) and Singapore law (PDPA 2012) for SG customers.

1. What we collect

Account data: name, email, phone, billing/shipping address (when you create an account or place an order).
Order data: what you bought, when, payment method (we never see full card numbers — our payment gateway handles that).
Messages: anything you send us via email, WhatsApp, or contact forms.
Site usage: pages visited, clicks, time on page, referring URL, device/browser type, IP address. We use Google Analytics 4 for this.
Cookies: small files stored in your browser. Some are essential (cart, login), others are analytics/marketing. You can disable non-essential ones in the cookie banner.

2. Why we collect it

To process and ship your order.
To send you order updates (dispatch, delivery, returns).
To respond to your questions.
To improve the Site (which pages get used, where people leave).
To comply with tax and accounting laws (we keep invoices for 7 years).
To send marketing emails — but only if you opt in. You can unsubscribe from any marketing email in one click.

3. Who we share it with

We don’t sell your data. We share it with:

Payment gateways (Stripe, Billplz, etc.) to process your payment.
Couriers (Pos Malaysia, Ninja Van, J&T, etc.) to deliver your order — they get your name, phone, and address.
Email service (e.g. Mailgun, Klaviyo) to send you order updates and (if you opted in) marketing emails.
Analytics (Google Analytics 4) — anonymised usage data.
Hosting (Exabytes Malaysia) — the servers that run the Site.
Government — if legally required (tax audit, court order).

4. How long we keep it

Order data + invoices: 7 years (Malaysian tax law).
Account data: until you delete your account, then purged within 30 days (except order records, which stay 7 years).
Marketing list: until you unsubscribe.
Analytics: 14 months (Google’s default for GA4).

5. Your rights

Access: ask what data we have on you.
Correct: ask us to fix wrong data.
Delete: ask us to delete your account and non-required data.
Stop marketing: one click in any marketing email.
Withdraw consent: anytime, for any optional processing.
Lodge a complaint: with the Malaysian PDP Commissioner (jPDP) or Singapore’s PDPC.

To exercise any of these, email hello@joandrew.com.sg. We respond within 14 days.

6. International transfers

Some of our service providers (Stripe, Google) are based outside Malaysia. When you use the Site, your data may be transferred to and processed in the US, EU, or other countries. These providers are bound by their own privacy policies and data-handling standards.

7. Security

We use SSL encryption (HTTPS) on every page. Payment data is handled by PCI-DSS compliant gateways. Account passwords are hashed (never stored in plain text). Access to customer data is restricted to staff who need it (mostly Malk, the owner, and our part-time fulfilment helper).

8. Children’s data

The Site is for adults. We don’t knowingly collect data from anyone under 18. If you’re a parent and your child created an account, email us and we’ll delete it.

9. Changes to this policy

Material changes get a 30-day notice (email or banner). The “last updated” date at the top tells you when the most recent change was made.

10. Contact

Privacy questions: hello@joandrew.com.sg. We treat every privacy request as priority.