This policy explains what personal data the XOFI mobile app collects, why, and your choices. It applies to the XOFI app for ordering and pickup at XOFI outlets in Terengganu.
Who we are
The XOFI app is operated for XOFI GROUP SDN. BHD. (202201013378 (1459075-W)) ("XOFI", "we"). The app is built and run by Artiseni Sdn. Bhd. (201701045446), which processes data on XOFI's behalf. XOFI is the data user under the Personal Data Protection Act 2010 (PDPA).
Data we collect
| Data | Example | Why |
|---|---|---|
| Account details | Name, email, phone number | Create your account, contact you about orders |
| Sign-in data | Login from email, Google or Apple | Keep your account secure |
| Orders | Items, outlet, time, total, booking number | Prepare your order and show your history |
| Loyalty | Stamps, coupons, points, referral code | Run the rewards programme |
| Preferences | Chosen outlet, notification settings | Remember your choices |
| Device data | Push notification token, app version | Send order alerts, fix problems |
We do not collect your location, contacts or photos. Card and bank details are entered on the payment provider's page and are never stored in the app.
How we use your data
- To take, prepare and hand over your orders
- To give you stamps, coupons and other rewards
- To send order updates and, if you allow it, promotions
- To improve the app and keep it secure
- To meet legal and accounting duties
We do not sell your personal data.
Who we share it with
- Outlet staff see your name and order to prepare it.
- Cloud service providers host the app's database, logins and notifications on our behalf. Data may be stored on servers outside Malaysia, and these providers are required to keep it secure and confidential.
- Fiuu handles online payments, under its own privacy policy.
- Authorities, only when the law requires it.
How long we keep it
We keep your account while it is open. Order records are kept for 7 years for tax and accounting. When you delete your account, your profile is removed and remaining order records are kept without being used for marketing.
Your rights
Under the PDPA you can:
- Ask what personal data we hold about you
- Ask us to correct it (you can edit your name and phone in the app)
- Withdraw consent for promotions (Account → Notifications)
- Delete your account in the app (Account → Delete account)
Security
Data is sent over encrypted connections. Access is limited by login and role: customers see only their own data, and each outlet sees only its own orders.
Children
The app is not meant for children under 13.
Changes
We will post any changes on this page and update the date above. Big changes will be shown in the app.
Contact
Privacy questions or requests: hello@xofi.my
XOFI GROUP SDN. BHD., PT33845, Taman Tembesu Perdana, 21200 Kuala Terengganu, Terengganu