Privacy & Personal Data Protection

1. Who Controls Your Personal Data

MYSENDEX INTERNATIONAL LOGISTIC SDN. BHD. generally acts as the Data Controller for personal data collected and controlled through www.mysendex.com, MYSENDEX Customer accounts and the principal customer relationship provided from Malaysia.

Overseas warehouses, Actual Carriers, couriers, customs service providers, insurers, payment providers and other third parties may also process personal data independently where required by their own legal or operational responsibilities.

2. Who This Notice Applies To

This Notice may apply to registered users, Customers, senders, consignees, quotation enquiries, business contacts, claimants, website visitors and authorised representatives of business Customers.

3. Personal Data We May Collect

Depending on the Services used, we may process:

• Identity and contact data: name, company, email, telephone number, address and postcode;
• Sender and consignee data: names, delivery addresses, telephone numbers and necessary delivery information;
• Account data: customer references, identifiers, login and account-activity information;
• Shipment data: orders, tracking numbers, declarations, quantities, weights, dimensions, declared values, routes and tracking records;
• Transaction data: payment status, amounts, transaction references, refunds and accounting records;
• Customer-service data: emails, calls, messages, complaints, claims and service requests;
• Website and technical data: IP addresses, browser, device, session, Cookies, security and access records;
• Identification or customs documents: where required by carriers, customs authorities, destination countries or applicable law; and
• Other data: information voluntarily provided or reasonably required for a particular Service.

We do not ordinarily request sensitive personal data unrelated to our logistics Services. Where sensitive information is genuinely required for legal, customs, insurance or service purposes, it will be handled in accordance with applicable law.

4. Sources of Personal Data

Personal data may be provided directly by you or collected through our website, account and ordering systems, email, telephone, messaging or social-media channels.

We may also receive necessary information from senders, consignees, business Customers, authorised persons, warehouses, carriers, couriers, customs service providers, payment providers or technical records generated by our systems.

5. Purposes of Processing

We may process personal data to:

• create, administer and verify Customer accounts;
• respond to enquiries and provide quotations;
• arrange warehousing, consolidation, packing, transportation, customs-related services, delivery and tracking;
• provide necessary information to logistics service providers;
• process payments, refunds, accounting and reconciliation;
• provide customer service and handle complaints, investigations and claims;
• detect fraud, abuse, unauthorised access and security risks;
• comply with customs, tax, regulatory, court, law-enforcement and other legal requirements;
• improve our website, systems, operations and Services;
• maintain audit, risk-management, transaction and dispute records; and
• send marketing communications where the required consent has been obtained or applicable law otherwise permits.

6. Consequences of Not Providing Required Information

Certain information is necessary to perform international logistics Services. Without accurate consignee information, delivery may not be possible. Without required cargo declarations or customs documents, transportation or customs clearance may not be possible.

If required information is not provided, MYSENDEX may be unable to provide, continue or complete the relevant Service.

7. Personal Data About Other Individuals

Customers frequently provide information about consignees, senders, employees, suppliers or other individuals.

When providing another person's personal data, you should ensure that you are authorised to provide it and, where applicable law requires, that the individual has been appropriately informed or the necessary authority has been obtained.

8. Disclosure of Personal Data

Where reasonably necessary to provide Services, operate our systems or comply with legal requirements, personal data may be disclosed to:

• MYSENDEX China operations and other operational parties genuinely involved in the Service;
• warehouses in Malaysia, China and other relevant countries;
• airlines, shipping lines, road carriers, couriers, last-mile providers and other Actual Carriers;
• customs brokers, clearance agents, ports and logistics service providers;
• payment providers, banks and financial institutions;
• insurers and insurance service providers;
• hosting, cloud, IT, communications, email, cybersecurity and customer-service providers;
• accountants, auditors, lawyers and professional advisers;
• customs, tax, courts, regulators, law-enforcement and governmental authorities; and
• other parties reasonably necessary to fulfil a Service expressly requested by the Customer.

MYSENDEX does not sell Customer personal data to data brokers as part of its business model.

9. International and Cross-Border Data Transfers

Because MYSENDEX provides international logistics Services, personal data may need to be transferred from Malaysia to China or to other origin, destination, transit or service-provider locations.

Such transfers may be required for warehouse receiving, transportation, customs clearance, delivery, claims, investigations, IT, communications or other logistics-related Services.

MYSENDEX will apply safeguards required by applicable Malaysian personal-data-protection law to cross-border transfers.

Where personal data is processed within the People's Republic of China, applicable PRC personal-information-protection requirements may also apply to that processing.

10. Cookies, Analytics and Advertising Technologies

The MYSENDEX website may use Cookies and similar technologies to maintain login sessions, shopping carts and core functionality, remember preferences, support security, understand website use and improve Services.

Depending on technologies actually deployed, these may include necessary Cookies, functionality Cookies, analytics tools and advertising or marketing technologies.

You may control or delete Cookies through your browser settings. Restricting necessary Cookies may affect login, shopping-cart or other website functions.

Where consent is legally required for non-essential tracking technologies, MYSENDEX will provide appropriate notice or choice mechanisms.

11. Marketing Communications

Where appropriate consent has been obtained or applicable law permits, MYSENDEX may send service updates, route information, promotions and related marketing through email, telephone, SMS, WhatsApp or other communication channels.

You may request that direct marketing stop at any time. Opting out of marketing does not stop transactional communications reasonably required for existing orders, payments, shipment issues or other Services.

12. Automation, Artificial Intelligence and Analytics

MYSENDEX may use automated or artificial-intelligence tools to assist customer service, system security, logistics processing, information organisation, anomaly detection and business analytics.

If automated decision-making or profiling that materially affects individuals is introduced, MYSENDEX will provide appropriate information, choices or safeguards in accordance with applicable law.

13. Retention of Personal Data

Personal data is retained only for as long as reasonably necessary for the purposes for which it was collected and for legitimate operational or legal requirements.

Retention periods may take into account ongoing Services, accounting, tax, audit, claims, insurance, refunds, disputes, fraud prevention, security and statutory record-retention requirements.

When personal data is no longer reasonably required, MYSENDEX will securely delete, destroy or anonymise it in accordance with applicable policies and technical capability.

14. Security

MYSENDEX applies reasonable administrative, technical and organisational measures appropriate to the nature and risk of the personal data processed.

Measures may include access controls, account management, secure transmission, server and system protection, backups, logging and employee or vendor access restrictions.

Where third parties process personal data on behalf of MYSENDEX, reasonable security safeguards will be required where applicable.

No internet, electronic-storage or logistics information system can be guaranteed to be completely secure, and MYSENDEX does not represent that a personal-data breach can never occur.

15. Personal Data Breaches

If personal data is lost, misused, accessed without authorisation, improperly disclosed or otherwise affected by a potential personal-data breach, MYSENDEX will assess the incident and take reasonable containment, investigation and remediation measures.

Where required by applicable law, MYSENDEX will make the required notification to the Malaysian Personal Data Protection Commissioner and affected data subjects.

16. Your Personal Data Rights

Subject to applicable law and relevant limitations, you may have rights to:

• be informed whether your personal data is being processed;
• request access to your personal data;
• request correction of inaccurate or incomplete data;
• withdraw consent where applicable;
• object to or stop processing for direct marketing;
• prevent processing likely to cause damage or distress where the law provides such a right;
• make a data-portability request subject to applicable rules, technical feasibility and compatible formats; and
• request deletion where appropriate and where there is no continuing lawful or reasonable need to retain the data.

Certain records cannot necessarily be deleted immediately where they are required for an unfinished order, accounting, tax, customs, fraud investigation, insurance, claim, legal dispute or statutory record-retention requirement.

17. Making a Personal Data Request

You may contact the MYSENDEX Privacy Contact to request access, correction, withdrawal of consent, marketing opt-out, data portability or information regarding our processing of personal data.

To protect personal data, MYSENDEX may require reasonable identity verification before carrying out a request.

18. Minors

MYSENDEX's general logistics and commercial Services are not specifically directed at minors.

Where information relating to a minor is genuinely required for a lawful shipment or delivery, only information reasonably necessary for the Service will be processed and, where appropriate, supplied by a parent, guardian or authorised person.

19. Third-Party Websites, Platforms and Services

Our website or communications may link to third-party payment platforms, social-media services, mapping services, tracking providers or other external websites and systems.

Those parties may process personal data independently under their own privacy practices. MYSENDEX does not control all independent processing carried out by third parties, and users should review the relevant third-party notice.

20. Complaints

If you have concerns about the way MYSENDEX processes personal data, please contact us first so that we may investigate and respond.

Nothing in this Policy restricts any right available under applicable law to lodge a complaint with the Malaysian Personal Data Protection Commissioner.

21. Changes to This Notice

MYSENDEX may update this Notice to reflect changes in law, technology, Services, operations or personal-data-processing practices.

The current version will display its Last Updated date. Where a change materially affects how personal data is used, appropriate notice will be provided where required by law.

22. Privacy Contact

23. Effective and Revision Dates

Effective Date: 1 January 2026

Last Updated: 12 September 2026

This version consolidates and clarifies MYSENDEX's current personal-data-processing, international logistics and privacy practices.

Any newly introduced practice that materially changes the processing of personal data will be implemented from publication or appropriate notice in accordance with applicable law.