Privacy Policy

BEANJARS MARKETPLACE SDN. BHD., Company No. 202601040277 (1702372-V), is responsible for personal data it processes as the BeanJars marketplace operator. This notice explains the information used for accounts, listings, supported transactions and direct marketplace interactions, why it is needed, who receives it and the choices and rights available to you. It applies to the BeanJars website.

Different activities involve different information. Browsing a public listing is different from providing delivery details, completing seller verification or submitting a dispute. We do not treat every visitor as using every feature. Read the relevant sections alongside the information requested in the particular process. Where another party independently handles information, its own obligations and privacy notice may also apply.

1. Information you give us

We receive information that you submit through account forms, profile updates, listings, orders, messages, verification and support. This can include your name, username, email address, telephone number, delivery or contact address, profile photograph and other content you provide. Particular account forms may request date of birth, gender or security-question information. Required and optional information depends on the feature and its form.

Provide accurate details and update information that affects communication or a transaction. If you submit information for another person, such as a recipient, representative or business contact, have the appropriate authority and give that person relevant notice. Do not provide unnecessary sensitive information simply because a free-text box permits it. Public descriptions are not the appropriate place for identity documents, financial statements or private contact records.

2. Account access and security information

Account operation uses password records, session identifiers, verification-related information and relevant security settings. These records help authenticate a request, maintain a signed-in session and protect functions from misuse. We may also use information about failed or unusual requests to investigate suspected unauthorized activity and apply proportionate security controls.

Do not disclose your password or verification codes to another user or include them in a support request. If you believe an account is compromised, tell us which account and activity are affected without circulating the secret itself. We may request proportionate information to establish the account holder's authority before changing access or discussing private records. A security check is intended for the relevant account or transaction purpose; it is not permission to publish the supporting documents.

3. Public profiles, listings and photographs

Listing descriptions, prices, category and location information, photographs and the profile information made public are available to other people viewing the marketplace. A person may share a link or retain a screenshot, and information that is public may be accessible through ordinary internet services. Consider what is necessary to explain the offer before including personal details in a photograph or description.

Do not publish another person's image, private address, identity record or confidential information without an appropriate basis. Remove unrelated material from the background of photographs where possible. We use listing content to present the offer and support relevant marketplace, moderation and transaction functions. Removing a public listing does not necessarily remove records needed for an existing order, safety report or legal obligation, or copies independently retained by other people.

4. Orders, payments and financial records

Supported orders involve information about the buyer, seller, items, quantities, prices, delivery details and transaction references. Payment-related records can include the selected method, provider reference, amount and status, together with refund, reversal or reconciliation information. A provider may supply confirmation or other information needed to understand the payment. Creating an order does not itself prove that payment succeeded.

Payment Service Providers and financial institutions handle information through their own payment processes and may have independent legal duties. The fields requested depend on the method offered. Do not send full card credentials or security codes through marketplace messages. We use relevant payment records to operate and reconcile the transaction, respond to errors, prevent misuse and maintain necessary accounting and dispute records. We do not describe every payment-provider record as data held directly by BeanJars.

5. Deliveries, returns and recipient information

Delivery and return processes use recipient and sender details, addresses, contact information, shipment references, tracking events and relevant handover or delivery evidence. Providers may return information such as an occurrence time, delivery status, photograph, signature or location evidence where available for the shipment. Not every carrier supplies every type of evidence.

Relevant information is used to arrange or investigate the shipment and resolve the related transaction concern. A buyer or seller may receive the information needed for fulfilment or an authorized return. They must not reuse it for unrelated marketing or disclose it publicly. A private delivery arrangement outside the supported order process may involve information exchanged directly between the parties or their chosen provider; consider that provider's handling practices before supplying details.

6. Messages and direct arrangements

Messages submitted through BeanJars contain the content you send, the participants and associated records needed to provide the conversation. They may describe an item, inspection, direct meeting or transaction problem. Use messages for relevant communication and avoid including passwords, unrelated identity documents or other material that is unnecessary for the discussion.

Information can be considered when investigating a relevant report, resolving a case or meeting a lawful requirement. The other participant also receives what you send and may retain it. If you move a conversation to telephone, another messaging service or a direct meeting, that activity involves the parties and services concerned; this notice does not give BeanJars control over every copy or subsequent use outside its systems. Report misuse with the relevant context.

7. Identity and seller verification documents

Seller verification can require legal name, identity number, telephone number, tax identification number, images of identity documents and a selfie. Supporting information may be reviewed to establish identity, assess a discrepancy or determine eligibility for the relevant process. Do not upload another person's document as your own or include unrelated household members' records.

Identity images and private verification materials are distinct from public listing photographs. They should be handled through the designated private process with access limited according to the purpose. We do not describe an identity-document upload as public marketplace content or claim that every selfie undergoes an automated biometric comparison. Verification information may need to be retained for a lawful compliance, security or dispute purpose after a particular review ends; retention must still be justified.

8. Tax and invoice-related information

Where an applicable tax or invoicing process requires it, relevant identity, business, contact and tax details may be used to prepare, validate, correct or reconcile documents and meet reporting obligations. The information required depends on the person's role and the relevant transaction. A seller's tax identification information is not ordinary public profile content merely because the seller lists on BeanJars.

A receipt, supplier invoice, marketplace fee document and legally applicable self-billed e-Invoice can have different purposes. This notice does not state that every receipt has been validated through a tax-authority system. Information should be supplied through the designated process and disclosed to the authority or service provider only as necessary and lawful. Contact us about an incorrect record rather than submitting a fabricated identifier to complete a form.

9. Support, disputes and safety reports

A support request or dispute may include explanations, transaction references, photographs, videos, documents and communications from the parties. We use relevant material to understand the issue, assess evidence, communicate with those involved and record the outcome. Reports of fraud, infringement, unsafe goods or account misuse can also include information from a rights holder, representative or provider.

Submit evidence that is relevant and truthful. Explain a redaction without altering the underlying account of events, and avoid including unrelated people's private information. We may need to share the substance of an allegation or relevant evidence with the other party so it can respond, while considering privacy and safety. A request for confidentiality cannot always prevent a disclosure required for a fair process or by law; unnecessary disclosure should still be avoided.

10. Technical information and security logs

When a device requests a page or service, our systems and relevant service providers receive technical connection information. This can include IP address, browser or device request details, requested resource, request time, response information and security or error records. Such information supports delivery of the service, troubleshooting, rate limits, security investigation and reliable operation.

We do not infer from a browser request that we have unrestricted access to the contents of your device. Technical records may nonetheless relate to an identifiable account or activity and should be handled accordingly. Security logs can be retained where needed to investigate an incident or demonstrate what occurred. Do not include secrets in a public URL or unnecessary private information in an error report merely to help reproduce a problem.

11. Location, maps and external public resources

The address-location feature can request browser permission to obtain coordinates and send them to the map or geocoding service to help identify an address. The site uses OpenStreetMap-related mapping and Nominatim geocoding for this function. You can enter an address manually instead. Browser permission settings remain under your control.

Some public resources are loaded from external services, including Cloudflare's cdnjs icon resources and mapping resources. The request exposes relevant technical connection information to that provider. A map request and an address saved to an order serve different purposes. Check a suggested address for accuracy before using it. Refusing location permission does not authorize us to obtain the same precise coordinates without your permission.

12. Cookies and browser storage

BeanJars uses cookies and session identifiers to support sign-in, security and continuity between requests. Browser session storage supports interface state and payment navigation. Your browser may also retain public resources such as styles, scripts and images through ordinary caching. These mechanisms mean it would be inaccurate to say that BeanJars stores nothing on your device.

You can use browser controls to manage cookies and stored site data. Blocking or clearing them may sign you out, remove interface state or interrupt a payment navigation step. Keep the transaction reference if you need help after such an interruption. Removing site data from a device does not delete the corresponding server-side order or fulfil a request to close an account. Shared-device users should sign out and manage their own downloads and browser records.

13. Connection loss and device records

If connectivity is lost during a transaction, reconnect and check its actual status rather than assuming success or repeating payment immediately. A page remaining visible in your browser is not proof that an action completed.

Your downloads, screenshots and browser records may remain on your device. Protect these records, especially on shared devices. Removing a website shortcut does not close your BeanJars account; browser and account controls serve different purposes.

14. Purposes and information needed for a feature

We use relevant information to provide accounts, publish listings, connect buyers and sellers, operate supported orders and payments, arrange deliveries, manage verification and tax documentation, respond to support and disputes, protect the service and comply with law. The information must be appropriate to the purpose. We do not treat the ability to collect a field as a reason to use it for every possible activity.

Without information necessary for a particular feature, we may be unable to provide that feature: for example, a delivery requires usable recipient details and a verification process requires the relevant evidence. Optional information need not be supplied. Where consent or another specific legal condition is required, that requirement applies to the relevant processing. Publishing this notice alone does not justify a new incompatible use that requires additional consent or notice.

15. Where information comes from

Information comes directly from you, from technical interactions with the service, and from relevant transaction participants and providers. A seller can supply fulfilment evidence, a buyer can report a defect, a payment provider can confirm a status and a courier can supply a tracking event. Authorized representatives, rights holders or competent authorities may provide information relevant to a lawful request or investigation.

We should assess relevance and reliability rather than treat every allegation as established fact. If a record is inaccurate, explain the correction and provide proportionate supporting information. We may need to preserve the original account and the correction to understand an ongoing dispute. This notice does not mean that BeanJars purchases unrestricted personal-data lists or collects information from every external source about every user.

16. Who receives information

Relevant recipients include the buyer or seller for their transaction; Payment Service Providers and financial institutions for payment-related matters; delivery providers for shipments and returns; and providers supporting hosting, communications, security, verification and applicable tax administration. Authorized staff and professional advisers may need information for their responsibilities. Access and disclosure should be limited according to the purpose.

Some providers act on instructions, while others have their own legal duties and privacy practices. A service configuration or provider brand does not mean every user sends it every type of information. We do not promise that one payment provider will remain permanent. You may contact us about the recipient categories relevant to your information. Users receiving transaction details must not treat that access as authority for unrelated disclosure or solicitation.

17. Legal disclosures and business changes

Information may be disclosed where necessary and lawful to comply with an obligation, respond to a competent authority, protect rights or investigate relevant unlawful activity. The request, purpose and scope should be assessed; an informal demand for another user's private records is not automatically a sufficient basis. We may need to retain material connected with a legal claim even when public content is removed.

If a genuine business reorganization or transfer requires examination or transfer of personal data, the handling must have an appropriate lawful basis and safeguards, with relevant notice where required. This is not unrestricted permission to sell user information as an unrelated asset. A new operator or processing purpose must meet applicable data-protection obligations. We do not state that a particular sale or corporate transaction is occurring merely by explaining this possibility.

18. Processing outside Malaysia

Relevant service providers may process information outside Malaysia. A request for a public resource, a provider's support operation or infrastructure arrangement can involve another jurisdiction. We do not represent that every recipient stores all information exclusively in Malaysia, or that using a Malaysian marketplace removes cross-border processing considerations.

Any transfer must meet applicable Malaysian personal-data requirements, including the relevant lawful basis and appropriate protection. The nature of the information, purpose, recipient and safeguards matter. A foreign provider's availability alone is not sufficient justification for an unrestricted transfer. Contact us if you need information about the arrangements relevant to your data. We will assess the request while respecting legitimate security, confidentiality and legal limitations.

19. Retention, backups and account closure

Records are kept for purposes that continue to require them and for applicable legal obligations. These can include supplier and transaction records, tax and accounting records, unresolved disputes, fraud prevention and security incidents. Malaysian electronic-trade rules require specified supplier, transaction and advertising records to be retained for a statutory three-year period. That is not a rule to retain every piece of personal information forever or delete every record on the same date.

Account closure does not require immediate deletion of every record. An active order, legal requirement or relevant claim may justify retaining particular information. Backup copies also require controlled retention and handling; a request concerning live data does not mean every backup copy disappears instantly. Information no longer needed should be deleted or anonymized as appropriate. Ask us about the particular record and purpose rather than assuming that removing a website shortcut performs server-side deletion.

20. Access, correction and portability

You may request access to or correction of your personal data under applicable law. We may need proportionate information to verify your identity and authority and locate the relevant records. Avoid sending excessive identity material before we explain what is needed. A request can be restricted or refused only on an applicable legal basis, with an explanation where permitted.

For access or correction governed by the Malaysian Personal Data Protection Act, the usual statutory response period is 21 days from receipt, subject to the Act's conditions and exceptions. If completion is not possible in that period, the required written explanation and compliance as far as possible must occur before expiry, with the remainder completed within the further 14 days allowed by the Act. You may also request transmission to another data controller where statutory portability requirements, including technical feasibility and format compatibility, are met.

21. Consent, deletion requests and communication choices

You may contact us to withdraw consent where applicable, object to direct marketing, request account closure or ask for deletion of information that is no longer needed. The effect depends on the processing and applicable obligations. Withdrawal may prevent continued use of a feature without erasing information that must lawfully be retained. We should explain a relevant limitation rather than promise unconditional deletion.

Essential account, security and transaction communications differ from optional promotional communications. Installing BeanJars does not itself subscribe you to push messages or authorize new analytics tracking. If an additional feature requires personal data, permission or consent, the relevant notice and choices must be provided. Browser notification or location permissions can be managed through the browser, but changing them does not necessarily resolve a separate account or statutory request.

22. Security and personal-data incidents

We use access controls and other appropriate measures to protect information according to the risks. No online service can guarantee absolute security. You can help by protecting credentials, keeping devices secure and reporting suspicious activity promptly. Do not send a suspected attacker additional identity material to prove ownership of an account.

Where a personal-data breach requires notification, we will notify the relevant authority and affected people within the applicable legal timeframes and provide relevant information and protective steps. Where notification to affected people is required, it must be made without unnecessary delay and no later than 7 days after the initial notification to the Commissioner. Not every technical error is a notifiable breach; the incident, affected information and applicable requirements must be assessed.

23. Children, capacity and another person's information

The marketplace's contractual and regulated activities require the legal capacity and authority described in the Terms of Service. Access to a public page does not establish that a child can enter every transaction. Do not submit a child's identity documents, photographs or private contact information without an appropriate lawful basis and any required authority.

If you believe information concerning a child has been submitted improperly, contact us with sufficient details to identify the concern. We may need to verify the requester's authority and consider relevant protection, retention and legal duties before acting. Similarly, an employer, relative or business representative requesting another person's records must establish authority; a relationship alone does not entitle that person to unrestricted account access.

24. Privacy contact, complaints and changes

Send privacy requests and complaints to contact@beanjars.my, identifying the matter as a privacy request and explaining the relevant account, information and desired action. We may seek clarification through an appropriate private channel. Do not include passwords, verification codes or full card details. If a response does not resolve the concern, explain what remains outstanding and request further review.

You may contact Malaysia's Personal Data Protection Commissioner through the official personal-data protection website. The version and effective date of this notice appear above. We will publish changes and bring material changes to your attention through an appropriate notice. New processing requiring consent is not justified solely by editing this page. The English and Bahasa Malaysia notices describe the same substantive practices and rights.