This Privacy Policy is issued under the Personal Data Protection Act 2010 ("PDPA") by TERAHERTZ EXPERIENCE SPACE SDN. BHD. (Company No. 202401036617), 52A, Jalan Eco Forest 6/1C, Eco Forest Semenyih, 43500 Semenyih, Selangor ("TES", "we"), the data user of your personal data. It explains how we collect, use, disclose and protect personal data when you use our website www.tesinternational.my, the TES mobile application, our outlets and our services. The mobile application has an additional Mobile App Privacy Policy.
1. Personal data we collect
| Category | Examples |
|---|---|
| Identity and contact | Name, mobile number, email, date of birth (optional), delivery addresses. An email address is required only if you want to pay online, because the payment gateway issues its invoice to it and we send your receipt there. You can shop without one by paying at our counter |
| Account | Login credentials (hashed), membership tier, referral code and referrer, language preference, consents |
| Transactions | Orders, payments (transaction references from our payment gateway; no card numbers), TES Credit, Points and Referrer Credit records, vouchers, refunds |
| Appointments | Services booked, dates, notes you provide, and any health information you choose to disclose so we can deliver the service safely (sensitive personal data, collected only with your explicit consent) |
| Distributor programme | Signed agreement, identification documents required for approval, bank account details for settlement (held by our finance staff only) |
| Enquiries and support | Messages sent through the website form, WhatsApp, email or phone |
| Testimonials | Name, photo or video and statement, only with your written consent |
| Technical | IP address, browser or device type, app version, push notification token, pages viewed, diagnostic and crash data |
| Verification | Mobile number and the delivery status of registration passcodes sent to it over WhatsApp. If you choose to pay online we also verify your email address by sending a code to it. Passcodes and codes are stored only as a keyed hash and are deleted shortly after they expire |
We collect data directly from you, automatically when you use the website or app, and from third parties such as our payment gateway (payment status) and courier partners (delivery status).
2. Purposes
We process personal data to: register and manage your account and membership tier; process orders, payments, deliveries and refunds; manage appointments and deliver services safely; operate TES Credit, Points, vouchers and the Distributor Programme, including calculating and settling Referrer Credit; respond to enquiries and provide support; send service messages (order and appointment updates, security alerts); send marketing about our products, services and promotions where you have opted in; publish testimonials you have consented to; maintain security, prevent fraud and enforce our terms; comply with legal, tax and accounting obligations; and analyse usage to improve the website, app and services.
3. Consent and choice
By providing your personal data you consent to its processing for these purposes. Providing the data marked mandatory in our forms is necessary to deliver the services; without it we may be unable to serve you. You may withdraw consent for marketing at any time (§7) and may withdraw other consents subject to §9.
4. Disclosure
We share personal data only as needed with:
| Recipient | Purpose |
|---|---|
| Fiuu (payment gateway) | Payment processing; receives billing name, email, mobile number and order description |
| Courier and delivery partners | Delivery of products |
| Cloud hosting and infrastructure providers (Cloudflare for the website, application and content delivery; Supabase, whose servers are located in Singapore, for the database) | Hosting the website, app services and database |
| Google Firebase | Push notifications and app crash reports |
| Infobip (communications provider) | Delivering registration passcodes and service messages to your mobile number over WhatsApp |
| WhatsApp / Meta Platforms | Delivering the one-time passcode message to your WhatsApp account. Your mobile number is processed to route that message |
| Email service provider | Receipts and service or marketing email |
| Error-monitoring provider | Diagnosing faults in our servers and staff systems |
| Professional advisers, auditors, banks and insurers | Where required for our business operations |
| Regulators, law enforcement and courts | Where required by law |
We do not sell personal data. Distributors do not receive personal data of the members they refer beyond a masked name, registration date and status.
5. Transfers outside Malaysia
Our database is located in Singapore, and some service providers are located outside Malaysia, including Singapore and the United States. Our application runs on a global content delivery network, so a request may be processed at a location outside Malaysia even though your data is stored in Singapore. By using our services you consent to the transfer of your personal data to those locations. We require providers to protect personal data to standards comparable to the PDPA.
6. Cookies and analytics
The website uses strictly necessary cookies and privacy-friendly analytics that do not identify you. The app does not use advertising identifiers or tracking for advertising.
7. Marketing
We send marketing by push notification, SMS, WhatsApp or email only if you opt in. You can opt out at any time in the app settings, by following the unsubscribe instructions in a message, or by contacting us. Service messages are sent regardless of marketing preferences.
8. Retention
We keep personal data only as long as needed for the purposes above and for legal requirements. Transaction, payment, loyalty and commission records are retained for 7 years for accounting and tax purposes. Enquiry records are kept for 24 months. When you delete your account, your profile is anonymised and only the records we must keep are retained.
9. Your rights
Under the PDPA you may: request access to your personal data; request correction of inaccurate or incomplete data; withdraw consent to processing (which may prevent us from providing some services); and limit processing of your data, including for direct marketing. Send requests by WhatsApp to 012-359 2688, or in writing to the address above, with proof of identity. We respond within 21 days as required by the PDPA and may charge the fee permitted by law for access requests.
10. Security
We protect personal data with encryption in transit and at rest, access controls, staff training and audit logs. Payment card data is handled only by our payment gateway. No system is completely secure; tell us immediately if you suspect misuse of your account.
11. Minors
Our services are intended for persons aged 18 and above. We do not knowingly collect personal data from minors without parental consent.
12. Third-party links
The website may link to third-party sites (for example maps or social media). Their privacy practices are their own.
13. Changes
We may update this Policy. Changes are published on this page with a new effective date and, where material, notified in the app or by email.
14. Contact
Data protection contact: Data Protection Officer, TERAHERTZ EXPERIENCE SPACE SDN. BHD. · WhatsApp 012-359 2688 · 52A, Jalan Eco Forest 6/1C, Eco Forest Semenyih, 43500 Semenyih, Selangor