1. Who we are

This site, firestaq.bond, is operated by Northcliff Grooming Sdn. Bhd. (Company No. 202301034891 (1521776-K)), with a registered office at Unit G-08, Ground Floor, Wisma Damansara Heights, Jalan Maarof, Bangsar Baru, 59100 Kuala Lumpur, Federal Territory, Malaysia. We are the data controller for any personal information collected through this site or at our branches.

2. What we collect

We collect only the data you actively provide us, plus a minimal amount of technical information needed to keep the site running.

Enquiry form data: your name, email, optional Malaysian phone number, chosen topic and the message itself.
In-shop till data: the type of service performed, the time, and payment confirmation (we never store full card numbers — that lives only with our payment processor iPay88).
Technical logs: IP address, browser type, the page you arrived from, time of request. Retained 30 days for security.
Cookies: see the Cookie Policy for a granular breakdown.

3. Why we collect it

To answer your enquiry and follow up if needed.
To improve service quality at our 14 chairs and on this website.
To comply with PDPA 2010, Inland Revenue, and any lawful regulator request.
To protect the site and our customers against fraudulent or abusive activity.

4. How long we keep it

Enquiry messages are deleted from our inbox 12 months after the conversation closes, or sooner on request. Till records are kept for the statutory 7 years required by the Malaysian Income Tax Act 1967. Technical logs are rotated out at 30 days.

5. Who we share it with

We do not sell, rent or share your data with advertisers or data brokers. Limited disclosure happens only with: (a) our payment processor iPay88 (M) Sdn. Bhd. for transactions; (b) our email host Zoho Mail Malaysia for the enquiry inbox; (c) Malaysian regulators on lawful request. All third-party processors are bound by PDPA-compliant data-processing terms.

6. Your rights under PDPA 2010

Right to access a copy of the personal data we hold about you.
Right to correct, update or limit how it’s used.
Right to withdraw consent at any time (which may end the service you’re using).
Right to lodge a complaint with the Department of Personal Data Protection Malaysia.

To exercise any of these rights, email us at [email protected]. We respond within 14 business days.

7. Children

While we offer Junior cuts for under-12s, the website itself is intended for parents and guardians. We do not knowingly collect personal information from children under 13 online.

8. Security

This site runs over HTTPS with HSTS. Enquiry data is transmitted encrypted in transit, and our internal database access is restricted to authorised staff who sign annual confidentiality undertakings.

9. Cross-border transfers

Our infrastructure providers (web host, email, payments) operate primary servers within Malaysia or ASEAN. Should disaster recovery require a fail-over outside Malaysia, equivalent PDPA-grade protection is contractually mandated.

10. Updates to this policy

We review this policy annually. Material changes are notified by a banner on the site for at least 30 days. The current revision date sits at the top of this page.

11. Contact

For privacy questions or to exercise a right, write to our Data Protection Officer at [email protected] or by post to the address at the top of this page.

Privacy Policy