Privacy policy generator for restaurants and cafes in Malaysia
Every Malaysian food business that takes a phone number for an order, runs a loyalty card or sends WhatsApp promotions is processing personal data under the Personal Data Protection Act 2010 (PDPA). The 2024 amendments made the rules stricter, so a policy copied from a template written before 2024 is probably out of date.
Fill in your business details below and tick what you actually collect. The generator writes a plain-English privacy notice that covers the seven PDPA principles for the way restaurants really work: online ordering, delivery partners, table QR ordering, loyalty points, CCTV and guest WiFi.
Your privacy policy
Fill in to finish:
- Trading name
- Registered company name
- Business address
- Contact email
Privacy policy
Last updated: 27 October 2026
This policy explains how our business, trading as our business ("we", "us", "our"), collects, uses, shares and protects your personal data when you visit our outlets, order from us, use our website or join our programmes, and the choices and rights you have.
Who we are and how to contact us
- our business, trading as our business
- Address: , Malaysia
- Email:
Laws this policy follows
- Personal Data Protection Act 2010 of Malaysia, as amended by the Personal Data Protection (Amendment) Act 2024
What we collect and why
We only collect what we need. Here is what we collect in each situation, and what we use it for.
When you order from us (online, pickup, delivery or at the table)
What we collect:
- your name, phone number and email address
- your delivery address and any delivery notes
- what you ordered, when, and any special requests
Why we use it:
- to prepare, deliver or hand over your order
- to contact you about your order, for example if an item is unavailable or your rider is on the way
- to issue receipts and handle refunds or complaints
When you pay
What we collect:
- the amount, payment method and payment status
- payment details you enter are handled by our payment provider; we do not see or store your full card number
Why we use it:
- to take payment and issue refunds
- to detect and prevent fraud
- to keep the tax and accounting records the law requires
When you agree to hear from us
What we collect:
- your name, phone number (including WhatsApp) and email address
- what you buy and which messages you open or click, so our offers are relevant
Why we use it:
- to send you promotions, new menu items and event news by WhatsApp, SMS or email
When you visit our website
What we collect:
- cookies and similar technologies on your device
- pages visited, device and browser type, approximate location from your IP address, and how you arrived
Why we use it:
- to make the website work, such as keeping your basket
- with your consent where required, to measure visits and show you relevant ads on other sites (for example Google Analytics and Meta Pixel)
Allergy and dietary information
If you tell us about an allergy or dietary need, we use it only to prepare your food safely, with your consent, and we do not use it for marketing. Please also tell our staff in person: we cannot guarantee that any dish is free from allergens.
Who we share your data with
We do not sell your personal data. We share it only with:
- payment providers that process your payments
- other service providers that host our website, ordering, messaging and IT systems, under contracts that require them to protect your data and use it only for us
- professional advisers, such as accountants, auditors and lawyers
- the police, regulators, courts or other authorities, when the law requires it or to protect our rights, customers or staff
- a buyer or successor, if our business or part of it is sold or reorganised
Transfers outside your country
Some of our service providers store or process data in other countries. When we transfer your personal data abroad, we make sure it receives a comparable level of protection, for example by using providers in countries with adequate data protection laws or by contract terms that require them to protect it.
How long we keep your data
- orders, invoices and payment records: 7 years, because tax and accounting laws require it
- marketing preferences: until you unsubscribe; we keep a record of your opt-out so we do not contact you again
- anything else: only as long as needed for the purpose we collected it for, or as the law requires
How we protect your data
We use reasonable technical and organisational measures to protect your personal data against loss, misuse and unauthorised access, including encrypted connections, access limited to staff who need it, and service providers bound by confidentiality. No system is completely secure, so please keep your account login details private.
If a data breach is likely to put you at risk, we will tell you and the relevant authority as the law requires.
Marketing and how to stop it
We only send marketing messages if you agreed to them or if the law otherwise allows it. You can stop them at any time: use the unsubscribe link in an email, reply STOP to a WhatsApp or SMS message, change your account settings, or contact us. Stopping marketing does not affect messages about your orders.
Cookies
Some cookies are needed for our website to work and cannot be switched off. We only use analytics and advertising cookies with your consent where the law requires it, and you can change your choice at any time in your browser or in our cookie settings.
Your rights
You can:
- ask for access to the personal data we hold about you and a copy of it (we may charge the fee allowed by law)
- ask us to correct personal data that is inaccurate, incomplete, misleading or out of date
- withdraw your consent to our processing of your personal data
- ask us to stop processing that is causing, or is likely to cause, substantial and unwarranted damage or distress
- ask us to stop using your personal data for direct marketing
- ask us to transmit your personal data to another organisation, where technically feasible (data portability)
We will reply to an access or correction request within 21 days of receiving it.
To use any of these rights, email us at . We may need to confirm your identity before we act on your request. We will not treat you less favourably for using your rights.
Children
Our services are not aimed at children. We do not knowingly collect personal data from children without the consent of a parent or guardian. If you think a child has given us personal data, please contact us and we will delete it.
Complaints
If you are unhappy with how we handled your personal data, please contact us first at so we can try to put it right.
You can also complain to the Personal Data Protection Commissioner of Malaysia (Jabatan Perlindungan Data Peribadi).
Changes to this policy
We may update this policy from time to time. We will post the new version on this page with a new "Last updated" date, and tell you directly about important changes where the law requires it.
Before you publish
- Read the whole policy and remove anything that does not match what you really do. A policy that describes practices you do not follow is worse than none.
- Have a lawyer qualified in each country you selected review it before you rely on it. This generator is a drafting aid, not legal advice.
- Publish it where customers can find it before they give you data: your website footer, online ordering page, WiFi sign-in page and loyalty sign-up.
- Malaysia: the PDPA requires this notice in both Bahasa Malaysia and English. Have the Bahasa Malaysia version translated and checked, and publish both.
- Malaysia: check whether you must appoint a Data Protection Officer and register their details with the Commissioner under the 2024 amendments and the Commissioner's guidelines.
- Malaysia: keep a written record of the consent customers give for marketing, and a way to act on an opt-out quickly.
- Malaysia: data breaches that cause or may cause significant harm must be notified to the Commissioner, and in some cases to the people affected. Agree internally who does this.
Nothing you type here is sent to or saved by EatsVenture: the policy is put together in your browser. This tool is a drafting aid, not legal advice, and does not guarantee compliance with any law.
What Malaysia's PDPA means for your restaurant
Notice in two languages
The PDPA asks for the privacy notice in Bahasa Malaysia and English. Publish both versions side by side; the generator gives you the English text to have translated.
Data Protection Officer
The 2024 amendments introduced a duty for many data controllers to appoint a Data Protection Officer. Put their name and email in the policy so customers know who to contact.
Breach notification
Since 2025, a personal data breach that causes or may cause significant harm must be notified to the Personal Data Protection Commissioner, and in some cases to the customers affected.
Direct marketing
Customers can tell you to stop using their data for marketing at any time. Every WhatsApp, SMS or email promotion needs an easy way to opt out, and you must act on it.
Data portability
The amendments added a right for customers to ask for their data to be sent to another organisation where technically feasible.
Privacy policy generator by country
Questions restaurant owners ask
Does a small cafe or hawker stall need a privacy policy in Malaysia?
If you collect personal data in a commercial transaction, such as names and phone numbers for orders, delivery addresses, loyalty memberships or WhatsApp marketing lists, the PDPA applies regardless of size. A written privacy notice is how you meet the Notice and Choice Principle.
Does the PDPA apply to orders through GrabFood or foodpanda?
The delivery platform controls the data customers enter in its app under its own policy. Once you receive a customer name, phone number or address from the platform to fulfil the order, you are responsible for how you use and keep it.
How long should a Malaysian restaurant keep order and invoice records?
Tax law generally requires business records such as invoices to be kept for seven years, which is why the generator defaults to 7 years. Other data, such as marketing lists or CCTV footage, should be kept only as long as needed.
Is the generated policy legally binding or guaranteed compliant?
No generator can guarantee compliance. It gives you a solid, restaurant-specific draft. Have it reviewed by a Malaysian lawyer and check it matches what you actually do before publishing.
Is this privacy policy generator really free?
Yes. There is no sign-up and no watermark. Copy the text or download it as HTML, Markdown or PDF and use it on your own website.
Do you store the details I type in?
No. The policy is put together in your browser. Your business details are not sent to or saved on our servers.
Which countries does it cover?
It has specific clauses for Malaysia (PDPA), Singapore (PDPA), the European Union (GDPR) and the United Kingdom (UK GDPR). You can also select other countries, which get general clauses and a reminder to check local law.
Is the generated policy legal advice?
No. It is a restaurant-specific draft to save you time. Check that it matches what you actually do, and have it reviewed by a lawyer in each country where you operate.
Keep it up to date without thinking about it
EatsVenture runs your own online ordering, loyalty and WhatsApp marketing, with your privacy policy, terms and refund policy filled in from your business details and published on your ordering site.
Talk to us on WhatsApp