CHE'SU

Legal

Privacy Policy

Last updated: 7 August 2026

This Privacy Policy explains how CHE'SU LEGACY ENTERPRISE (business registration no. 202603084921), trading as CHE'SU, collects, uses and protects your personal data when you place an order through chesulegacy.com. We handle personal data in line with Malaysia's Personal Data Protection Act 2010 (PDPA).

This policy covers this website only. The CHE'SU mobile app has a separate privacy policy, because the app collects different information (such as account registration and OTP verification) that this website does not.

1. What we collect

You do not need an account to order. We only collect what is needed to prepare and deliver your order:

  • Name — so we know whose order it is.
  • Phone number — so we can contact you about your order.
  • Delivery location — only if you choose Delivery. You place a pin on a map, and we store its coordinates. If you tap "Use My Location", your browser asks for your permission first; you can decline and place the pin manually instead.
  • Order details — the drinks you chose, your options (sweetness, ice, add-ons), any notes you add, and the total amount.

2. What we do NOT collect

  • We do not use cookies for tracking, advertising or analytics.
  • We do not run Google Analytics, Facebook Pixel, or any other tracking or profiling tool on this website.
  • We do not ask you to create an account or a password.
  • We never see or store your card or online banking details. Payments are handled entirely on ToyyibPay's own secure payment page.

3. Information stored in your own browser

To make ordering work, this website saves a small amount of information in your browser's local storage (not cookies). This stays on your device — it is not sent to us for tracking:

  • Your cart — so your drinks are still there if you close the tab and come back.
  • Your pending order details — saved just before you are sent to the payment page, so we can show your confirmation when you return. This is deleted once your confirmation is sent.

You can clear this at any time through your browser settings.

4. How we use your information

  • To prepare, package and hand over or deliver your order.
  • To calculate your delivery fee based on distance from our shop.
  • To contact you on WhatsApp or by phone about your order.
  • To keep a record of the order for accounting and dispute resolution.

We do not sell your personal data, and we do not use it for marketing without your consent.

5. Third parties we share data with

We share only what each service needs to do its job:

  • ToyyibPay — payment processing. Your name, phone number and order amount are passed to create the bill. Your card and banking credentials are entered on ToyyibPay's page and are never visible to us.
  • Render — hosting for our order system and database, where your order record is stored.
  • Netlify — hosting for this website.
  • OpenStreetMap — supplies the map images and converts your map pin into a readable address. Your browser contacts them directly when the delivery map is shown.
  • WhatsApp (Meta) — when you send us your order confirmation, that message goes through WhatsApp under their own privacy policy.

6. How long we keep it

Order records are kept for as long as needed for accounting and dispute handling. Completed orders are automatically removed from our live order dashboard 12 hours after completion. You may ask us to delete your details sooner — see section 8.

7. Security

This website is served over HTTPS, and order data is stored in a secured PostgreSQL database hosted by our provider. We take reasonable steps to protect your information from unauthorised access, alteration or disclosure. However, no method of transmission or storage over the internet is completely secure, and we cannot guarantee absolute security.

8. Your rights under the PDPA

You have the right to ask us to:

  • access the personal data we hold about you;
  • correct it if it is inaccurate or incomplete;
  • delete it, where we are not required to keep it; and
  • stop using it for a particular purpose.

To make a request, contact us using the details in section 10. We may need to verify your identity (for example, by confirming the phone number used on the order) before acting on a request.

9. Children

This website is not directed at children under 13, and we do not knowingly collect their personal data. If you believe a child has provided us with personal data, please contact us and we will remove it.

10. Contact us

CHE'SU LEGACY ENTERPRISE (202603084921)
Kampung Paya Rawa, Kampung Raja, 22200 Besut, Terengganu, Malaysia
Email: chesulegacy@gmail.com
Phone / WhatsApp: 011-6301 3008

11. Changes to this policy

We may update this policy from time to time. The "last updated" date at the top of this page shows when it was last changed. Please review it occasionally.

Back to home