Privacy Policy – Serana Beauty

1. Who we are and what this policy covers

Serana Beauty is operated by T&Y Aura Sdn. Bhd. (Company No. 202501044339), a company incorporated in Malaysia with its registered address at B-5-8, Plaza Mont Kiara, Mont Kiara, 50480 Kuala Lumpur, Malaysia ("Serana", "we", "us" or "our"). We sell skincare and beauty products through our website at seranabeauty.com and its sub-domains, including our product seal verification page at verify.seranabeauty.com (together, the "Site").

We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains what personal data we collect when you visit the Site, create an account, place an order, verify a product seal or otherwise interact with us; why we collect it; who we share it with; how long we keep it; and the rights and choices you have.

This policy is issued under the Personal Data Protection Act 2010 of Malaysia ("Malaysian PDPA") and serves as our written notice to you under section 7 of that Act. Where you are located in Singapore, it also describes how we comply with the Personal Data Protection Act 2012 of Singapore ("Singapore PDPA"). If you are located elsewhere, we apply the same standards to your personal data unless local law requires more.

"Personal data" means any information that relates to you and from which you can be identified, directly or indirectly, such as your name, contact details, order history or device identifiers.

By using the Site, creating an account or placing an order, you acknowledge that you have read this policy. Where the law requires your consent for a particular use of your personal data (for example, marketing), we will ask for it separately.

2. The personal data we collect

We collect personal data in three ways: information you give us directly, information collected automatically when you use the Site, and information we receive from third parties.

2.1 Information you give us

When	What we collect
Creating an account	Name, e-mail address, password (stored in hashed form), phone number, date of birth (optional), delivery and billing addresses.
Placing an order (with or without an account)	Name, e-mail address, phone number, delivery and billing addresses, items purchased, order value, chosen payment method, order notes and any gift message.
Making a payment	We do not receive or store your full card number, CVV or online-banking credentials. Our payment gateway collects these directly. We receive a transaction reference, payment status, payment method type and, for cards, the last four digits and card brand.
Contacting customer care	Your name, contact details, the content of your message and any attachments or photos you send us (for example, of a product or a delivery).
Product seal verification	The authentication code you type in. If you are logged in to your Serana account when you verify (so that you can earn GLOW points), the verification is linked to your account. If you are not logged in, we do not ask for your name or contact details.
GLOW rewards programme	Your account details, points earned and redeemed, the activities that earned them (purchases, seal verification, reviews, referrals and other campaigns), and your points balance and expiry dates.
Reviews, surveys and competitions	Your name or display name, review text, star rating, photos you upload, and any survey answers.
Subscribing to marketing	E-mail address and/or mobile number, and your marketing preferences.
Skin profile or consultation tools (if offered)	Skin type, concerns and product preferences you choose to tell us. Some of this may be treated as sensitive personal data; we will only collect it with your explicit consent.

2.2 Information collected automatically

When you visit the Site, we and our service providers automatically collect certain technical information using cookies, pixels and similar technologies (see Section 7):

Device and browser information: IP address, device type, operating system, browser type and language, screen size.
Usage information: pages viewed, products viewed or added to cart, searches, links clicked, time and date of visits, referring website or advertisement, and approximate location derived from your IP address.
Identifiers set by cookies and pixels, such as a Google Analytics client ID, Meta Pixel identifier or TikTok Pixel identifier.
On the seal verification page: the code you submit, the result, the date and time, your IP address, browser details, a session identifier and, if you are logged in, your account ID. We keep this to detect abuse and counterfeit products (see Section 4).

2.3 Information from third parties

Payment gateway: confirmation of payment, fraud-screening results and chargeback information.
Courier and logistics partners: delivery status, proof of delivery and delivery issues.
Advertising and analytics platforms (Google, Meta, TikTok): aggregated campaign performance and information used to attribute a visit or purchase to an advertisement.
Social media platforms, if you interact with our official pages or use a social login feature (if offered).

2.4 Personal data of other people

If you give us personal data about someone else – for example, a recipient's name and address for a gift delivery – you confirm that you are permitted to do so and that they have been made aware of this policy.

2.5 Children

The Site is intended for adults. We do not knowingly collect personal data from anyone under 18 years of age without the consent of a parent or guardian. If you believe a child has provided us with personal data, please contact us and we will delete it.

3. How we use your personal data and why

Under the Malaysian PDPA we may only process your personal data for a lawful purpose directly related to our activities, where the processing is necessary for or directly related to that purpose, and where the data is adequate and not excessive. Under the Singapore PDPA we may only collect, use and disclose your personal data for purposes a reasonable person would consider appropriate and of which you have been notified. The purposes for which we use your personal data are set out below.

Purpose	Personal data used	Basis
To process and deliver your orders, including payment, packing, shipping, delivery updates, returns and refunds	Account, order, contact, payment and delivery data	Necessary to perform our contract with you; your consent when you place the order
To create and manage your account, and to let you view your order history and saved addresses	Account and order data	Necessary to perform our contract with you
To provide customer care and respond to your enquiries, complaints and requests	Contact data and the content of your communications	Necessary to perform our contract; our legitimate interest in serving customers
To send transactional messages, such as order confirmations, shipping notifications, password resets and important service or safety notices	Contact data	Necessary to perform our contract; legal obligations (for example, product safety)
To send marketing e-mails, SMS or messaging-app messages about our products, offers and events	Contact data, purchase history and preferences	Your consent, which you can withdraw at any time
To operate, secure and improve the Site, including fixing errors, testing features and analysing how the Site is used	Technical and usage data, analytics cookies	Our legitimate interest in running a secure and effective store
To show you relevant advertising on other platforms and measure our campaigns	Cookie and pixel identifiers, usage data, hashed e-mail address where lawful	Our legitimate interest in promoting our products; you can opt out as described in Section 7
To verify the authenticity of product seals, detect counterfeit products and prevent abuse of the verification service	Verification code, result, time, IP address, browser details, session identifier, account ID if logged in	Our legitimate interest in protecting customers and our brand; prevention of fraud
To run the GLOW rewards programme: credit points for purchases, seal verifications and other activities, manage balances and expiry, and let you redeem rewards	Account data, order history, verification claims, points ledger	Necessary to perform our contract with you (the programme terms); your consent when you join
To detect and prevent fraud, unauthorised transactions and security incidents	Order, payment, technical and usage data	Our legitimate interest; legal obligations
To comply with legal and regulatory obligations, including tax, accounting, consumer protection and product safety laws, and to respond to lawful requests from authorities	Order, payment, contact and identity data	Legal obligation
To establish, exercise or defend legal claims	Any relevant data	Our legitimate interest; legal obligation

We do not sell your personal data. We do not use your personal data to make decisions about you that are based solely on automated processing and that have legal or similarly significant effects on you. The only automated decisions we make are temporary security measures described in Section 4 (for example, pausing access to the verification service or to GLOW point claims when our systems detect suspicious activity); you can always contact customer care to have such a decision reviewed by a person.

4. Product seal verification and GLOW rewards

4.1 Verifying a seal

Each Serana product carries a tamper-evident seal with a unique authentication code and a QR code. Scanning the QR code takes you to our verification page, where you can enter the printed code to check whether it is a valid Serana code. You can verify a seal without logging in.

Every time a code is submitted we record the code entered, the result, the date and time, your IP address, your browser information and a temporary session identifier. If you are logged in to your Serana account, we also record which account made the verification. We use this data to confirm authenticity, to detect counterfeit products, to identify codes that are being verified an unusual number of times or from an unusual number of places, and to stop automated or abusive use of the service.

4.2 Earning GLOW points by verifying

If you log in to (or create) your Serana account before or after verifying a seal, you can claim GLOW points for that product. Each code can be claimed once only, by the first account to claim it. When you claim, we record the claim against your account and the code, credit the points to your GLOW balance, and keep that record so that the same code cannot be claimed again and so that we can resolve any dispute about who claimed it. If you verify a seal as a guest, we will show you the option to log in or join so that you can claim the points; we do not collect any personal data from you unless you choose to do so.

The GLOW programme is run on our website using a loyalty software provider. Your points balance is linked to the e-mail address on your account. Points may expire in accordance with the GLOW programme terms, and we will keep the record of how and when points were earned, redeemed or expired for as long as your account is active and for the period in Section 9.

4.3 Security checks and automated blocks

To protect the programme from abuse, our systems automatically monitor verification and claim activity – for example, the number of codes tried from one IP address, account or device in a period, repeated invalid codes, and attempts to claim codes that have already been claimed. Where this activity crosses our security thresholds, our systems may automatically and temporarily pause access to the verification service, or to GLOW point claims, for that IP address or account (typically for one to 24 hours). This is an automated decision with limited effect: it does not affect your ability to shop, your existing points, or your account. If you believe you have been blocked in error, contact customer care using the details in Section 13 and a member of our team will review it.

4.4 Retention

Verification and claim records are kept for 36 months from the date of the event, after which they are deleted or anonymised; records relating to a suspected fraud or counterfeit investigation may be kept for longer where needed to resolve the matter. IP addresses in the log may be stored in hashed form. GLOW points records are kept as described in Section 9.

5. Marketing communications

We will only send you marketing e-mails, SMS or messaging-app messages (such as WhatsApp) if you have opted in, for example by ticking the marketing box at checkout or when creating an account, or by subscribing to our newsletter. We do not pre-tick consent boxes.

You can opt out at any time by clicking "unsubscribe" in any marketing e-mail, replying STOP to an SMS where that option is offered, changing your preferences in your account settings, or contacting us using the details in Section 13. Opting out of marketing does not affect transactional messages about your orders or account.

If you are in Singapore, we will not send marketing messages to a Singapore telephone number listed on the Do Not Call Registry unless you have given us clear and unambiguous consent to do so.

We may use your purchase history and browsing behaviour to tailor the offers we show you or send to you. You can ask us to stop this at any time.

6. Who we share your personal data with

We share personal data only where necessary for the purposes described in Section 3, and only with the recipients described below. Every service provider we use is required by contract to keep your personal data confidential, to use it only on our instructions and to protect it with appropriate security measures.

Recipient	What is shared and why
Payment gateway and payment service providers	Order amount, order reference, your name, e-mail and billing details, so that your payment can be authorised, processed and screened for fraud. Card and online-banking details are entered directly with the gateway and never touch our servers.
Courier and logistics partners	Name, delivery address, phone number and parcel details, so your order can be delivered and you can receive delivery updates.
Website hosting and IT service providers	Our website, database and back-ups are hosted by our web hosting provider. Our e-mail, technical support and security providers may have incidental access to personal data when maintaining our systems.
Loyalty programme software provider	Account e-mail, points earned, redeemed and expired, and the activities that earned them, so that your GLOW balance can be maintained. The software runs on our own website; the provider does not receive your data for its own purposes.
E-mail, SMS and messaging service providers	Contact details and message content, so that transactional and (where you have consented) marketing messages can be delivered.
Analytics providers (Google Analytics)	Technical and usage data collected through cookies, so we can understand how the Site is used. See Section 7.
Advertising platforms (Meta, TikTok)	Cookie and pixel identifiers and, where lawful, hashed e-mail addresses, so we can measure campaigns and show relevant advertising. See Section 7.
Professional advisers	Lawyers, accountants, auditors and insurers, where needed to run our business, comply with law or handle a claim.
Government bodies, regulators, courts and law enforcement	Where we are required by law or a lawful request, including the Royal Malaysian Customs Department, the Inland Revenue Board and the Personal Data Protection Commissioner, or the equivalent bodies in Singapore.
A buyer or successor of our business	If we sell, merge or reorganise all or part of our business, personal data may be transferred to the new owner, who will remain bound by this policy.

7. Cookies, pixels and similar technologies

Cookies are small text files placed on your device when you visit a website. Pixels (also called tags) are small pieces of code that let a platform recognise your browser or device. We use both to make the Site work (for example, keeping you logged in, remembering your cart and securing the seal verification page), to analyse how the Site is used, and to measure and support our advertising.

The main third-party tools we use are Google Analytics, which helps us understand which pages and products are popular and how visitors move through the Site using aggregated statistics; and the Meta Pixel (Facebook and Instagram) and the TikTok Pixel, which measure whether our advertisements lead to visits and purchases and allow us to show you relevant advertising on those platforms. These tools set cookies or similar identifiers in your browser and send technical and usage data to Google, Meta and TikTok, who process it under their own privacy policies, which we encourage you to read.

You can block or delete cookies at any time through your browser settings, although some features of the Site, such as staying logged in or keeping items in your cart, may not work properly as a result. You can also limit advertising personalisation and analytics through your Facebook and Instagram ad preferences, your TikTok privacy settings, Google's Ads Settings and the Google Analytics opt-out browser add-on. If we introduce a cookie preference tool on the Site in future, we will update this section.

8. Where your personal data is stored and international transfers

Our Site and customer database are hosted in Malaysia. Some of the service providers listed in Section 6 – in particular our payment gateway, e-mail and messaging providers, and Google, Meta and TikTok – may store or process personal data in other countries, including Singapore, the United States and other locations where they or their sub-processors operate.

Where we transfer personal data outside Malaysia, we do so in accordance with section 129 of the Malaysian PDPA: either to a place that has laws substantially similar to the Malaysian PDPA or that provides an equivalent level of protection, or on another ground permitted by the Act, such as with your consent, where the transfer is necessary to perform our contract with you, or where we have taken all reasonable precautions and exercised due diligence to ensure the data will not be processed in a way that would breach the Act.

Where we transfer personal data of Singapore customers outside Singapore, we ensure the recipient is bound by legally enforceable obligations to provide a standard of protection comparable to the Singapore PDPA, as required by its Transfer Limitation Obligation.

9. How long we keep your personal data

We keep personal data only for as long as it is needed for the purposes for which it was collected, or as required by law, after which it is deleted or anonymised. Our standard retention periods are:

Data	Retention period
Order, invoice and payment records	7 years from the end of the financial year of the transaction, as required by Malaysian tax and company law (and 5 years for Singapore tax records where applicable).
Customer account	For as long as your account is active. If you ask us to close your account, or it has been inactive for 3 years, we may delete or anonymise it, except for records we must keep by law.
Customer care correspondence	3 years from the last contact, so we can handle follow-up questions and complaints.
Marketing consent and preferences	Until you withdraw consent, plus a record of the withdrawal so we can honour it.
Seal verification and GLOW claim logs	36 months from the event, then deleted or anonymised (longer if part of a fraud or counterfeit investigation).
GLOW points ledger (points earned, redeemed, expired)	For as long as your account is active, plus 12 months after closure to resolve any dispute; transactions tied to an order follow the 7-year order-record period.
Analytics data (Google Analytics)	14 months on Google's servers in aggregated form, per our retention setting.
Website server logs and security logs	90 days, unless needed to investigate a security incident.
Reviews you post	For as long as the product is listed, unless you ask us to remove the review.

10. How we protect your personal data

We take practical steps to protect personal data against loss, misuse, unauthorised access, modification or disclosure, taking into account the nature of the data and the harm that could result. These steps include:

Encryption of all traffic between your browser and the Site using HTTPS/TLS.
Never storing full card numbers, CVVs or online-banking credentials – payments are handled by a PCI DSS-compliant payment gateway.
Storing account passwords only in salted, hashed form.
Restricting access to personal data to staff and contractors who need it, protected by individual accounts, strong passwords and two-factor authentication for administrators.
Keeping our website software, plugins and server up to date, with regular back-ups, malware scanning and a web application firewall.
Rate-limiting and abuse detection on the seal verification page.
Written contracts with service providers requiring them to protect personal data.

No method of transmission over the internet or of electronic storage is completely secure. If we become aware of a personal data breach that is likely to cause significant harm to you, we will notify the Personal Data Protection Commissioner (Malaysia) and, where required, the Personal Data Protection Commission (Singapore) within the timeframes required by law, and we will notify you without unreasonable delay, along with the steps you can take to protect yourself.

You also play a part in keeping your data safe: keep your password confidential, do not share your account, and let us know immediately if you suspect any unauthorised use of your account.

11. Your rights and choices

Subject to the conditions and exceptions in the Malaysian PDPA and the Singapore PDPA, you have the following rights in relation to your personal data:

Access: to ask for a copy of the personal data we hold about you and information about how we have used and disclosed it in the past year.
Correction: to ask us to correct personal data that is inaccurate, incomplete, misleading or out of date. You can update most account details yourself in your account settings.
Withdraw consent: to withdraw any consent you have given, for example to marketing, by giving us reasonable notice. Withdrawing consent does not affect processing that took place before, and in some cases may mean we cannot continue to provide a product or service to you.
Object to direct marketing: to require us to stop, or not begin, using your personal data for direct marketing purposes.
Limit processing: to ask us to stop or not begin processing your personal data where it is causing, or is likely to cause, substantial and unwarranted damage or distress to you or another person.
Data portability: to ask us to transmit personal data you have provided to us to another data controller in a commonly used machine-readable format, where this is technically feasible.
Deletion: to ask us to delete personal data that is no longer needed for the purpose it was collected, subject to legal retention requirements.
Complain: to lodge a complaint with the Personal Data Protection Commissioner in Malaysia (www.pdp.gov.my) or the Personal Data Protection Commission in Singapore (www.pdpc.gov.sg). We would appreciate the chance to resolve your concern first.

To exercise any of these rights, contact us using the details in Section 13. We may need to verify your identity before acting on your request. We will respond within 21 days of receiving a valid request, or within any shorter time required by law, and will tell you if we need more time. We do not usually charge a fee, but the Malaysian PDPA allows us to charge a prescribed fee for access requests; we will tell you in advance if a fee applies. In some circumstances we are permitted to refuse a request (for example, where it would disclose another person's personal data or where the law requires us to keep the data), and we will explain why.

Providing your personal data is voluntary. However, if you do not provide the personal data marked as required on our forms, we will not be able to create your account, process your order or respond to your enquiry.

12. Links to other websites and social media

The Site may contain links to third-party websites, apps and social media platforms, including our official Facebook, Instagram, TikTok and Shopee or Lazada storefronts (if any). We are not responsible for the privacy practices of those third parties, and this policy does not apply to them. Please read their privacy policies before providing any personal data. Purchases made on marketplace platforms are governed by that platform's privacy policy as well as this one.

13. How to contact us

If you have any question, request or complaint about this policy or how we handle your personal data, please contact our privacy contact:

Attention: Data Protection Officer / Privacy Contact, Serana Beauty

Company: T&Y Aura Sdn. Bhd., B-5-8, Plaza Mont Kiara, Mont Kiara, 50480 Kuala Lumpur, Malaysia

E-mail: hello@seranabeauty.com

Telephone: +603-2788 3778

Email Us →

If you are writing to exercise a right under Section 11, please include your full name, the e-mail address used on your account or order, and enough detail for us to understand and verify your request.

14. Changes to this policy

We may update this policy from time to time to reflect changes in our business, the Site, the law or our service providers. The version number and date at the top and bottom of this policy show when it was last updated. If we make a significant change – for example, using your personal data for a materially new purpose – we will notify you by e-mail or by a prominent notice on the Site before the change takes effect, and where the law requires it we will ask for your consent. We encourage you to review this policy regularly.

15. Language

This policy is issued in English and may also be made available in other languages for convenience. In the event of any inconsistency between the English version and any translation or summary, the English version shall prevail to the extent permitted by law.

Serana Beauty Privacy Policy · Version 1.0 · October 2026