Privacy Policy

1. Who we are

Pho King is a Vietnamese restaurant in Petaling Jaya, Selangor, Malaysia. This policy explains how we collect, use, store and protect personal data when you use our website, our customer app, our ordering and table booking services, and our loyalty programme. We handle personal data in line with Malaysia's Personal Data Protection Act 2010 (PDPA).

Address: 153, Jalan SS 2/6, SS 2, 47300 Petaling Jaya, Selangor. Hotline: 16 254 9866. Privacy enquiries: privacy@phokingkl.com.

2. Information we collect

We only collect what we need to serve you:

• Account details: your name, email address, phone number and, if you choose to share it, your birthday.
• Order details: dishes ordered, item notes, order value, pickup or delivery choice, delivery address and delivery instructions.
• Table bookings: booking date and time, number of guests, seating preference and any pre-ordered dishes.
• Loyalty and rewards: points earned and redeemed, vouchers granted, redemption history and referral code usage.
• Payment records: the payment method used and the payment reference or transfer confirmation. We never see or store your full card number, banking password or one-time passcode.
• Messages: reviews, feedback, support messages, and email or WhatsApp notifications we send you about your order or booking.
• Technical data: device type, browser, approximate location when you request delivery, and basic usage logs used to keep the service secure and working.

3. How we use your information

We use your personal data to:

• Prepare, confirm and deliver your orders and table bookings.
• Send order status, booking confirmations and delivery updates by email or WhatsApp.
• Run the loyalty programme: award points, apply vouchers and process reward redemptions.
• Provide customer support and respond to feedback or complaints.
• Keep accounting and tax records as required by Malaysian law.
• Detect and prevent fraud, abuse and misuse of vouchers or rewards.
• Improve our menu, service and app experience using aggregated, non-identifying statistics.

4. Marketing messages

We only send promotional emails or WhatsApp messages when you have agreed to receive them. You can opt out at any time using the unsubscribe link in the email, by replying STOP to a WhatsApp message, or by contacting us. Opting out of marketing does not stop essential messages about an order or booking you have made.

5. Who we share your information with

We do not sell your personal data. We share it only with service providers who help us operate the restaurant, and only to the extent they need it:

• Payment and banking partners who process transfers and QR payments.
• Delivery platforms and riders who fulfil your delivery order.
• Email and WhatsApp messaging providers used to send order and booking notifications.
• Our hosting and database provider, which stores the data securely on our behalf.
• Government authorities, regulators or law enforcement where we are legally required to do so.

6. How long we keep your data

We keep account and order data for as long as your account is active. After your account is deleted we remove your personal details, and keep only the transaction records we are legally required to retain for accounting and tax purposes, normally seven years. Aggregated statistics that cannot identify you may be kept indefinitely.

7. Security

Your data is stored on secured servers with encrypted connections. Access is restricted to authorised staff who need it to do their job, and staff access is protected by individual accounts and passwords. No system is perfectly secure, so please keep your own account password private and tell us immediately if you suspect unauthorised access.

8. Your rights

Under the PDPA you may:

• Ask for a copy of the personal data we hold about you.
• Correct information that is wrong or out of date — you can edit most details yourself in your account.
• Withdraw your consent to marketing messages.
• Ask us to limit how we process your data.
• Request deletion of your account and personal data.

9. Deleting your account

You can ask us to delete your account and personal data at any time by emailing privacy@phokingkl.com from the email address on your account, or by calling our hotline 16 254 9866. We action verified requests within 30 days. Deleting your account permanently removes your saved addresses, unused loyalty points and vouchers, and they cannot be restored.

10. Children

Our services are intended for customers aged 18 and above. We do not knowingly create accounts for children. If you believe a child has given us personal data, contact us and we will remove it.

11. Cookies and local storage

We use cookies and browser storage to keep you signed in, remember your shopping cart and remember your language and display preferences. These are necessary for the service to work. We do not use third-party advertising trackers.

12. Changes to this policy

We may update this policy as our services change. The date at the top of this page shows the latest version. If we make a significant change we will notify you in the app or by email. Questions? Email privacy@phokingkl.com.