1. Personal Data We Collect
To create your digital name card and deliver our Service, we collect the following categories of information:

• Account Credentials (via Google SSO): Full name, primary email address, and Google account avatar/profile image.

• Profile Data (Directly Provided): Information you choose to display on your digital card, including phone numbers, job titles, business addresses, web links, and social media identifiers (e.g., WhatsApp, Instagram, LinkedIn, Xiaohongshu, TikTok).

• Technical & Usage Data: Tokenized NFC chip identifiers linked during card activation, IP addresses, browser types, device information, and necessary cookies for user authentication and session management.

2. Purpose of Data Processing
We process your personal data for the following legitimate business purposes:

• To generate, host, and render your public digital landing page and downloadable contact file (.vcf file).
• To enable profile edits and dashboard management via Google SSO authentication.
• To manage customer support inquiries and process replacement orders.
• To maintain server security, prevent fraud, and optimize platform reliability.

3. Disclosure & Public Nature of Profiles
• Public Profile Intent: By publishing your profile details on CatchUpBuddei, you give explicit consent for that data to be publicly accessible to anyone who taps your physical NFC hardware or scans your QR code.

• Third-Party Recipients: CatchUpBuddei does not control how third-party recipients store, share, or process your contact details once saved or downloaded (.vcf) onto their personal devices.

• Backend Infrastructure: We do not sell or rent your personal data to advertisers. Data is shared with trusted infrastructure providers (e.g., secure cloud hosting and database services) solely as required to run the platform.

• Legal Compliance: We may disclose personal data if compelled by Malaysian law enforcement agencies, regulatory bodies, or legal court orders.

4. Data Security & Retention
• Security Controls: We implement appropriate technical, administrative, and physical safety measures to prevent unauthorized access, alteration, disclosure, or destruction of your personal data.

• Retention Period: Your profile data is retained as long as your CatchUpBuddei account remains active. Upon account deletion requests, your data will be permanently purged from our active operational databases within 30 days.

5. Your Rights Under the PDPA
In accordance with the Malaysian PDPA, you possess the following rights regarding your personal data:

• Right to Access & Correct: You may view and modify your published profile information at any time by logging into your account dashboard.

• Right to Withdraw Consent / Account Deletion: You may request complete deletion of your account and withdrawal of consent for data processing by emailing our support team.

• Response SLA: We will process and respond to formal PDPA data access or deletion requests within 21 calendar days of receipt.

6. Contact Us
For any privacy inquiries, data access requests, or issues regarding this policy, please reach out to our Data Protection representative at:

• Email: catchupbuddei.support@gmail.com