TCT Privacy Notice
1. Introduction
Toybox Creations and Technology Sdn. Bhd. (“TCT”) and its subsidiaries (each, referred to as “Company” and collectively referred to as the “Group”) is committed to safeguarding Your Personal Data and regards the protection of Your privacy as a high priority. Accordingly, as part of Our efforts to comply with applicable rules and regulations governing Personal Data protection, we adhere to the Personal Data Protection Act 2010 of Malaysia, together with all the subsequent amendments, revisions, and subsidiary regulation made thereunder (hereinafter referred to as “Malaysia’s PDP”).
Furthermore, given the availability of Our products and/or services in Indonesia and Singapore, the processing of Personal Data carried out in Indonesia shall also comply with the prevailing laws and regulations, and Indonesia's Law Number 27 of 2022 concerning Personal Data Protection, together with all the subsequent amendments, revisions, and subsidiary regulation made thereunder (Undang-Undang Nomor 27 Tahun 2022 tentang Pelindungan Data Pribadi hereinafter referred to as “UU PDP”) and Singapore’s Personal Data Protection Act 2012, together with all the subsequent amendments, revisions, and subsidiary regulation made thereunder (hereinafter referred to as “Singapore’s PDPA”).
In the context of Personal Data processing, there are two roles, which are the Data Controller and the Data Processor. The Data Controller is the party that determines the purposes of and exercises control over the processing of Personal Data. In this regard, TOYBOX CREATIONS AND TECHNOLOGY SDN. BHD., with its registered office at A2-19-3A, SOHO Suites @ KLCC, 20, Jalan Perak, 50450 Kuala Lumpur, shall be deemed the Data Controller (hereinafter referred to as the “Data Controller,” “TCT,” “Company,” “Group” or “Us”).
In addition, a Data Processor refers to any individual, public authority, or international organization that processes Personal Data solely on the basis of the written instructions of the Data Controller, including but not limited to application service providers for processing Personal Data, as well as server or cloud storage providers.
This Privacy Notice may be revised and updated by TCT from time to time. TCT recommends that You visit Our Website to review the most updated version of this Privacy Notice, each time You provide Your Personal Data to Us. By continuing to communicate with TCT, using Our services, purchasing Our products and/or access to Our website after being notified of any amendments to this Privacy Notice, You will be treated as having agreed to and accepted those amendments.
2. Reference
TCT will only process Your Personal Data in accordance with the Malaysia PDPA/ Indonesia’s UU PDP/Singapore PDPA, the applicable regulations, guidelines, orders made under the Malaysia PDPA/ Indonesia’s UU PDP/Singapore PDPA, and any statutory amendments or re-enactments made of the the Malaysia PDPA/ Indonesia’s UU PDP/Singapore PDPA, from time to time as well as the internal practice of Personal Data Protection, including but not limited to this Privacy Notice, Privacy Policy, and Internal Policy (Standard Operating Procedure/SOP). All the regulations mentioned are constructed in consideration to align with the global standard of Personal Data Protection, namely European Union General Data Protection Regulation 2016 (hereinafter referred to as “GDPR”).
By providing Your Personal Data to TCT, visiting Our website, and using Our products and services, You are deemed to have read and accepted the policy herein;
You are also deemed to have consented to the processing of Your Personal Data by TCT in the manner set out herein. If You provide Personal Data of third parties to TCT, You warrant and represent to TCT that You have obtained the required consent of the third parties for the processing of the relevant Personal Data by TCT in the manner set out herein.
3. Consent
In the processing of Personal Data, each processing activity is required to be supported by a valid legal basis, as follows:
explicit consent from the Data Subject;
contractual obligation;
legal obligation;
vital interest;
public interest;
legitimate interest.
By providing Your Personal Data to TCT, visiting Our website, and using Our products and services, You are deemed to have read and accepted this Privacy Notice. Accordingly, this constitutes Your consent to the processing of Your Personal Data by TCT in the manner described herein. Should You provide the Personal Data of third parties to TCT, You are required to obtain and provide the explicit written consent of such third parties for the processing of their Personal Data by TCT in the manner described herein.
4. Use of Your Information
TCT collects information that identifies/may identify an individual, which refers to as "Personal Data". We collect Your Personal Data using Our proprietary system as well as anonymous information aggregated on the system, and uses such information to provide updates and information from TCT to You, to improve TCT’s or third party’s products or as a reference to their product development. If such information was collected in connection with other services provided by TCT, TCT will address such information appropriately in accordance with Our End User License Agreement, Privacy Policy or any other terms and conditions provided in connection with the said other services.
TCT may collect Personal Data from You during the course of Your dealings with TCT or for the purpose of TCT’s business activities. Such Personal Data may include, but not limited to, name as per identity card, preferred name, identity card/passport number, age, contact number, biometric data, residential address, email address, birth date, gender, race, nationality, behavioural data, occupation, designation, bank account or payment details, information of spouse/children such as name and birth date, verification of parental authority, communication, billing, legal documentation, information of Your company such as name, registration number and address, information as to physical or mental health, religious beliefs or other beliefs of a similar nature and such other data necessary for the purposes which the Personal Data is collected.
TCT may "process" Your Personal Data by way of collecting or record, storing, using, transfer or disclose, delete or destruct of Personal Data. The Personal Data provided by You to TCT may be processed by TCT for the following purposes:
to administer the business or contractual relationship between TCT and You and/or Your company;
to communicate with You and/or Your company to maintain and improve customer relationship;
to communicate with You and/or Your company for marketing purposes, if applicable, TCT will issue newsletters or updates, and/or separate content based purposes for promotional activities;
to administer customer relationship management procedures;
to provide You with information about the activities, products, services, events and programmes that may be organized, managed, facilitated, provided, sponsored and/or participated by TCT;
to provide You with information about the products, services, events and programmes offered by selected third parties that may interest You;
to facilitate payment in connection with the business or contractual dealings between TCT and You and/or Your company;
to conduct research, study, assessment, survey and/or prepare reports/statistics for purpose of TCT’s business activities;
to process and analyse Your Personal Data either individually or collectively with other individuals;
to share any of Your Personal Data with TCT business partners to jointly develop products and/or services or launch marketing campaigns;
to maintain and update internal record keeping, files and contact lists;
to respond to Your enquiries;
to comply with any legal or regulatory requirements applicable to TCT, and to make disclosure under the requirements of any law, regulation, direction, court order, by-law, guideline, circular or code applicable to TCT;
for recruitment of employees;
for internal administrative purposes;
for TCT’s internal record keeping; and/or
other lawful business activities of TCT.
TCT will seek Your separate consent for any other purposes which do not fall within the categories stated above.
TCT will not sell, rent, transfer or disclose any of Your Personal Data to any third party without Your consent. However, the Personal Data provided by You may, if required, be disclosed to the following classes of third parties;
TCT’s group of companies including the TCT’s parent/holding company, subsidiaries, successors in title, related and/or associated companies inside or outside the relevant country where the service is provided;
TCT’s sub-contractors or third-party service or product providers as may be determined by TCT to be necessary or appropriate;
Financial institutions for purposes of facilitating payments and/or maintaining financial records in connection with the business or contract relationship between TCT and You and/or Your company;
Government bodies and agencies inside or outside the relevant country where the service is provided including strategic partners that work with TCT in connection with Our business activities or any event or programme;
Any party nominated or appointed by TCT either solely or jointly with other service providers, for purpose of establishing and maintaining a common database where TCT has a legitimate common interest;
The data centres and/or servers located inside or outside the relevant country where the service is provided for data storage purposes;
Any party in relation to legal proceedings or prospective legal proceedings;
Agents, contractors, auditors, consultants, accountants, insurers, lawyers or other financial or professional advisers of TCT;
Regulatory bodies, government bodies or other authorities if required or authorized to do so to discharge any regulatory function under any law or in relation to any order or judgment of a court;
Any person to whom TCT is compelled or required to do so under the law;
TCT’s business partners, third party product and/or service providers, suppliers, vendors, distributors, contractors or agents, on a need to know basis, that provide related products and/or services in connection with Our business, or discharge or perform one or more of the above Purposes and other purposes required to operate and maintain Our business;
The Personal Data processed by TCT is collected from You or provided by a third party considering the alignment with aforementioned applicable law and regulations to TCT for the aforesaid purposes.
5. Notice and Choice Principle Statement
Please note the collection of Your Personal Data by TCT may be mandatory or voluntary in nature depending on the Purposes for which Your Personal Data is collected. Where it is mandatory for You to provide TCT with Your Personal Data, and in the event, You fail or choose not to provide TCT with such data, or do not consent to the above or this Data Protection Policy, TCT will not be able to provide Our products and/or services or otherwise deal with You.
TCT assumes that all Personal Data provided by You are accurate, complete, and that none of it is misleading or out of date. You will promptly update TCT in the event of any change to Your Personal Data. You have a right to request for access to and for correction of Your Personal Data. You may also choose to limit the processing of Your Personal Data. If You would like to make any of such requests, kindly submit Your request in writing to TCT at the postal/email address specified in Section 12. TCT may charge You an administration fee for such requests.
In addition, You are also given the right to inform TCT on the withdrawal (in full or in part) of Your consent given previously to TCT subject to any applicable legal restrictions, contractual conditions and a reasonable duration of time for such withdrawal of consent to be effected. However, Your withdrawal of consent could result in certain legal consequences. In this regard, depending on the extent of such withdrawal of consent for TCT to process Your Personal Data, it may mean that TCT will not be able to continue the existing relationship with TCT and/or the contract that You have with TCT will have to be terminated.
You are also entitled to request for transmission of Your Personal Data from us to another Data Controller of Your choice directly by giving us a notice in writing by way of electronic means. However, this request for data portability is subject to technical feasibility and compatibility of the data format.
If You have any inquiries or complaints in respect of the Personal Data, kindly communicate to TCT in writing at the postal/email address specified in Section 12 CONTACT DETAILS.
6. Security of Your Personal Data
In safeguarding the security and confidentiality of your Personal Data, TCT has implemented security policies and measures in accordance with applicable Personal Data protection laws and regulations. The measures include technical, organizational, and governance safeguards, as outlined below.
General Security Safeguard
All processing activities, including the collection/recording, storage, use, transfer/disclosure, and deletion/destruction of Personal Data, are conducted with appropriate security safeguards. These safeguards are designed to ensure the confidentiality, integrity, and availability of Personal Data. The implementation of these safeguards is guided by internal practices as documented in the internal policy of the Company (SOP). Specific technical and organizational measures are described in the following sub-sections.
Storing & Transfer of Personal Data
Personal Data collected by TCT shall be stored securely according to its data format and supported with backups to protect against incidents such as data loss.
TCT’s IT facilities and servers may be located in jurisdictions outside the country where the services are provided, therefore Personal Data may also be disclosed or transferred to third-party entities outside the relevant country with storing purposes. By providing Your Personal Data, You expressly consent to such cross-border transfers.
TCT will take reasonable steps to ensure that any third parties receiving Your Personal Data outside the relevant country use it solely for the intended purposes and implement safeguards to maintain its confidentiality and privacy.
Transfers to third-party service or product providers, whether domestic or international, will follow security measures aligned with Malaysia PDPA, Singapore PDPA, and Indonesia’s UU PDP. If the recipient jurisdiction’s protection level is considered inadequate, minimum safeguards as specified in TCT’s internal PDP SOPs will be applied. The transfer activities will follow the regulation outlined in the Cross Border Data Transfer (“CBDTA”) and/or other regulations implemented in any of the respective jurisdictions.
Usage of Personal Data
TCT ensures that the use of Your Personal Data is aligned with, and strictly limited to, the purposes for which it was collected, and is shared only with authorized third parties for the purposes set out in this policy.
Data Accuracy & Update
TCT ensures that Personal Data is kept accurate and up-to-date. Data Subjects have the right to request corrections or updates to their Personal Data to ensure its accuracy, and TCT will take reasonable steps to accommodate such requests in accordance with applicable data protection laws.
Website & Digital Security
The Internet is not a secure medium. However, TCT will secure various security procedures with regard to Our website and Your electronic communications medium with us. All TCT’ employees and Data Processors, who have access to, and are associated with the processing of Your Personal Data, are obliged to respect the confidentiality of Your Personal Data.
Please be aware that communications over the Internet, such as email/webmail are not secure unless they have been encrypted. Your communications may be routed through a number of countries before being delivered, due to the nature of the World Wide Web/Internet. TCT cannot and does not accept responsibility for any unauthorised access or interception or loss of Personal Data that is beyond Our reasonable control.
Such security procedures are conducted in accordance with the internal practice (SOP).
Security Update
TCT will make reasonable updates to its security measures from time to time based on regular evaluations conducted to strengthen the protection of Personal Data.
Incident Management
In the event that TCT becomes aware of or detects a Personal Data breach, we will take all necessary measures to notify the Personal Data Protection Commissioner and other relevant government authorities according to the Malaysia PDP, Singapore PDP, and Indonesia's UU PDP as soon as reasonably practicable, in accordance with governed laws and regulations, and shall follow up in accordance with the established Incident Response Plan.
Data Protection Officer
As part of the governance obligation as stipulated in Malaysia PDPA, Singapore PDPA, and Indonesia's UU PDP, TCT is obliged to appoint of Data Protection Officer(s) who responsible to ensure the compliance of Personal Data Protection within TCT.
Requirement for the appointment of DPO is outlined in the internal Privacy Policy.
7. Personal Data from Minors and Other Individuals
To the extent that You have provided (or will provide) Personal Data about Your family members, spouse, other dependents (if You are an individual), directors, shareholders, employees, representatives, agents (if You are a corporate entity/an organisation) and/or other individuals, You confirm that You have explained (or will explain) to them that their Personal Data will be provided to, and processed by TCT and You represent and provide proof of consent that You have obtained prior to the processing (including disclosure and transfer) of their Personal Data in accordance with this Privacy Notice.
In respect of minors (i.e. individuals under 18 years of age) or individuals not legally competent to give consent, You shall confirm and provide a written proof that You are the parent or guardian or person who has parental responsibility over them or the person appointed by court to manage their affairs or that they have appointed You to act for them, to consent on their behalf to the processing (including disclosure and transfer) of their Personal Data in accordance with this policy; and
In addition, Your Child/Ward data may be processed in an anonymised and aggregated form for the purpose of research, service improvement, and AI model training, in accordance with the applicable ethical and regulatory standards.
8. Website and External Links
If any part of Our website links You to other websites, those websites do not operate under this policy and we do not accept any responsibility or liability arising from those websites;
If You subscribe to an application, content or a product from TCTʼs strategic partner and You subsequently provide Your Personal Data directly to that third party, that Personal Data will be subject to that third party's privacy/Personal Data protection policy (if any) and not to this Personal Data Policy;
We recommend You to read and understand the Privacy Notice/Privacy Policy posted on those other websites in order to understand their procedures for when collecting or record, storing, using, transfer or disclose, delete or destruct of Personal Data and before submitting Your Personal Data to those websites.
9. Cookies
TCT employs an industry standard technology called "cookies". The cookie is a small piece of information stored on the hard drive of Your computer or device for record-keeping purposes, and is used by us to track Your visits to TCTʼs website. Cookies may be used to save Your preferences for Your ease and convenience when using the website. Third party advertising networks may issue their separate cookies to Your hard drive when serving advertisements;
The type of anonymous click stream data collected by TCT through the cookies may include Your Internet Protocol address, web browser software, date and time of visit to TCTʼs website, and whether Your requests (including search requests and clicking on links to parts of TCT website) were met with successfully. All such information collected through cookies is not Personal Data and You cannot be identified from this information. Such information is only used for the purpose of managing and creating a better user experience, analysing the traffic on the website and to identify areas for improvement on TCTʼs website.
The use of cookies is now an industry standard, and You will find them used on most major websites. Most browsers are initially set up to accept cookies. If You prefer, You can reset Your browser either to notify You when You have received a cookie, or to refuse to accept cookies. You should understand that certain features on TCTʼs website will not function properly if You set Your browser to not accept cookies.
10. Disclaimer and Limitation of Liability
You shall use TCT at Your sole risk. No Information or advice provided by TCT creates a warranty. The system is provided on an “as is” basis without warranty of any kind. To the greatest extent permitted by law, TCT disclaims any and all warranties with respect to the system, express or implied, including without limitation, the implied warranties of merchantability and fitness for a particular purpose. TCT shall assume liability for damages caused by reasons attributable to TCT (except for any incidental, special, consequential, exemplary, indirect or punitive damages); provided however, that except in cases of wilful misconduct or gross negligence by TCT and to the greatest extent permitted by law, TCT will not be liable for any damages incurred by You or a third party beyond the extent normally expected in connection to Your access, use, misuse, or inability to use the system or data on the system, or termination or cancellation of this policy, even if TCT has expected the possibility of such disadvantage or damages.
In any event, TCTʼ aggregate liability to You in connection with any claims arising out of or relating to the system is limited to the amount You actually paid for the system, except in cases of wilful misconduct or gross negligence by TCT and to the greatest extent permitted by law. If a law restricts TCTʼs ability to limit liability or disclaim warranties, the limitations listed above may not apply to You. In that case, TCT limits Our liability and disclaims warranties to the greatest extent permitted by law. For avoidance of doubt, nothing herein shall exclude or restrict TCTʼs liability for death or personal injury resulting from TCT negligence.
11. Discrepancies
If ever any updates, changes, modifications, commissions, and/or amendments show discrepancies in any versions of this Privacy Notice, the latest version shall prevail. This Privacy Notice was last updated on November 10th, 2025.
12. Contact Details
Should You have any questions or concerns, You may contact TCT at:
TOYBOX CREATIONS AND TECHNOLOGY SDN BHD,
Registered address:
A2_19_3A, SOHO SUITES c KLCC, 20, JALAN PERAK,
50450, KUALA LUMPUR.
Business Address:
E_01_02, BLOCK E PLAZA MONT KIARA, JALAN KIARA, MONT KIARA WP 50480, KUALA LUMPUR.
Attn: TCT service team
Email: info@toyeight.com
