Privacy Policy.

1. Introduction

At UFOREA, your privacy matters. We respect the trust families place in us when they hand over an email, a WhatsApp number, or a card payment, and we treat that information accordingly.

This Privacy Policy explains what personal data Marvelous Wonderland Sdn. Bhd. (202401002683), trading as UFOREA (referred to as "we", "us", or "our"), collects from visitors to our website at uforea.net and guests at our playground at Island 88, Tanjong Tokong, Penang. It also covers how we use that data, who we share it with, how long we keep it, and the rights you have under Malaysia's Personal Data Protection Act 2010 (PDPA).

By visiting our website, purchasing a ticket, or messaging us on WhatsApp, you consent to the practices described in this policy. If you do not agree with any part, please contact us before proceeding (see Section 11).

2. What personal data we collect

We only collect personal data that is necessary for the services we provide. The categories of data we may hold are:

2.1 Newsletter and marketing sign-ups

We do not currently operate an email newsletter. If we introduce one, sign-up will always be opt-in and we will collect only your email address and, where you provide it, your first name.

2.2 Ticket and event purchases

When you buy tickets, book a birthday party, or pay a deposit through our website (powered by WooCommerce), we collect:

• Your full name and contact details (email, mobile number)
• Your IC (NRIC) number, which we keep for record purposes only
• Billing address (where required by the payment processor)
• Booking details (visit date, party theme, number of children, dietary notes, and the birthday child’s actual birthday date — so we can suggest a better slot for your celebration where one is available)
• Payment confirmation reference (we do not store full card numbers — see Section 4.1)

2.3 WhatsApp and email correspondence

When you message us via WhatsApp at +60 12-949 2683 or email hello@uforea.net, we retain the conversation history together with the phone number or email you used. This helps us pick up the thread if you contact us again.

2.4 Birthday party and event details

For birthday bookings we may collect the birthday child's first name, age and actual birthday date, the names and ages of guests where you provide them, and any dietary or accessibility requirements you share. We use the birthday date to help suggest the best available slot for your celebration. This information is used solely to plan and deliver your event.

2.5 Anonymous analytics

When you browse uforea.net, our analytics tool collects standard, anonymised information: pages visited, time on page, approximate location (city level), device type and referring source. This data is aggregated and cannot identify you personally. See Section 6.

2.6 CCTV at our premises

Our playground is monitored by CCTV for child safety and security. Recordings are stored on a local secure server and are not shared except where required by law or to investigate a safety incident.

3. How we use your data

We use your personal data only for the purposes for which it was collected, including:

• Fulfilling your booking — issuing tickets, confirming party dates, processing payments, sending pre-visit instructions, and providing on-site support.
• Customer service — responding to WhatsApp messages, emails and phone calls; resolving complaints and refund requests.
• Marketing communications — sending newsletters, promotional offers and event and deal updates by email or WhatsApp only if you have opted in. You can unsubscribe from any email with a single click, or message us on WhatsApp to opt out at any time.
• Improving our service — analysing aggregate website traffic to understand which content families find useful, and refining the playground experience.
• Legal and regulatory obligations — keeping financial records for the Inland Revenue Board (LHDN), responding to lawful requests from authorities, and defending claims.
• Safety and security — CCTV recording, lost-child reunification (see our Health & Safety policy), and protecting our staff and visitors.

We will not use your personal data for any purpose materially different from the above without first obtaining your consent.

4. Who we share data with

We never sell your personal data. We share it only with the third-party service providers we rely on to run our business, and only to the extent necessary. Current providers include:

4.1 Payment processors

Card and online payments are processed through Stripe and our acquiring bank. They receive your name, email, billing address, payment amount and card details directly — we do not see or store full card numbers on our own servers. Stripe's privacy notice is available at stripe.com/privacy.

4.2 Email and newsletter service

We do not currently operate an email newsletter. If we introduce one, delivery will be handled by a reputable provider such as Mailchimp, which would receive your email address and first name, and we will update this policy accordingly.

4.3 Website analytics

We use Google Analytics to understand aggregate website traffic. Google may receive anonymised browsing data via cookies. See Section 6 on how to opt out.

4.4 Messaging

WhatsApp messages you send us are handled by WhatsApp / Meta under their own privacy terms.

4.5 Service providers under contract

From time to time we engage photographers, party-supply vendors, IT support and accountants. These parties are bound by confidentiality obligations and process your data only as instructed by us.

4.6 Legal disclosures

We may disclose your data where required to do so by Malaysian law, by a court order, or to protect our legal rights, the safety of our staff and guests, or to investigate fraud.

5. How long we keep your data

We retain personal data only for as long as is necessary for the purposes set out above:

• Newsletter subscribers (if a newsletter is introduced) — until you unsubscribe, after which we retain a suppression record (so we don't email you again) but delete other details within 30 days.
• Ticket and party bookings — for at least 7 years, to meet tax and accounting record-keeping requirements under Malaysian law.
• WhatsApp and email correspondence — typically 24 months from the last interaction, unless the conversation relates to an ongoing matter or refund.
• CCTV recordings — generally 30 days on a rolling overwrite, retained longer only where a specific safety incident is under review.
• Analytics data — anonymised aggregates retained as long as our analytics provider's default (typically 14 months for Google Analytics).

6. Cookies and analytics

Our website uses cookies and similar technologies to make the site work, remember your preferences, and understand how visitors use the site.

We use two broad categories:

• Essential cookies — required for the website and shopping cart to function (for example, remembering what's in your basket). These cannot be switched off.
• Analytics cookies — set by Google Analytics to collect anonymous usage statistics. You can decline these via the cookie banner shown on your first visit, or by enabling "Do Not Track" in your browser.

You can also clear or block cookies through your browser settings at any time. Doing so may affect site functionality (for example, the shopping cart).

We do not use advertising or remarketing cookies at this time, and we do not allow third-party advertisers to set cookies on our site.

7. Your rights under the PDPA

Under the Personal Data Protection Act 2010, you have a number of rights in relation to the personal data we hold about you:

• Right of access — to ask for a copy of the personal data we hold about you.
• Right of correction — to ask us to correct inaccurate or incomplete data.
• Right to limit processing — to ask us to stop using your data for direct marketing or any other purpose where consent is the basis.
• Right to withdraw consent — at any time, where consent is the basis on which we process your data.
• Right to lodge a complaint — with the Personal Data Protection Commissioner of Malaysia if you believe we are not complying with the PDPA. The Commissioner's office can be contacted via pdp.gov.my.

We will respond to verified requests within 21 days. A reasonable fee may apply for data-access requests as permitted under the PDPA, although in most cases we will provide your data free of charge.

To exercise any of these rights, please contact us using the details in Section 11.

8. How we keep your data secure

We take reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, alteration or disclosure. These measures include:

• HTTPS encryption on all pages of uforea.net
• Restricted access to systems holding personal data — only staff who need access are granted access
• Reliance on reputable third-party providers (Stripe, Google) that maintain their own security and compliance certifications
• Periodic review of staff handling procedures for sensitive data such as party-guest lists

No system is perfectly secure. In the unlikely event of a personal data breach that is likely to result in significant harm, we will notify affected individuals and, where required, the Personal Data Protection Commissioner without undue delay.

9. Children's data

UFOREA is a family business and we welcome children every day on our premises. However, our website is intended to be used by parents and guardians, not by children directly. We do not knowingly collect personal data from children under the age of 13 through the website without parental consent.

Where a parent or guardian provides their child's first name, age or birthday date as part of a birthday booking, that information is used to plan and deliver the event and to help us serve your family on future visits, and is retained for as long as needed for those purposes.

If you believe your child has provided us with personal data without your consent, please contact us and we will delete it promptly.

10. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, new services, or changes in law. The "Last updated" date at the top of this page will always show the most recent revision.

If we make a material change that affects how we use your personal data, we will tell you by email (if we hold your email address) or by a prominent notice on the website, and where required by law, ask for your fresh consent.

11. Contact us / opt out

To ask about this policy, exercise any of your rights, or opt out of marketing, please contact us using any of the channels below.

For complaints you cannot resolve with us directly, you may contact the Personal Data Protection Commissioner of Malaysia via pdp.gov.my.