How We Look After Your Details

1Who we are

Squid Boy 花枝の燒 (“Squid Boy”, “we”, “us”) serves Taiwanese-Japanese street snacks at outlets across Malaysia and runs this website. For the personal data in this notice, Squid Boy is the data user under the PDPA.

Registered company: Din Fung F&B Sdn. Bhd. (company number to confirm). Business address: 11, Jalan Industri PBP 10, Taman Industri Pusat Bandar Puchong, 47100 Puchong, Selangor.

Some Squid Boy outlets are run by Squid Boy itself and some by independent operators under our brand (our subpartners).

2What this notice covers

Two forms on this website: the feedback form and the franchise enquiry form. Elsewhere on the site:

• “Use my location” on the Locations page works inside your browser. Your location is used on your device to sort outlets by distance and is never sent to us.
• Links to GrabFood, foodpanda, Facebook, Instagram, TikTok and Google Maps take you to those services. Their own privacy policies apply there.
• The chat bubble is a separate service. Please don’t type sensitive personal details into it. to confirm: who runs it and what it keeps
• Cookies: this website does not set advertising or tracking cookies. Our fonts, icons and map load from Google Fonts, Cloudflare (cdnjs), unpkg and OpenStreetMap, so your browser connects to those services to fetch them.

3What we collect

Both forms also record the date and time you sent it, the language of the page, and your IP address and browser type. We use these only to keep the forms working and to stop spam and abuse. A short sum (like “4 + 7”) checks that you are a person.

Please don’t put sensitive details in your message — for example health information, IC numbers or bank details. We don’t need them.

If you leave out something you must give, the form can’t be sent. If you leave out your contact details, we can still read your feedback, but we can’t reply to you.

4Why we use it

Feedback

To look into what happened and put it right, to help the outlet and HQ improve our food and service, and to contact you about it — only if you said we may.

Franchise enquiries

To reply to you, talk with you about opening a Squid Boy outlet, and keep a record of enquiries.

Both

To protect the forms from spam and abuse, and to meet our legal obligations.

We don’t use your details for marketing or advertising, and we never sell them. If we ever want to send you marketing, we will ask you first.

5Who sees it

Feedback

Squid Boy HQ staff who handle customer feedback, and the operator of the outlet your feedback is about (our subpartner) and their staff who handle feedback. Each operator sees feedback about its own outlets only. If you don’t name an outlet we recognise, HQ reads it first and passes it to the right one.

Franchise enquiries

Only Squid Boy HQ staff who handle franchise enquiries. Outlet operators don’t see them.

Service providers

Companies that host our website and systems or deliver our e-mail, only so they can run those services for us.

Authorities

Government bodies, the police or the courts, when the law requires it.

6How long we keep it

Franchise enquiry

While we are discussing it with you. Once the enquiry is closed we keep it for 24 months, then erase your personal details and keep only the reference number, date and status.

Feedback: the website’s copy

Deleted from the website’s system as soon as it reaches the outlet’s feedback system. If it can’t be delivered, it is deleted after 30 days.

Feedback: the case with HQ and the outlet

Kept while it is being handled, then for 24 months after it is resolved. After that we erase your name, phone number and e-mail and keep only the feedback itself (outlet, rating, message and dates). If we mark it as spam, your contact details are erased at once.

IP address and browser type

Up to 90 days, then deleted.

You can ask us to erase your details sooner — see your rights.

7Keeping it safe

• The forms send your details over an encrypted (HTTPS) connection.
• Only staff who need your details can see them, and each outlet operator sees only its own outlets’ feedback.
• E-mail alerts to our staff carry only the basics and a link — never your phone number, e-mail or message.
• No system is perfectly secure. If a data breach is likely to cause you significant harm, we will tell you and the Personal Data Protection Commissioner, as the law requires.

8Your rights and choices

Under the PDPA you can ask us to:

• See it — give you a copy of the personal data we hold about you.
• Correct it — fix anything that is wrong, incomplete or out of date.
• Stop — withdraw your consent, stop contacting you, or stop using your details. We may then be unable to carry on with your enquiry or feedback.
• Limit it — stop using your details in a way that causes, or is likely to cause, you damage or distress.
• Move it — send your data to another organisation, where that is technically possible.
• Delete it — erase your details, unless the law says we must keep them.

How to ask: e-mail info@squidboy.my with the subject “Personal data request”. Tell us what you would like and, if you have one, your reference number (it starts with FB- for feedback or FR- for a franchise enquiry). We may ask you to confirm who you are before we act. We will reply within 21 days.

Your choices: the “you may give” details are optional, and on the feedback form you choose whether we may contact you.

9Contact us or complain

Questions about this notice or your personal data: info@squidboy.my.

If you are not happy with our answer, you can complain to the Personal Data Protection Commissioner, Malaysia (Jabatan Perlindungan Data Peribadi) at www.pdp.gov.my (opens in a new tab).

E-mail us

10Changes to this notice

We will update this page when the way we handle your data changes, and change the date at the top. The franchise form records which version of this notice you agreed to.