Privacy notice

Personal Data Protection Act 2010 (Malaysia) · Last updated 4 August 2026

This notice is issued under the Personal Data Protection Act 2010 (“PDPA”) by Lovani (“we”, “us”), operating from Kuala Lumpur, Malaysia. It explains what personal data we collect on lovani.co, why, and your rights. A Bahasa Malaysia version of this notice is available on request.

1. What we collect

• Order data — your name, email, phone/WhatsApp number, shipping address, ring size, and what you ordered.
• Registry data — the owner name registered to each certificate (yours, or the recipient’s if the ring is a gift).
• Contact data — your name, email, and message when you write to us.
• Technical data — basic server logs (IP address, pages requested) kept for security, and a session cookie that remembers your cart and currency choice. We do not run advertising trackers.

We do not collect or store card numbers or online-banking credentials. Payment happens entirely on the secure pages of Billplz (FPX) or Stripe (cards).

2. Why we collect it

• To make, register, ship, and support your ring — including warranty service
• To maintain the Lovani Registry, which permanently records each ring’s specification and owner
• To send you transactional emails about your order (confirmations, receipts, shipping, certificates)
• To answer your enquiries and keep records required by law (tax, accounting)
• To protect the Site and registry against fraud and abuse

Providing this data is voluntary, but without it we cannot process an order or register a certificate.

3. The registry and what is public

Anyone with a certificate number can look it up on our verification page. The public record shows the ring’s specification and a masked owner name (for example “A***a T.”) — never your full name, contact details, or address. The full record is held privately by us. Owner records are permanent by design and are not altered after registration; see our refund & warranty policy.

4. Who we share it with

We share only what each provider needs to do its job, and we never sell personal data:

• Payment — Billplz (Malaysia) and Stripe (may process data outside Malaysia)
• Email delivery — Brevo, to send transactional emails
• Shipping — the courier delivering your order receives your name, address, and phone number
• Authorities — where disclosure is required by Malaysian law

Some of these providers store data outside Malaysia; by ordering, you consent to that transfer as permitted by the PDPA.

5. How long we keep it

• Order and payment records — at least 7 years, as required for tax and accounting
• Registry records — permanently, because permanence is the purpose of the registry
• Contact messages — as long as needed to resolve your enquiry

6. Security

Data is transmitted over HTTPS and stored with access limited to those who need it. Certificate lookups are rate-limited and public results are masked. No system is perfectly secure, but we treat your data the way we treat the registry: carefully.

7. Your rights under the PDPA

You may request access to your personal data, ask us to correct it, or withdraw consent to processing (which may mean we can no longer provide certain services — and note that registered certificate records are permanent by design, though we can mask or annotate on request in genuine cases). To exercise these rights, contact us or email hello@lovani.co with the subject “PDPA request”. We may verify your identity before acting, and we will respond within 21 days.

8. Changes

If this notice changes materially, the date above changes with it. Continued use of the Site after a change means you accept the updated notice.