Privacy Policy

The Piggy Thai Food & Mookata

Operated by: Actually Thai Sdn Bhd

Effective date: 26 July 2026

Last updated: 26 July 2026

1. Introduction

Actually Thai Sdn Bhd, trading under the brand name “The Piggy Thai Food & Mookata” (“The Piggy”, “we”, “us” or “our”), respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how we collect, use, disclose, store and protect your personal data when you:

visit thepiggy.my;
create or use a customer account;
place an online order;
make a payment;
request delivery or collection;
contact our customer service team; or
otherwise interact with The Piggy Thai Food & Mookata.

We process personal data in accordance with the Personal Data Protection Act 2010 of Malaysia, including applicable amendments, regulations, standards and guidelines (“PDPA”).

By using our website or submitting your personal data to us, you acknowledge that you have read and understood this Privacy Policy. Where consent is required by law, we will obtain your consent before processing the relevant personal data.

2. Data Controller

The data controller responsible for personal data collected through The Piggy Thai Food & Mookata online shop is:

Actually Thai Sdn Bhd

Trading as: The Piggy Thai Food & Mookata

Company registration number: 20200100213 (1306532-K)

Address: 15-1F (First Floor) Jalan USJ10/1D,

Taipan Business Centre, 47620,

Subang Jaya, Selangor, MALAYSIA

Email: account@thaiessential.com.my

Telephone: 1700-82-9164

Operating hours: Monday - Friday (10am - 6pm)

3. Personal Data We Collect

Depending on how you use our website and services, we may collect the following information.

3.1 Customer account information

Full name;
Email address;
Mobile telephone number;
Username or customer account identifier;
Encrypted account password;
Saved delivery addresses;
Account preferences; and
Account creation and login information.

3.2 Order and delivery information

Products ordered;
Order date and time;
Order value;
Special instructions;
Delivery or collection method;
Delivery address;
Recipient’s name and telephone number;
Delivery status;
Order history;
Promotion or voucher information; and
Information relating to cancellations, complaints, replacements or refunds.

3.3 Payment and transaction information

Payments on our website are processed through Razorpay Curlec.

We may receive or retain limited payment-related information such as:

Payment status;
Transaction or payment reference number;
Payment date and amount;
Selected payment method;
Masked payment instrument information;
Refund status; and
Fraud or risk assessment information provided to us.

Full card numbers, CVV numbers, online banking passwords, PINs and one-time passwords should be entered only through the secure Razorpay Curlec payment interface. We do not intentionally collect or store these sensitive payment credentials on our own systems.

3.4 Communications

We may collect information contained in:

Customer enquiries;
Emails, telephone calls or messages;
Complaints and feedback;
Refund or cancellation requests;
Reviews submitted to us;
Photographs or supporting evidence relating to an order; and
Communications through social media or messaging applications.

3.5 Technical and website information

When you access our website, we may automatically collect:

Internet Protocol address;
Browser type and version;
Device type;
Operating system;
Login and session information;
Pages viewed;
Date and time of access;
Referring website;
Website activity;
Cookie identifiers; and
Security and fraud-detection information.

4. How We Collect Personal Data

We may collect personal data:

Directly from you when you register, order, pay or contact us;
Through your customer account;
Automatically through cookies, server logs and similar technologies;
From Razorpay Curlec in connection with payment processing;
From delivery or logistics providers;
From website hosting, e-commerce and technology service providers;
From our customer-service channels; and
From authorities or other lawful sources where permitted or required by law.

5. Purposes of Processing

We may collect, use and process your personal data for the following purposes:

Creating and administering your customer account;
Processing and confirming orders;
Preparing, packaging and delivering your order;
Contacting you regarding your order;
Processing payments through Razorpay Curlec;
Confirming successful or unsuccessful payments;
Processing cancellations, refunds, payment reversals and disputes;
Providing customer support;
Responding to enquiries, feedback and complaints;
Verifying transactions and preventing fraud;
Protecting our website, customers and business;
Maintaining accounting, taxation and transaction records;
Managing promotions, vouchers and customer benefits;
Improving our menu, website, services and customer experience;
Conducting internal reporting and business analysis;
Complying with applicable laws, regulatory requirements, court orders and requests from authorities;
Establishing, exercising or defending legal rights; and
Carrying out any other purpose directly related to the purposes stated above.

Where information is required to process an order, payment or delivery, failure to provide the information may prevent us from completing your transaction.

6. Razorpay Curlec Payment Processing

Razorpay Curlec is our online payment gateway provider.

When you select payment at checkout, certain information may be sent directly to or collected by Razorpay Curlec, participating banks, payment networks or other payment service providers.

Razorpay Curlec may process information including:

Your name and contact information;
Transaction amount;
Order or payment reference;
Payment method;
Card, FPX, online banking or e-wallet information;
Device and technical information;
Information required for payment authentication;
Fraud-prevention information; and
Refund and dispute information.

Razorpay Curlec processes personal data under its own privacy notice and applicable terms. We encourage customers to review Razorpay Curlec’s current privacy notice and payment terms before completing payment.

Razorpay Curlec is a payment facilitator and is not the seller of our food or products. Questions relating to orders, products, delivery, cancellations and merchant-initiated refunds should be directed to The Piggy Thai Food & Mookata.

We will never ask you to disclose your online banking password, card PIN, CVV number or one-time password by telephone, email, social media or messaging application.

7. Disclosure of Personal Data

We may disclose personal data, where reasonably necessary, to:

Razorpay Curlec;
Banks, card networks, FPX operators, e-wallet providers and other payment participants;
Delivery riders, logistics companies and delivery service providers;
Website hosting and e-commerce platform providers;
Cloud storage, software, IT security and technical support providers;
Customer communication and messaging service providers;
Our related companies, where necessary for administration or support;
Accountants, auditors, insurers, lawyers and professional advisers;
Government departments, regulatory authorities, law-enforcement agencies or courts;
A purchaser, investor or adviser involved in a proposed corporate restructuring, sale or transfer of our business; and
Any other person where disclosure is authorised or required by law.

We do not sell or rent customer personal data to third parties.

Service providers processing personal data on our behalf are expected to use the information only for authorised purposes and to implement appropriate confidentiality and security measures.

8. Delivery Information

Where you request delivery, we may share the following information with the assigned delivery provider:

Recipient’s name;
Delivery address;
Contact telephone number;
Order reference;
Delivery instructions; and
Information reasonably required to complete the delivery.

Delivery providers may process this information under their own privacy notices and operating terms.

9. Cookies and Similar Technologies

Our website may use cookies and similar technologies to:

Keep you signed in;
Maintain your shopping cart;
Remember your preferences;
Process checkout;
Protect customer accounts;
Detect fraud or suspicious activity;
Understand website usage;
Improve website performance; and
Analyse customer interactions with our website.

You may control or disable cookies through your browser settings. However, disabling essential cookies may prevent certain website functions, including account login, cart management and checkout, from operating correctly.

10. Direct Marketing

We may send promotional emails or messages only where:

You have provided the necessary consent;
You have subscribed to our marketing communications; or
The communication is otherwise permitted by applicable law.

You may unsubscribe at any time by:

Using the unsubscribe function in the relevant communication;
Updating your account preferences; or
Contacting us at info@thaiessential.com.my.

Unsubscribing from marketing communications will not prevent us from sending transactional messages concerning your account, payment, order, delivery, cancellation or refund.

11. Security

We take reasonable administrative, organisational, physical and technical measures to protect personal data against:

Loss;
Misuse;
Unauthorised access;
Unauthorised disclosure;
Alteration;
Destruction; and
Other unlawful processing.

These measures may include restricted access, password protection, encryption, secure connections, access logging, staff controls and the use of reputable payment and technology providers.

No method of internet transmission or electronic storage is completely secure. We therefore cannot guarantee absolute security.

Customers are responsible for keeping their account password confidential and must notify us promptly if they believe their account has been accessed without authorisation.

12. Personal Data Breaches

Where we become aware of a personal data breach, we will investigate and take reasonable steps to contain and address the incident.

Where required by applicable law, we will notify the Personal Data Protection Commissioner and affected individuals within the applicable legal period.

13. Retention

We retain personal data only for as long as reasonably necessary to:

Complete the purposes described in this Privacy Policy;
Maintain customer and order records;
Meet accounting, taxation and regulatory requirements;
Resolve complaints, refunds or payment disputes;
Prevent fraud; and
Establish, exercise or defend legal claims.

Different categories of personal data may be retained for different periods. When personal data is no longer required, we will take reasonable steps to delete, destroy or anonymise it, subject to our legal and operational obligations.

Deleting a customer account may not result in immediate deletion of transaction records that we are required to retain by law.

14. International Transfers

Some of our payment, website, cloud, technical or service providers may process or store information outside Malaysia.

Where personal data is transferred outside Malaysia, we will take reasonable steps to ensure that the transfer is permitted under applicable law and that appropriate data protection and confidentiality measures are in place.

15. Your Rights

Subject to the PDPA and any applicable exceptions, you may have the right to:

Ask whether we hold or process your personal data;
Request access to your personal data;
Request correction of inaccurate, incomplete or outdated personal data;
Withdraw consent where processing is based on consent;
Request that certain processing be limited;
Prevent processing for direct-marketing purposes;
Request data portability where applicable; and
Submit a complaint regarding our processing of your personal data.

To exercise these rights, contact us at [insert privacy email address].

We may need to verify your identity before processing a request. A reasonable fee may be charged where permitted by law.

Withdrawal of consent will not affect processing already carried out lawfully. It may also affect our ability to provide services that require the relevant personal data.

16. Personal Data Belonging to Other People

Where you place an order for another person or provide another person’s name, address or telephone number, you confirm that:

The information is accurate;
You are authorised to provide it to us; and
The person has been informed that their information will be used for order fulfilment and delivery.

17. Children

Our online shop is not specifically directed at children.

A person placing an order must have legal capacity to enter into the transaction or must place the order with the knowledge and permission of a parent or legal guardian.

18. External Websites

Our website may contain links to third-party websites or services. We are not responsible for the privacy, security or content practices of third-party websites.

Customers should review the privacy policies of those third parties before providing personal information.

19. Changes to This Privacy Policy

We may amend this Privacy Policy to reflect changes in:

Our services;
Our website;
Our business practices;
Payment or delivery arrangements; or
Legal and regulatory requirements.

The latest version will be published on our website with the revised effective date. Material changes may also be communicated through the website or other appropriate channels.

20. Contact Us

For privacy enquiries, access or correction requests, complaints or withdrawal of marketing consent, contact: