Privacy
Privacy Policy
Last updated: May 25, 2026
Need to make a request?
Read the policy, then use the data-rights route.
The Data Rights Portal starts an access, correction or deletion request and records when we have to respond by.
The policy
What we collect, and what you can ask us to do with it.
Introduction
Shoo Lab ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and services, including when you sign in using Google authentication.
By using our services, you agree to the collection and use of information in accordance with this policy.
Information We Collect
Personal Information
When you create an account or use our services, we may collect the following information:
- Account Information: Name, email address, and profile picture (when signing in with Google)
- Contact Information: Phone number and address (when you provide them for order delivery or communication)
- Order Information: Details about your orders, including item types, service preferences, and order history
- Payment Information: Payment method and transaction records (note: we do not store full credit card numbers)
Information from Google Sign-In
When you choose to sign in with Google, we receive access to your:
- Google account email address
- Name associated with your Google account
- Profile picture (if available)
We use this information solely to create and manage your Shoo Lab account. We do not access your Google contacts, emails, calendar, or any other Google services data.
Automatically Collected Information
When you visit our website, we may automatically collect:
- Device information (browser type, operating system)
- IP address and general location
- Pages visited and time spent on our site
- Referring website or source
How We Use Your Information
We use the information we collect to:
- Create and manage your account
- Process and fulfill your orders
- Send order updates and notifications via WhatsApp, SMS, or email
- Provide customer support and respond to inquiries
- Improve our services and user experience
- Send promotional communications (with your consent)
- Maintain our loyalty and rewards programs
- Comply with legal obligations
How We Share Your Information
We do not sell your personal information. We may share your information with:
- Service Providers: Third-party companies that help us operate our business (e.g., payment processors, SMS/WhatsApp providers, hosting services)
- Franchise Partners: If you use services at a franchise location, relevant order information may be shared with that outlet
- Legal Requirements: When required by law or to protect our rights and safety
Data Security
We implement appropriate technical and organizational security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. However, no method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security.
Data Retention
We retain your personal information for as long as your account is active or as needed to provide you services. We may retain certain information as required by law or for legitimate business purposes. You can request deletion of your account and personal data at any time by contacting us.
Your Rights
Under data protection laws, you have the right to:
- Right to Access: Request a copy of all personal data we hold about you
- Right to Rectification: Request correction of inaccurate information
- Right to Erasure: Request deletion of your personal data (subject to legal retention requirements)
- Right to Data Portability: Receive your data in a machine-readable format
- Right to Withdraw Consent: Opt-out of marketing communications at any time
- Right to Object: Object to processing of your data for specific purposes
- Revoke Google account access at any time through your Google Account settings
To exercise any of these rights, please visit our Data Rights Portal or contact us using the information below. We will respond to your request within 30 days.
Cookies and Tracking
We use cookies and similar tracking technologies to enhance your experience on our website. We categorize cookies as follows:
- Essential Cookies: Required for the website to function properly (always enabled)
- Analytics Cookies: Help us understand how visitors use our site (Google Analytics, Microsoft Clarity) - requires your consent
- Marketing Cookies: Used to deliver personalized promotions - requires your consent
You can manage your cookie preferences at any time through our cookie consent banner or by clearing your browser cookies and revisiting our site.
Malaysia Data Protection Compliance
Shoo Lab Bintulu operates in Malaysia and complies with the Personal Data Protection Act 2010 (Act 709) ("PDPA Malaysia"), including the seven Personal Data Protection Principles:
- General Principle: We process personal data only with your consent and for lawful purposes directly related to our shoe and bag care services.
- Notice and Choice Principle: We inform you in writing (this Policy) about the purpose of collection, your rights, and how to contact us.
- Disclosure Principle: We do not disclose your personal data for purposes other than those notified, except with your consent or where permitted by law.
- Security Principle: We take practical steps to protect personal data from loss, misuse, unauthorised access, modification, or disclosure.
- Retention Principle: Personal data is kept only as long as necessary to fulfil the purpose collected, or as required by Malaysian law.
- Data Integrity Principle: We take reasonable steps to ensure personal data is accurate, complete, not misleading, and kept up-to-date.
- Access Principle: You may request access to and correction of your personal data at any time.
We respond to all data access, correction, and deletion requests within 21 days as required by PDPA Malaysia. Complaints can also be lodged with the Department of Personal Data Protection (JPDP), Ministry of Digital, Malaysia.
Third-Party Services
We use the following third-party services that may process your data:
- Google Analytics: Website analytics (anonymized IP)
- Microsoft Clarity: User experience analytics
- Twilio: SMS and WhatsApp messaging services
- Google OAuth: Authentication services
Each of these services has their own privacy policies. Analytics services are only activated after you provide consent.
Children's Privacy
Our services are not intended for children under 13 years of age. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.
Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last updated" date. We encourage you to review this policy periodically.
Contact Us
If you have any questions about this Privacy Policy or our data practices, please contact us: