Your data. Only what we need.

GEARHALO, based in Malaysia, is the data user responsible for the personal data collected through this store. This policy is written to meet the Personal Data Protection Act 2010 (PDPA). Questions go to support@cresdo.com.

Depending on how you use the store, we may collect:

• Contact and delivery details: name, email, phone number, delivery address
• Order details: what you bought, order value, order history
• Payment confirmation: the result of the payment and the last digits of the card — never the full card number
• Account details: your email and password, stored encrypted, if you create an account
• Technical data: IP address, browser and device type, pages viewed, and how you reached the site
• Messages you send us by email or through the contact form

• To take payment, pack your order and get it delivered
• To send order confirmations, tracking and delivery updates
• To handle refunds, guarantee claims and support requests
• To screen orders for fraud and keep the store secure
• To understand which pages work and improve the store
• To send marketing email, only if you have asked for it
• To meet our tax, accounting and legal obligations

We do not sell your personal data, and we do not use it to make automated decisions about you.

We process your data to perform the sales contract you entered into, to meet legal duties such as record keeping, for our legitimate interest in running a secure and functioning store, and — for marketing and non-essential cookies — on your consent. You can withdraw consent at any time.

We share only what each provider needs to do its job, and only with:

• Payment providers, to authorise and settle your payment
• Couriers and logistics partners, to deliver your parcel
• Our ecommerce and hosting platform, which runs this store
• Email and analytics providers, to send order mail and measure site usage
• Professional advisers and authorities, where the law requires it

Some of these providers process data on servers outside Malaysia. Where that happens we rely on providers that apply protection comparable to the PDPA.

Order and payment records are kept for seven years to meet Malaysian tax and accounting requirements. Account data is kept until you ask us to close the account.

Marketing consent records are kept until you unsubscribe, and support emails for two years after the conversation ends.

Under the PDPA you may ask us to:

• Give you access to the personal data we hold about you
• Correct data that is wrong, out of date or incomplete
• Stop using your data for marketing
• Limit how we process your data, or delete it where we are not required to keep it
• Withdraw a consent you previously gave

Email support@cresdo.com and we will respond within twenty-one days. We may ask you to confirm your identity first.

The store runs over an encrypted connection, passwords are stored hashed, and access to order data is limited to the people who need it. Card details are handled entirely by our payment provider and never reach our systems. No system is perfect, so if a breach ever affects your data we will tell you promptly.

We use essential cookies to keep your cart and checkout working, and optional cookies for analytics and marketing that only run if you accept them. Full detail, and the switch to change your mind, is on our cookie policy page.

This store is intended for adults. We do not knowingly collect data from children under eighteen. If you believe a child has given us their data, contact us and we will delete it.

If we change how we handle personal data we will update this page and move the date at the top. Significant changes affecting your rights will be announced by email where we have your address.