GamifyGo is operated by Persizt Technology PLT ("we", "us"). This policy explains how we handle personal data when merchants use GamifyGo to run campaigns and when customers take part in those campaigns.
1. Who is responsible for your data
Merchant accounts. We are responsible for the data of merchants and their staff who sign up for and use GamifyGo.
Campaign participants. Each campaign is run by a merchant. The merchant decides what data the campaign collects and how it is used, and we process that data on the merchant's behalf. For questions about a specific campaign, contact the merchant running it, or contact us and we will pass your request on.
2. Data we collect
From merchants
- Business details, outlet information, and account login details
- Contact details of account owners and staff
- Billing and payment records for token purchases
- Campaign settings, prize configuration, and usage activity
From campaign participants
- Name, email address, and phone number
- Date of birth and postcode, where the campaign asks for them
- Receipt images and the details read from them, where the campaign requires a receipt
- Game sessions, entries, prizes won, and voucher redemptions
- Answers to campaign questionnaires, where the campaign includes one
- Records of the consents you give, including the version you agreed to
- Technical data such as IP address, browser type, and device information
3. How we use data
- To run campaigns, check eligibility, and enforce participation limits
- To verify receipts and prevent fraud and duplicate entries
- To award prizes and deliver vouchers by email or messaging
- To give merchants campaign reports and analytics
- To send marketing messages, only where you have separately agreed to them
- To operate, secure, and improve the platform, and to meet legal obligations
4. Consent
Taking part in a campaign and receiving marketing are separate choices. You can join a campaign without agreeing to marketing. We record each consent with its date and the version of the wording you saw. You can withdraw marketing consent at any time by using the unsubscribe link in a message or by contacting us.
5. Receipt verification
When a campaign requires a receipt, we read the uploaded image using automated text recognition (OCR) to check the purchase details. Some receipts are also checked manually by the merchant. We remove personal details that are not needed from receipt data, and we delete receipt images within 90 days of processing unless a dispute or legal requirement means we must keep them longer.
6. Who we share data with
We do not sell personal data. We share it only with:
- The merchant running the campaign you join
- Service providers that help us run GamifyGo, including cloud hosting, email delivery, messaging, receipt OCR, and payment processing providers
- Authorities, where the law requires it
Some service providers may process data outside Malaysia. Where this happens, we take steps to make sure the data receives a comparable level of protection.
7. How long we keep data
We keep personal data only as long as needed for the purposes above. Campaign data is kept for the campaign period and a reasonable time after it for prize fulfilment, disputes, and reporting. Merchants can delete participant data, and we delete or anonymise data when it is no longer needed.
8. Security
We protect data with access controls, encryption in transit, separation of each merchant's data, and audit logs of sensitive actions. No system is completely secure, but we work to prevent unauthorised access, loss, or misuse.
9. Your rights under the PDPA
We handle personal data in line with Malaysia's Personal Data Protection Act 2010 (PDPA). You have the right to:
- Request access to the personal data we hold about you
- Ask us to correct data that is inaccurate, incomplete, or out of date
- Withdraw consent, including consent to marketing
- Ask us to limit how we process your data
- Ask us to delete your data where we no longer need to keep it
To make a request, email us at the address below. We may need to confirm your identity first, and we respond within 21 days.
10. Children
Campaigns may set a minimum age. Participants under 18 should take part only with the permission of a parent or guardian.
11. Changes to this policy
We may update this policy from time to time. When we do, we change the effective date above and, for significant changes, ask for your consent again where required.
12. Contact us
Persizt Technology PLT
Email: [email protected]
In the event of any inconsistency between the English version of this policy and any translation, the English version prevails.