Privacy Policy

This policy explains how Dink City collects, uses and protects your personal data, in line with Malaysia's Personal Data Protection Act 2010 (PDPA).

Data we collect

• Account details: name, email, phone number.
• Booking and credit history, session preferences.
• Payment proof: the QR payment receipts you upload for verification.
• Marketing preference (whether you opted in).
• Event and workshop registrations: which you reserved a place at, whether you attended, and what you paid for your seat.

How we use it

• To create your account and manage your bookings and credits.
• To verify payments and issue confirmations and receipts.
• To contact you about your bookings and, if you opt in, events and offers.
• To run workshops you register for, take attendance, and keep a record of the fee owed and collected.

Events

Events are run by Dink City rather than by an individual coach, so a registration is visible to our administrators and to nobody else. Other people looking at an event page see only how many places are left — never who has taken them, and never any contact details. If you pay an entry fee, we hold the payment receipt you upload on the same terms as any other receipt described below.

Workshops & coaches

Registering for a workshop requires an account, and it shares specific information with the coach running that workshop: your name, email address and phone number, along with your attendance and whether you have paid for your seat. They need it to know who is coming, to reach you if the session changes, and to collect the fee afterwards.

That is all a coach sees. They cannot see your other bookings, your credit balance, your payment receipts, or any workshop you registered for with a different coach. Other people registered for the same workshop see only how many seats are left — never who has taken them. Our administrators can see workshop registrations as part of running the facility and reconciling payments.

Website analytics

We measure how this website is used so we know which pages help people book and where they get stuck. This is done with Vercel Web Analytics and Speed Insights, which record the page visited, the site that referred you, and general device and country information.

These analytics use no cookies and no advertising identifiers, and they do not follow you to other websites. The measurements are aggregated: they tell us that a page was viewed, not who viewed it, and they are not joined to your account, your bookings or your payments.

We do not use Google Analytics, advertising pixels or any third-party tracking or profiling service. If that ever changes, we will update this policy and ask for your consent first.

Storage & sharing

Your data is stored securely with our infrastructure providers. Those that process personal data on our behalf are Supabase (database and file storage), Resend (email), Vercel (website hosting and the analytics described above), Upstash (short-lived one-time codes and abuse limits) and Cloudflare (Turnstile, which checks that a sign-in or sign-up is made by a person rather than a bot). Some of these necessarily see your IP address in order to serve or protect the site. Payment receipts are kept in private storage accessible only to authorised staff. We do not sell your data. We share it only as needed to run the service or where required by law.

Retention

We keep booking, workshop and financial records — including attendance and the fees owed and collected — for seven years. That is the period Malaysian law requires business and accounting records to be kept (Income Tax Act 1967 and Companies Act 2016).

After that, if you have not used Dink City for seven years, we anonymise your account automatically: your name, email address and phone number are removed and replaced with a permanent placeholder. The underlying financial records remain, but they are no longer linked to a person. This happens on a schedule — you do not have to ask.

One exception, stated plainly: a receipt or credit note is a frozen record of a transaction and its buyer, and we are required to keep it for seven years. The name on a receipt already issued is not removed by anonymising your account. Malaysian data-protection law permits keeping personal data where another law requires it, and this is that case.

Your rights

You may request access to, correction of, or deletion of your personal data, and you may withdraw marketing consent at any time. To make a request, contact us.