This Privacy Policy & Terms ("Terms") govern your use of the MIX-LAH rewards programme operated by GFB FOOD SDN. BHD. (Company No. 201301019685 / 1049515-D), the legal brand owner of MIX-LAH ("we", "our", "us"). This application framework is technically developed and maintained by our appointed data processor, GREATPRODX SDN. BHD. By submitting your personal details through this portal, you expressly agree to the terms outlined below.

1. What we collect

When you claim a MIX-LAH voucher, we securely collect:

• Your name, WhatsApp/mobile phone number, and complete delivery address (street, postcode, city, state).
• The specific MIX-LAH beverage or dessert premix powder flavour profile purchased.
• System-generated transaction data including voucher codes issued, timestamps, device IP addresses, and browser types collected strictly for fraud prevention.

2. Why we collect it

We process your personal data strictly under the following lawful purposes:

• To verify your consumer identity and deliver your RM3 reward voucher.
• To send transactional notifications (SMS/WhatsApp OTP verifications and fulfilment updates).
• To improve our beverage selections through secure, anonymized data analytics.
• To prevent system abuse, duplicate claims, or fraudulent activity.
• To comply with the Malaysian Personal Data Protection (Amendment) Act 2024.

3. Marketing communications

We enforce a strict anti-spam policy. We will not send you promotional marketing messages unless you separately and explicitly tick the opt-in checkbox. This agreement governs transactional messaging only.

4. Authorized third-party data processors

To operate this portal securely, your data is shared exclusively with our appointed technical processors under strict data protection agreements:

• GreatProdx Sdn. Bhd. (Malaysia): Appointed software application developers and systems maintenance operators.
• Supabase Inc. (Singapore region servers): Secure, encrypted cloud database hosting infrastructure.
• Vercel Inc.: Application deployment and front-end cloud hosting router.
• MoceanAPI Sdn. Bhd. (Malaysia): Gateway handler for secure SMS/WhatsApp transactional OTP routing.

We do not sell, rent, or trade your personal consumer data to external advertisers, brokers, or third-party marketing networks.

5. Data retention & minimization

To ensure compliance with the PDPA data minimization framework, your personal information is stored for a maximum of 12 months from the date of voucher submission. Upon reaching Day 365, your records are automatically and permanently purged from our live production databases.

6. Infrastructure security safeties

We protect consumer data using enterprise-grade security protocols: all data transfers are encrypted in transit via forced HTTPS/TLS 1.3 pipes, data is locked via AES-256 encryption at rest, and database tables strictly enforce Row-Level Security (RLS) managed by GreatProdx Sdn. Bhd. to block unauthorized data manipulation.

7. Reward voucher terms

• The RM3 reward voucher is single-use, non-transferable, and carries no cash value.
• The voucher expires exactly 7 days from the issued date.
• Redeemable exclusively via the official MIX-LAH website (mixlah.com.my) or authorized flagship e-commerce distribution nodes.
• Strictly limited to one (1) voucher redemption per unique individual, mobile number, and delivery address. Duplicate submissions will be automatically invalidated.

8. Your legal rights under the Malaysian PDPA

Under the Personal Data Protection framework of Malaysia, you maintain full statutory rights to:

• Access and request a digital copy of the personal data we hold.
• Request immediate correction of inaccurate or outdated contact data.
• Request early permanent erasure of your profile records from our databases.
• Exercise data portability rights to obtain your data in a structured, machine-readable format.

To exercise these rights, please contact our data compliance team directly at administration@gfbfood.com. We will process and respond to verified requests within twenty-one (21) days.

9. Minors

This promotional rewards platform is intended strictly for users aged 18 and above. We do not knowingly collect information from minors.

10. Governing law

These Terms are governed exclusively by the laws of Malaysia, and any unresolved disputes shall fall under the jurisdiction of the Malaysian courts.

11. Contact & corporate identity

GFB Food Sdn. Bhd.
Email: administration@gfbfood.com
Corporate Portal: mixlah.com.my

This policy is provided as a starting point and should be reviewed by qualified Malaysian legal counsel before being relied upon in production. Drafted for GREATPRODX SDN. BHD. (MIX-LAH), 22 May 2026.