NYRA Skin Privacy Policy

Last updated: 24 October 2026

ABOUT THIS POLICY

This policy explains what personal data we collect, why we collect it, and how we protect it. It follows the Personal Data Protection Act 2010 (PDPA), including the 2024 amendments.

NYRA Skin is a brand owned and operated by NIRO ENTERPRISE (SSM Reg. No: 202303038429 (003467784-P)), a business registered in Malaysia. In this policy, "we", "us" and "our" mean NIRO ENTERPRISE, the data controller for your personal data.

The policy applies when you visit our website, order from us, message us on WhatsApp, follow us on social media, or join our membership or agent programme. Orders on the official NYRA Skin TikTok Shop are also handled by TikTok under its own privacy policy.

By using our website or giving us your personal data, you agree to this policy. A Bahasa Melayu version is available on request. If the two versions differ, the English version applies.

PERSONAL DATA WE COLLECT

• Contact details: name, phone number, email, delivery address

• Order details: products bought, order history, amounts paid, delivery records

• Payment details: payment receipts you send us, the payer name on bank transfers, bank details you give us for refunds, and transaction records from CHIP once it is live

• Membership details: date of birth (for the birthday discount), membership status, spend history

• Agent details: sales records, order counts, bank details for commission payouts

• Messages and claims: WhatsApp and email messages, photos or videos you send for refund claims

• Health information: details of a skin reaction, only if you choose to tell us about one

• Technical data: IP address, browser and device type, pages visited, cookies

Most of this comes directly from you. Some comes from our website automatically, and some comes from service providers such as CHIP, couriers and TikTok Shop.

Health information is sensitive personal data under the PDPA. We collect it only with your explicit consent and use it only to handle your claim.

You do not have to give us your personal data. If you don't, we may not be able to process your order, refund or membership.

PAYMENTS

Bank transfer and DuitNow QR (current)

When you pay by bank transfer or DuitNow QR, we see the payer name, amount and reference on our bank statement, plus the receipt you send us. We use these only to confirm your payment and keep accounting records. We never ask for your online banking username, password or TAC.

CHIP (coming soon)

CHIP will soon be our official payment gateway. When it is live, you will enter your card or online banking details on CHIP's secure checkout page or your bank's own page, not on our website.

We do not see or store your full card number, CVV or banking login. CHIP sends us only what we need to manage your order, such as the transaction reference, amount, payment method, payment status and the name and email you entered.

CHIP processes your payment data under its own privacy policy and security standards, available at chip-in.asia. Your bank, card issuer or e-wallet provider may also process your data under their own terms.

HOW WE USE YOUR DATA

• To process, deliver and support your orders

• To confirm payments and send refunds

• To run the membership and agent programmes, including birthday discounts, member prices and commission payouts

• To answer your questions and handle claims

• To keep our website working and secure, and to understand how it is used

• To meet our legal, tax and accounting duties

• To send you offers and product updates, only if you agree. You can opt out at any time by replying STOP on WhatsApp or using the unsubscribe link in our emails.

WHO WE SHARE IT WITH

We do not sell your personal data. We share it only as needed with:

• Couriers and delivery partners, to deliver your parcel

• CHIP, banks and payment providers, to process payments and refunds

• Website hosting, IT and analytics providers who help run our website

• Meta (WhatsApp) and TikTok, when you contact us or buy through their platforms

• Our accountants, auditors and legal advisers

• Government authorities, courts or regulators, when the law requires it

Some of these providers store data outside Malaysia. When that happens, we take the steps the PDPA requires to keep your data protected.

HOW LONG WE KEEP IT

• Order, payment and refund records: 7 years, to meet tax and accounting rules

• Membership and agent records: while you are active, then up to 2 years after

• Claim photos, videos and health details: until the claim is closed, then up to 12 months

• Marketing contact details: until you opt out

After that, we delete or anonymise your data.

HOW WE PROTECT IT

We limit access to people who need it for their work, use password-protected systems, and keep our website on secure HTTPS. If a data breach is likely to cause significant harm, we will notify the Personal Data Protection Commissioner and the people affected, as the PDPA requires.

YOUR RIGHTS

Under the PDPA, you can ask us to:

• Give you a copy of the personal data we hold about you

• Correct data that is wrong, incomplete or out of date

• Stop using your data for direct marketing

• Withdraw your consent to our use of your data

• Send your data to another organisation, where this is technically possible

To make a request, contact us using the details below. We will reply within 21 days. We may need to confirm your identity first, and we may charge a fee where the PDPA allows it. Withdrawing consent may mean we can no longer provide some services, such as membership.

COOKIES

Our website uses cookies to keep it working, remember your cart and understand how visitors use the site. We may use analytics and advertising tools such as [Google Analytics or Meta Pixel]. You can block or delete cookies in your browser settings, but some parts of the site may stop working.

CHILDREN

Our website and programmes are meant for people aged 18 and above. If you are under 18, please ask a parent or guardian to order for you.

CHANGES TO THIS POLICY

We may update this policy, including when CHIP goes live. The date at the top shows the latest version. If we make a major change, we will post a notice on our website.

CONTACT US

NIRO ENTERPRISE

SSM Reg. No: 202303038429 (003467784-P)

WhatsApp: +60196160798

If you are not satisfied with our response, you can contact the Personal Data Protection Department (JPDP) at www.pdp.gov.my.