Privacy Policy

Data Controller

The data controller responsible for personal data described in this policy is TONEGRADE STUDIO SDN. BHD., registered in Malaysia (Registration No. 202601041914 (1704009-D)), with its registered address at Level 9, Integra Tower, 348, Jalan Tun Razak, Kampung Datuk Keramat, 50400 Kuala Lumpur, Wilayah Persekutuan Kuala Lumpur, Malaysia.

Personal Data We Collect

Depending on how you interact with us, we may collect: your full name; business or creator name (the person or business to which a licence is issued); email address, which we use to deliver your purchase and to contact you about service orders; phone number; order details including product codes, licence type and quantity; the images, footage or other files you send us when you order a creative service, and any notes or style references that come with them; records of delivery, such as the emails, download links and cloud links we send you; and any other information you choose to include in an enquiry, checkout submission or order note.

We do not ask for a postal or shipping address, because everything we sell is delivered digitally.

How We Collect Data

We collect personal data directly from you when you build a cart and submit a checkout on this website, submit our contact form, email or call us, send us files for a service order, or otherwise communicate with us in the course of placing or discussing an order. We do not purchase personal data from third-party data brokers or list vendors.

Purpose of Processing

We use personal data to: process your order and confirm payment; deliver your download links and account access details by email; collect your files and carry out creative services you have ordered, and return the finished files; record the creator or business a licence is issued to; issue receipts or invoices; respond to enquiries and provide customer support, including re-sending files; handle refund requests under our Refund Policy; and, where you have given consent, tell you about new products.

Images and Footage You Send Us

If you order a creative service, the images, footage or other content you send us may include people other than you. You confirm that you own the content or have the right to send it to us for editing, and that you have any consents needed from people who appear in it. We use the content only to carry out your order, keep it for as long as needed to complete the work and handle any follow-up or dispute, and then delete it or return it to you, subject to the retention period below for business records. We do not publish client content or use it in our own marketing without asking you first.

Legal Basis Under the PDPA

We process personal data on the basis that you have provided it voluntarily for the purpose of placing an order, obtaining a licence or service, or otherwise engaging with us, which constitutes consent under the Personal Data Protection Act 2010 of Malaysia (“PDPA”), and because processing is necessary to perform a contract with you or to take steps at your request before entering into one. Where we rely on consent for optional communications, such as marketing updates, you may withdraw that consent at any time as described under “Your Rights”.

Sharing With Third Parties

We share personal data only where necessary to fulfil your order or as required by law, including with: our online payment gateway provider (AXAIPAY), to process your payment; email, cloud file-transfer and website hosting providers that help us deliver your files, collect your service files and operate this website; and our accounting and banking service providers, to keep financial records. We do not sell personal data to third parties for their own marketing purposes.

Cart, Checkout & Order Data

This website’s cart is stored in your own browser’s local storage and is not transmitted to us until you submit the checkout form. When you submit checkout, your name, email, phone number, order description and total are sent to our payment gateway provider so that your payment can be processed; card, bank and e-wallet details are entered on the payment provider’s pages and are never stored by us. The contact form generates an enquiry reference and a plain-text summary on your device, which you then choose to send to us by email.

Data Retention

We retain personal data for as long as necessary to fulfil the purpose it was collected for, to keep delivery and licence records, to satisfy accounting and tax record-keeping obligations under Malaysian law (generally seven years from the relevant transaction), and to resolve any dispute or defend a legal claim. Enquiry data that does not result in an order is retained for a reasonable period to allow follow-up, after which it is deleted or anonymised if no further engagement occurs.

Data Security

We apply reasonable administrative and technical safeguards to protect personal data against unauthorised access, alteration, disclosure or destruction, including restricting access to customer records and client files to those who need them to perform their role. Download links, cloud links and account access are intended for the purchaser only. No method of transmission or storage is completely secure, and while we work to protect personal data, we cannot guarantee its absolute security.

Your Rights

Under the PDPA, you have the right to request access to the personal data we hold about you, to request correction of inaccurate data, and to withdraw any consent you previously gave for us to process your data for a particular purpose, including marketing communications. To exercise any of these rights, contact us using the details under “Contact”. We will respond within a reasonable time and in accordance with the requirements of the PDPA, noting that withdrawing consent may affect our ability to continue providing services that depend on that data, such as re-sending a download link or finishing a service order.

Cookies & Website Analytics

This website does not use advertising or third-party tracking cookies, but it loads its typefaces from Google Fonts and, on the contact page, an embedded Google Map, so your browser (and its IP address) connects to Google’s servers when those load. It may use strictly necessary technical functions required for the site to display and function correctly, and your browser’s local storage to remember the contents of your cart and your preferred shop layout. If we introduce analytics or marketing cookies in the future, this section will be updated to describe them and, where required, to obtain your consent before they are set.

Children’s Privacy

Our products and services are for adult creators and businesses. We do not knowingly collect personal data from children, and any personal data submitted to us is expected to belong to an adult, or to be submitted by an adult authorised to act on behalf of their organisation.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our data practices or legal obligations. We encourage you to review this page periodically.

Contact

Questions, access requests or complaints about how we handle personal data can be directed to tone_grade@outlook.com or +6010-434 4057. Our registered address is Level 9, Integra Tower, 348, Jalan Tun Razak, Kampung Datuk Keramat, 50400 Kuala Lumpur, Wilayah Persekutuan Kuala Lumpur, Malaysia.