Privacy Policy

Last updated October 2026

Your privacy is important to us.

This Privacy Policy explains our policy on collecting, using and disclosing your Personal Information in accordance with the Personal Data Protection Act 2010 (“PDPA”) as amended by the Personal Data Protection (Amendment) Act 2024, and the laws of Malaysia. The Personal Information which you provide to us now or from time to time or have provided to us previously will be used and processed, and continued to be used and processed by us, in accordance with this Privacy Policy (as amended, varied or revised from time to time). By providing your Personal Information to us, you are consenting to this Privacy Policy and the collection, use, access, transfer, storage and processing of your Personal Information as described in this Privacy Policy. We may amend, vary or revise this Privacy Policy from time to time. If we revise the Privacy Policy, we will post the changes on our website.

In this Privacy Policy:

• “Loob” means Loob Holding Sdn Bhd (Registration No.: 201001021759 (905529-P)).
• “Loob Group” means Loob Holding Sdn Bhd and its subsidiaries, related and associate companies, including but not limited to Notable Paramount Sdn Bhd.
• “DPC” means the Data Protection Committee of Loob Group, which oversees all data protection and privacy matters on behalf of Loob Group. The DPC may be contacted at dataprotection@loob.com.my.
• “Personal Information” means any information in our possession or control that relates directly or indirectly to you (or any other individual) to the extent that you (or such other individual) are identified or identifiable from that information or from other information in our possession.
• “Products and Services” means any products or services offered by Loob or Loob Group, including the Tealive, Bask Bear Coffee & Toasties and SodaXpress brands.
• “We”, “us” or “our” means Loob and, where applicable, all subsidiaries of Loob Holding Sdn Bhd.
• “You” or “your” means any individual whose Personal Information is collected or processed by us in connection with our Products and Services.

1. Personal Information

1.1 What we collect from you

In order for us to provide you with our Products and Services, we may require you to disclose certain Personal Information, such as:

• personal details such as your name, identity card number, age, gender, nationality, date of birth, address, telephone number, email address, geolocation at time of using the apps, and other details;
• information in connection with Products and Services you have purchased from us or have registered with us for purchase, services, information, updates or inquiries;
• personal interests or preferences such as language, product or content interests, and communication and marketing preferences;
• your username, password, profile picture and other identifiers used to access the Tealive or Bask Bear Coffee and Toasties mobile application;
• payment information, including bank account or debit and credit card details, when you make payment through our outlet counter, mobile application and/or your e-wallet;
• your image or photo, captured by way of video surveillance installed at our premises as part of our security infrastructure;
• information about your general interests and browsing activity, by way of cookies stored on your computer or mobile phone when you visit our website or use our mobile application; and
• any other information that has been or may be collected by us or which you provide to us from time to time in connection with any service, transaction, contest, survey, promotion, questionnaire, form or communication with us.

1.2 How your Personal Information is collected

Your Personal Information may be collected directly from you or your authorised representatives, including:

• when you sign up to purchase our Products and Services or register your interest to obtain information, services or updates;
• when you set up an account on the Tealive or Bask Bear Coffee and Toasties mobile application;
• when you visit our website or social networking pages;
• when you enter contests, marketing events or respond to surveys, promotions or questionnaires;
• when you fill in prize claim forms;
• when you are present at our outlets, offices or other premises where video surveillance is in operation;
• from third-party sources such as credit reference agencies, fraud prevention agencies, publicly available sources, or our brand and business partners; and
• pursuant to any transaction, inquiry or communication made with or to us.

1.3 Purpose of collecting and processing your Personal Information

Your Personal Information will be processed by us, or by such third parties as may be engaged by us (including affiliates, sponsors, partners, auditors, consultants, lawyers, advisors and government bodies), for the following purposes:

• to process your application, inquiry or request;
• to provide our Products and Services to you, including providing you with information and updates;
• for administrative and internal operations purposes, including product development, training, testing, research, troubleshooting, accounting and payment, and to facilitate administration and management in connection with commercial transactions;
• to respond to your queries and provide customer service;
• to produce data, reports and statistics which have been anonymised or compiled in a manner that does not identify you as a specific individual;
• to monitor and improve our Products and Services;
• to manage and administer our loyalty programmes, including the Tealive and Bask Bear Coffee and Toasties loyalty programmes;
• to comply with applicable laws, regulatory requirements, proceedings or inquiries from regulatory authorities and enforcement agencies;
• to enforce and defend any of our legal rights;
• to maintain records required for security, claims or other legal purposes;
• to market and promote products and services offered by us or our partners from time to time, where you have consented to receive such communications; and
• any other purpose as we may reasonably determine from time to time, to the extent permitted by applicable law.

1.4 Sensitive Personal Data

We do not, as a matter of course, collect information categorised as sensitive personal data from you through our standard Products and Services. Sensitive personal data includes information relating to medical history and health conditions, biometric characteristics, racial or ethnic origin, religious beliefs, political opinions and the commission or alleged commission of any offence. In the event that the collection of such information becomes necessary for a specific purpose, we will inform you clearly of that purpose and seek your explicit consent before collecting or processing any such information.

1.5 Children’s Privacy Notice

We offer many features and services on our websites and app, including promotions and contests. Where a person below the age of 18 signs up for our apps or participate in our services, we are mindful of the additional care required when Personal Information. In this regard, we will seek explicit consent and only collect the minimum Personal Information reasonably necessary for that specific activity in order to complete our obligations and services.

Personal Information collected from an underage person is used solely for the purpose for which it was collected, and is not used for unrelated marketing or profiling. We may share such information with service providers who help us administer the services, on the same restricted basis.

A parent or guardian may contact us to review, request deletion of, or object to further collection or use of their child’s Personal Information, by writing to us at the contact details in Section 8 below.

1.6 Necessity of collection

It is necessary for us to collect and process your Personal Information in order to effectively provide our Products and Services to you. If you choose not to supply us with your Personal Information, do not consent to this Privacy Policy, or withdraw your consent, we may not be able to provide you with certain Products and Services, or at all.

1.7 Data retention

We will retain your Personal Information for as long as is necessary to fulfil the purposes for which it was collected, for the duration of your relationship with us, or for such further period as may be necessary to protect our interests or as required by applicable law. Upon expiry of the applicable retention period, we will dispose of your Personal Information securely.

1.8 Your consent

By providing your Personal Information to us, you consent to the use of that Personal Information as set out in this Privacy Policy. Where you have indicated your consent to receiving marketing or promotional communications from us, you consent to our use of your Personal Information for that purpose. You may withdraw your consent at any time by contacting us at dataprotection@loob.com.my or by selecting the unsubscribe option in any marketing communication. Withdrawal of consent does not affect the lawfulness of any processing carried out before the withdrawal.

2. Disclosure of Personal Information

To facilitate the purposes set out in this Privacy Policy and the provision of our Products and Services, there may be situations where we are required or permitted to disclose your Personal Information to the following classes of third parties:

• companies within Loob Group;
• regulatory authorities and enforcement agencies;
• any court of law or any relevant party in connection with any claim or legal proceedings;
• individuals, companies or organisations that act as our contractors, service providers, consultants, advisors or professional consultants, including without limitation auditors, lawyers and IT service providers;
• companies or organisations that assist us in processing your transactions and payments; and
• franchise partners of Loob Group, where your Personal Information relates to transactions or services provided through a franchise outlet.

We do not sell, rent or trade your Personal Information to any third party for their own marketing or commercial purposes.

3. Cookies and Online Tracking

When you visit our website or use our mobile application, we may place cookies and similar tracking technologies on your device. Cookies are small text files that help us recognise your device, remember your preferences and understand how you interact with our digital platforms. We use four categories of cookies:

• strictly necessary cookies, which are essential for the website or application to function and cannot be disabled;
• functional cookies, which allow us to remember choices you have made, such as your preferred language or region;
• analytics cookies, which help us understand how visitors use our website and application so that we can improve our services; and
• marketing cookies, which are used to deliver advertising relevant to your interests and to measure the effectiveness of our marketing campaigns.

When you first visit our website, you will be presented with a cookie consent notice. You may accept all cookies, accept only strictly necessary cookies, or manage your preferences by category. You may also manage or disable cookies at any time through your browser settings. Disabling certain cookies may affect the functionality of our website or application.

4. Video Surveillance

We operate video surveillance cameras at our outlets, offices, warehouses and other premises for the purposes of security, safety and loss prevention. Visible notices are displayed at all entry points to our premises where cameras are in operation. Recordings are retained for 30 days and then automatically overwritten, unless the footage is required in connection with a security incident, investigation or legal matter, in which case it may be retained until the conclusion of those proceedings. Access to footage is restricted to authorised personnel only. If you wish to request access to footage in which you appear, please contact us at dataprotection@loob.com.my.

Please take note that our video surveillance systems record footage for security and safety purposes only. We do not use facial recognition or other biometric analytics on this footage, and it is not used to identify individuals beyond manual review by authorised personnel where necessary for a security incident or investigation.

5. Transfer of Personal Information Outside Malaysia

Where it is necessary for us to do so, your Personal Information may be transferred to, stored or processed by entities outside Malaysia, including by our service providers and technology platforms whose servers are located in other countries. Any such transfer is carried out in compliance with the requirements of the PDPA 2010 as amended, including the cross-border transfer provisions that took effect on 1 April 2025. We take reasonable steps to ensure that any recipient of your Personal Information outside Malaysia is bound by obligations to protect your Personal Information to a standard equivalent to that required under the PDPA 2010.

6. Links to Other Websites

Our website and mobile application may contain links to the websites of our subsidiaries, franchise partners or other third parties for your convenience and reference. Such linked websites are not subject to this Privacy Policy, and we do not accept any responsibility or liability for the content or the privacy practices of those websites. We encourage you to read the privacy policy of any website you visit.

7. Your Rights

Subject to the provisions of the PDPA 2010 as amended, you have the following rights in respect of your Personal Information held by us:

• the right to be informed about how your Personal Information is collected, used and disclosed;
• the right to request access to your Personal Information (section 30, PDPA);
• the right to request correction of any Personal Information that is inaccurate, incomplete, misleading or not up to date (section 34, PDPA);
• the right to withdraw your consent to any use of your Personal Information at any time, without affecting the lawfulness of processing carried out before the withdrawal (section 38, PDPA);
• the right to request that we limit or cease processing of your Personal Information in certain circumstances (section 38, PDPA); and
• the right to request that your Personal Information be transmitted to another organisation in a machine-readable format, where technically feasible (section 43A, PDPA, as amended 2024).

To exercise any of these rights, please contact us in writing as set out in section 8 below. On receipt of your request, we may require you to provide proof of identity and such additional information as may be necessary to verify your identity before we process your request. We will respond to your request within 21 days of receipt.

8. How to Contact Us

Loob has appointed a Data Protection Officer (DPO) in accordance with Section 12A of the PDPA. Our DPO is responsible for overseeing our compliance with the PDPA and can be contacted directly at the contact details below.

If you have any questions or feedback relating to your Personal Information or this Privacy Policy, would like to withdraw your consent, or would like to request access to or correction of your Personal Information, please contact our Data Protection Committee as follows:

You may also opt out from receiving marketing or promotional material at any time by selecting the “unsubscribe” option in our emails or by contacting us at dataprotection@loob.com.my.

9. Updates to this Privacy Policy

We may amend, vary or revise this Privacy Policy from time to time to reflect changes in applicable law, our processing activities, or guidance issued by the Personal Data Protection Commissioner. If we revise this Privacy Policy, we will post the updated version on our website and, where appropriate, notify you through our mobile application or by email. Continued use of our Products and Services following notification of any revision constitutes your acceptance of the revised Privacy Policy. The current version of this Privacy Policy is available at www.loob.com.my.

This policy is published by Notable Paramount Sdn Bhd as part of the Loob Group. The current Group version is maintained at loob.com.my.