Privacy Notice

Warung Pak Din Enterprise (SA0284119-K), trading as Warung Pak Din, is the data user for the personal data described on this page. In everyday terms: the family that cooks your food is also the family that looks after your booking details, and nobody is holding them on our behalf.

Malaysia's Personal Data Protection Act 2010 (PDPA) governs how a business handles personal data in a commercial transaction. This notice explains, in the plainest words we can manage, what we take, why we take it, how long we hang on to it, and what you can tell us to do with it.

A Bahasa Malaysia version of this notice is available at the front counter on request.

Table reservations

Your name, mobile number, the date and time you want, how many people are coming, an email address if you offer one, and anything you type into the special requests box. That box is often used for an allergy, a wheelchair space, a high chair or a birthday, so we treat it as personal. Note where this reaches us from: the booking page on this website submits nothing and stores nothing. What you type there stays in your own browser until you press send, at which point it becomes an ordinary WhatsApp message, or something you read out over the phone. We only hold it once it arrives that way.

Catering enquiries

Your name, a phone number and email we can reply on, the event date, the venue address, the head count and the package you are asking about. Once a job is confirmed we also record the name on the invoice and the bank reference of your deposit.

Messages you send us

Whatever you choose to write to us by email, by WhatsApp, or in a message on our social accounts, including anything you attach to it.

The waiting list

On a busy night the counter writes a first name and a mobile number on a slip so we can call when a table frees up. The slip is destroyed at closing time.

Website logs

Our hosting provider records the ordinary technical lines: IP address, browser type, the page requested and the time. We look at them to keep the site running and to spot abuse, not to work out who you are.

What we never ask for

No card or bank details are entered anywhere on this website. We do not ask for your IC number, we do not ask for your home address unless you want catering delivered to it, and we do not ask about your health beyond a dietary note you choose to volunteer.

• To hold your table, and to call you if something changes at our end: a full house, a burst water main, or a kenduri that has taken over the dining hall.
• To quote, plan, cook and deliver a catering order, and to raise the invoice for it afterwards.
• To cook safely around an allergy or a dietary requirement you have told us about.
• To answer a question, sort out a complaint, or thank you for a kind word.
• To keep the accounting records that Malaysian tax law requires a business to keep.
• Nothing else. We do not build customer profiles, we run no advertising trackers on this site, and we will not add you to a mailing list unless you ask us to.

• A name and a contactable phone number are obligatory for a reservation. Without them we cannot confirm the booking or warn you if the kitchen has a problem, so the booking page will not let you finish a request without them.
• An email address is optional. We confirm by WhatsApp or a phone call as a matter of course; give us an email only if you would rather we wrote than rang.
• Everything else, including the special requests box, is voluntary. Leaving it blank costs you nothing except our advance warning about an allergy.

Reservation records

Twelve months after the booking date, then deleted from the counter phone and the office booking sheet. The paper booking book is kept in the office for the same twelve months and then shredded. Nothing is held by this website, because nothing is sent to it.

Catering and invoices

Seven years. These are accounting records and we are required to be able to produce them.

Emails and WhatsApp

Twenty-four months from your last message, then deleted from the counter phone and from the mailbox.

Waiting-list slips

Destroyed the same night, before we lock up.

Website server logs

Ninety days, then overwritten by our hosting provider.

• Our own people. Only the front-of-house team on shift and the kitchen lead see a booking, and only so they can seat you and cook for you.
• Nobody else, as a rule. We do not sell, rent, swap or lend personal data. We have never handed a customer list to anyone and we do not intend to start.
• Delivery partners are separate from us. When you order through GrabFood or foodpanda you are their customer first: your details live in their system under their own privacy notice, and all that reaches us is the order, the name on it, and sometimes a contact number for the handover.
• Where the law leaves us no choice. A court order, a police investigation, a JAKIM audit or a Ministry of Health request can oblige us to produce a record. If that happens we will comply, and we will tell you unless we are instructed not to.

• The paper booking book lives behind the counter and goes into a locked office drawer overnight.
• The digital booking sheet sits on one password-protected office computer. The counter phone and the manager phone both lock with a passcode.
• Only the manager, the head of front-of-house, and the family who own the warung can open the catering and invoice records.
• Your data stays in Malaysia, with one honest exception: our email and this website are run by service providers whose servers may sit outside the country. We choose providers who commit to a standard of protection comparable to the PDPA, and we send them nothing beyond what the service needs to work.

Right of access

Ask what personal data we hold about you and we will tell you in writing, along with what we have used it for.

Right of correction

If something we hold is wrong, incomplete or out of date, tell us and we will fix it. Correcting a misspelt name or a wrong phone number takes a minute.

Right to withdraw consent

You can tell us to stop using your data at any time. Do note that withdrawing consent for a booking usually means we can no longer hold the table, and withdrawing it midway through a catering job may mean we cannot finish it.

Right to limit use

You can ask us to use your details for the booking itself and nothing further, including any message we might otherwise send about a festive menu.

How to exercise them

• Email pdpa@warungpakdin.com, which reaches the manager rather than the general inbox.
• Call +60 4-588 1984 during opening hours and ask for the manager.
• Write to us at 128 Jalan Warisan, Tasek, 14100 Simpang Ampat, Pulau Pinang, Malaysia.

We aim to answer an access or correction request within twenty-one days, the period the PDPA sets. If a request is complicated and we need longer, we will write and tell you why.

We may ask for something that confirms you are who you say you are, so that we are not handing one person's booking history to somebody else. A name plus the phone number used for the booking is usually enough.

We do not charge a fee for an access or correction request.

• Start with us. Email pdpa@warungpakdin.com and tell us what went wrong. Most problems turn out to be a wrong number in the book and are sorted the same day.
• If you are still not satisfied, you may refer the matter to the Personal Data Protection Commissioner at Jabatan Perlindungan Data Peribadi (JPDP), the department that oversees the PDPA in Malaysia.

This website is not aimed at children. We expect a family booking to be made by an adult, and if you are under eighteen please ask a parent or guardian to make it. If you believe we hold data about a child that was given without a parent knowing, tell us and we will delete it.

This site sets no advertising cookies, no analytics cookies and no third-party trackers of our own. The only storage in play is whatever your own browser needs in order to display the pages. If that ever changes we will say so here first, and we will ask before we start.

There is one exception worth naming. The map on our Contact page is a frame served by OpenStreetMap, so opening that page asks openstreetmap.org for the map tiles and, like any web request, that reaches them with your IP address. We send them nothing else about you, and no other page on this site loads anything from outside our own server. If you would rather not make that request at all, the address and the directions on the Contact page are written out in full text beside the map.

When we change how we handle personal data we will rewrite this page and change the date at the top of it. A material change will also be posted at the front counter for a month, because plenty of our regulars book by walking in rather than by reading a website.