StoreHub Pay Privacy Notice
Payment Facilitation Services
About this document
This Privacy Notice explains how StoreHub Pay Sdn Bhd collects, uses, shares, and protects personal data in connection with StoreHub Payments, our card payment facilitation service. The StoreHub point-of-sale platform is covered by its own separate privacy policy, published by its operating entity. Your consents to the processing described here are captured on the StoreHub onboarding platform through the Merchant Consent Form, presented before any verification checks are run; the Merchant Agreement is accepted separately, after your application is approved.
1. Who We Are and Who This Applies To
1.1 Data Controller
The data controller for personal data processed in connection with StoreHub Payments is:
StoreHub Pay Sdn Bhd
Company No. 202601017817 (1679914-X)
Level 7, Mercu 3, No. 3, Jalan Bangsar, KL Eco City, 59200 Kuala Lumpur
Email: dpo@storehubpay.com
Website: https://www.storehub.com
1.2 Who This Applies To
This Notice applies to anyone whose personal data we process in connection with StoreHub Payments — including owners, directors and individual shareholders of onboarded businesses, Authorised Representatives who complete onboarding, and any other individuals whose personal data StoreHub Pay receives in managing a merchant account. If you complete the application on behalf of your business, you should make sure these individuals are aware that their data will be processed as described in this Notice.
This Notice does not apply to Shoppers (the end customers who make payments at merchants’ Payment Terminals). Shopper data is processed by Adyen MY under Adyen’s own privacy framework.
1.3 Our Role Alongside Adyen MY
StoreHub enters into the Merchant Agreement on behalf of, and as agent of, Adyen Malaysia Sdn Bhd (“Adyen MY”) in respect of the regulated payment processing component of the service, which is carried out by Adyen MY as the licensed acquirer. Some of the data we collect is shared with Adyen MY, who processes it as an independent data controller for payment processing and regulatory compliance purposes; Adyen MY’s privacy policy is available at https://www.adyen.com/policies-and-disclaimer/privacy-policy.
1.4 Language
This Notice is published in English and Bahasa Malaysia, as required by Malaysia’s Personal Data Protection Act 2010, as amended by the Personal Data Protection (Amendment) Act 2024 (the “PDPA”). If there is any inconsistency between language versions, the English version prevails for interpretation purposes.
2. What Data We Collect
This Notice is concerned with personal data — information relating to identifiable individuals. Business records are described below only because they may contain or constitute personal data, including where your business is a sole proprietorship or partnership. In connection with StoreHub Payments we collect the following, including:
- Business and account information — application details, transaction and settlement records, and communications with us;
- Bank account data, verified from the bank statement page you upload;
- Identity documents and a biometric verification of the applicant, and identity documents of directors or shareholders where we request them;
- The names, addresses, identification numbers and other information relating to all directors and all individual shareholders (regardless of shareholding percentage), obtained from company registry, credit-bureau and screening data sources, together with their screening results and credit data obtained from CTOS with your consent under the Credit Reporting Agencies Act 2010;
- Payment card details for purchases you make from StoreHub (such as hardware);
- Login and device data;
- Records we generate: risk assessment records and records of our compliance decisions and account administration; and
- Any other information or documents that you provide at our request, or that we receive from our verification and screening providers, in connection with your application or account.
A note on biometric data
Biometric data is sensitive personal data under the PDPA and is processed with the applicant’s explicit consent, captured at onboarding through the Merchant Consent Form. It is processed by our e-KYC provider as our data processor and is not retained on StoreHub’s systems.
Provision of the data described in this Section is obligatory for using StoreHub Payments. If you do not provide it, or if a consent required to process it is withdrawn, we will not be able to onboard your business, or we may have to suspend the service.
3. Why We Collect Your Data and How We Use It
We process this data to verify and screen your business and its principals (identity and e-KYC, sanctions and adverse-media screening, credit assessment, bank account verification, and periodic reviews); to process payments and settle funds and manage your account; to detect and prevent fraud and financial crime and meet our legal and regulatory obligations (including reporting and card scheme requirements); to secure and administer our services; to provide, develop and improve StoreHub group products and services; and for group administration.
Legal grounds. Our processing rests on your consent, captured through the Merchant Consent Form (including consent under the Credit Reporting Agencies Act 2010 to credit checks and the applicant’s explicit consent to biometric processing), performance of our contract with you, and compliance with legal obligations under Malaysian law.
Regulatory reporting. StoreHub and/or Adyen MY may be required by law to make reports to regulators (including suspicious transaction reports) concerning activity on your account, without notice to you. Such reports are confidential, and StoreHub is not permitted by law to tell you when one has been or will be made. Such reporting is a legal obligation and is not an indication of wrongdoing.
4. Who We Share Your Data With
We share your data with the following parties and classes of parties:
- Adyen Malaysia Sdn Bhd and its group — our acquirer, an independent data controller;
- StoreHub group companies;
- Registered credit reporting agencies (including CTOS) and company registry sources;
- Our vendors, service providers and professional advisers, acting for us (in Malaysia or abroad), including verification, screening, technology, communications and payment providers;
- Airwallex Malaysia Sdn Bhd (settlement);
- The card networks (Visa and Mastercard) — including, where an account is terminated for cause, their terminated-merchant databases, which the networks operate as independent controllers and retain under scheme rules; a listing may affect your ability to accept card payments elsewhere, and if you believe a listing is incorrect you should contact the relevant card network; and
- Bank Negara Malaysia, regulators and law enforcement where required by law.
Cross-border data transfers
Your data may be transferred to, and stored and processed in, locations outside Malaysia — by StoreHub Pay, other StoreHub group companies, and our service providers — including in jurisdictions where we and they operate (which currently include the United Kingdom, the European Union, Switzerland and the United States). Such transfers are made as permitted under section 129 of the PDPA — to jurisdictions with substantially similar protections, under contractual safeguards, with your consent, or as necessary for the performance of our contract with you.
5. How Long We Keep Your Data
We keep your data only for as long as necessary for the purposes described in this Notice, and for at least the periods required by applicable law (including anti-money laundering, company and tax law) for financial records, after which it is securely destroyed or anonymised. Biometric verification data is not retained on StoreHub’s systems.
6. How We Protect Your Data
We apply practical and appropriate technical and organisational measures to protect your data, including encryption, access controls and obligations on our staff. If we have reason to believe that a personal data breach has occurred affecting your data, we will notify the Personal Data Protection Commissioner (JPDP) as soon as practicable and in any case within 72 hours of becoming aware of the breach, as required by section 12B of the PDPA. Where the breach is likely to cause significant harm to you (including risks of financial loss, identity theft, physical harm, reputational damage, or other serious adverse consequences), we will also notify you without unnecessary delay and no later than 7 days after notifying JPDP. Notification to you will be made by email to your registered account address or, where that is not possible, by other appropriate means. We maintain an incident response process to detect, contain, and assess breaches in accordance with our obligations under the PDPA.
7. Your Rights Under Malaysian Data Protection Law
The PDPA gives you the following rights in relation to your personal data processed by StoreHub Pay:
| Right | What It Means |
|---|---|
| Right of access | You may request a copy of the personal data StoreHub holds about you. Access may be refused or limited where permitted or required by law, including for records connected with crime prevention or detection or regulatory reporting obligations. |
| Right to correct | You may ask us to correct inaccurate or incomplete personal data. |
| Right to withdraw consent | Where processing is based on consent, you may withdraw it at any time by writing to dpo@storehubpay.com. Processing required by law, or necessary to perform our contract with you, will continue after a withdrawal. Because the consents captured at onboarding are required to operate your account, withdrawing them may mean we cannot continue to provide StoreHub Payments. |
| Right to prevent processing likely to cause damage or distress | You may require us to stop (or not begin) processing that is causing, or is likely to cause, substantial damage or distress to you or another person that is unwarranted, as provided under the PDPA. |
| Right to prevent processing for direct marketing | We do not use your compliance data for marketing. Transactional data is not used for direct marketing without informing you and providing an opt-out. Offers of other StoreHub group products and services are made subject to the same opt-out. You may opt out of direct marketing at any time. |
| Right to data portability | You may request that your personal data be transmitted to another data user in a structured, commonly used, machine-readable format, where technically feasible. |
To exercise any of these rights, please contact our Data Protection Officer at dpo@storehubpay.com. We will respond within 21 days as required by the PDPA. In some cases — particularly where processing or retention is required by law — we may not be able to accommodate a request in full, and we will explain why.
8. Automated Systems
StoreHub uses automated tools and systems in onboarding, risk management, fraud prevention, sanctions and compliance screening, and transaction monitoring. You acknowledge that these automated controls may result in holds, suspensions, declines, settlement delays, or account restrictions, in some cases without prior notice and without prior human review, where StoreHub considers this necessary to comply with applicable law, Card Scheme rules, or its obligations to its acquiring and banking partners. You may query any such action by contacting dpo@storehubpay.com; StoreHub may not always be able to review an action or disclose its reasons, including where prevented by law.
9. Changes to This Notice
We may update this Privacy Notice from time to time. Material changes will be notified to you with reasonable notice before they take effect — or sooner where a change is required by law, a regulator, the Card Schemes or our acquirer — and the current version will be available at https://www.storehub.com/storehubpay/privacy.
10. Contact Us
If you have any questions about how we handle your personal data in connection with StoreHub Payments, or to exercise your PDPA rights, please contact:
Data Protection Officer
Email: dpo@storehubpay.com
General StoreHub Payments queries and support
Email: care@storehub.com
Address: Level 7, Mercu 3, No. 3, Jalan Bangsar, KL Eco City, 59200 Kuala Lumpur
To report a suspected compromise of your account or data, contact compliance@storehub.com.
If you are not satisfied with our response to a data protection query or complaint, you may raise a complaint with Malaysia’s Department of Personal Data Protection (JPDP) at https://www.pdp.gov.my or through the Personal Data Protection Commissioner.
Version 6.5 — Effective 23 June 2026
Version history
Version 6.5, updated 9 October 2026: the Data Protection Officer’s email is now dpo@storehubpay.com.