Privacy Notice

AvaEra is the data user. AVAERA SDN BHD · No. Syarikat 202501012345 · No 8, Jalan Prima Niaga 3, 81550 Johor Bahru, Johor, Malaysia · support@avaera.world. If you have any question about this notice or want to exercise any right in it, contact us using those details.

• Account details — name, username, email address, phone number, password (stored only as a cryptographic hash, never readable by us).
• Identity and payout details — IC or passport number, bank name, account name and account number, needed to verify you and to pay commission.
• Address — for delivery of the goods you redeem.
• Beneficiary details — if you choose to record one: their name, relationship, contact details and identification number. You are responsible for telling that person you have given us their details.
• Transaction records — orders, wallet movements, commission, withdrawals, redemptions, and your position in the referral network.
• Technical data — IP address and activity logs, kept for security and fraud prevention.

• To operate your account, process orders and deliver goods.
• To calculate and pay commission, which requires sharing limited details with your upline (see section 4).
• To verify identity, prevent fraud and secure the platform.
• To meet our legal, tax and accounting obligations.
• To contact you about your account, orders and deliveries. These are service messages and are not marketing — you cannot opt out of them while you hold an account.
• With your consent, to send you marketing (see section 5).

We disclose your data only as follows:

• Your upline. Because commission depends on the network, the members above you can see limited details about you — your name, username, joining date, rank, and the sales volume attributed to your team. They cannot see your bank details, your IC number, your password, your wallet balances, or your beneficiary.
• Service providers who help us operate: hosting, email delivery, and couriers who need your name, address and phone number to deliver.
• Authorities and professional advisers where we are required by law or need to establish or defend a legal claim.

We do not sell your personal data. Some of our service providers operate outside Malaysia, and where data is transferred abroad we take steps to ensure it remains protected to a comparable standard.

With your consent we will use your email address, phone number and purchase history to send you marketing about our products, promotions, new launches and events, and to decide which of those are likely to be relevant to you.

That consent is asked for separately when you register, as its own unticked box. Ticking it is optional and refusing it does not affect your account, your ability to buy, or your commission.

You can withdraw consent at any time from your profile, or by contacting us. We will stop sending marketing. Service messages about your account, orders and deliveries will continue while your account is open, because we need them to provide the service you asked for.

We keep your account data while your account is open. After it closes we keep what we must for legal, tax and audit purposes — commission and order records in particular — and delete or anonymise the rest. Financial records are generally kept for seven years.

Under the PDPA you may:

• Ask for a copy of the personal data we hold about you.
• Ask us to correct it if it is inaccurate, incomplete or out of date. Much of it you can correct yourself in your profile.
• Withdraw your consent to marketing.
• Ask us to limit how we process your data, subject to our legal obligations.

We may need to verify your identity before acting on a request, and a fee may apply to a data access request as permitted by the PDPA. If you are not satisfied with our response you may complain to the Personal Data Protection Commissioner.

Passwords are stored hashed and never in a readable form. Access to personal data is restricted to staff who need it, and changes to sensitive records are logged. No system is perfectly secure, so please use a strong, unique password and tell us immediately if you think someone else has used your account.

The PDPA requires this notice to be made available in English and Bahasa Malaysia. The Bahasa Malaysia version is being prepared and is not yet published. We have chosen to state that plainly rather than publish a machine translation of a legal document. In the meantime, if you would like this notice explained in Bahasa Malaysia or Chinese, contact us and we will help.