Privacy policy

Privacy Policy

Last updated: 29 April 2026

1. Data Controller

Celsius Coffee Sdn. Bhd. operates the Celsius Coffee Loyalty Programme, the order.celsiuscoffee.com web service, and the Celsius Coffee mobile applications for iOS and Android. This policy explains how we collect, use, and protect your personal data in accordance with the Personal Data Protection Act 2010 (PDPA) of Malaysia.

2. Data We Collect

•Phone number — required for account identification and OTP verification

•Name — for personalisation (optional)

•Email — for communications (optional)

•Birthday — for birthday rewards (optional)

•Transaction history — points earned, redeemed, and visit records

•Push notification token — device-specific identifier used solely to deliver order status notifications and rewards alerts

•Device and diagnostic data — OS version, app version, crash logs, and anonymous usage events used to maintain app stability

We do not collect precise location, contacts, photos, or any advertising identifiers. We do not track you across other companies' apps or websites.

3. How We Use Your Data

•To manage your loyalty points and rewards

•To send OTP codes for account verification

•To send promotional SMS (only with consent; opt out anytime)

•To provide birthday rewards and special offers

•To send order status push notifications — only with your permission

•To improve our services through aggregated analytics

4. Third-Party Data Sharing

We share limited data with:

•SMS providers (SMS123 / SMS Niaga) — your phone number and message content

•Supabase — cloud database for secure data storage

•Apple Push Notification service (APNs) and Firebase Cloud Messaging (FCM) — only the device push token is shared

We do not sell your personal data to any third party.

5. SMS Marketing & Opt-Out

You may receive promotional SMS messages. You can opt out at any time by informing staff at any outlet or contacting us. Opting out of marketing will not affect your loyalty account or transactional messages (such as OTP codes).

6. Data Retention

We retain your personal data for as long as your loyalty account is active. OTP codes are automatically deleted after verification or expiry. SMS logs are retained for 90 days for troubleshooting. You may request deletion at any time.

7. Your Rights (PDPA Sections 12 & 13)

•Access — know what personal data we hold

•Correction — request corrections to your data

•Deletion — request deletion of your account and data

•Withdraw Consent — for marketing communications at any time

8. Data Security

We implement appropriate security measures including encrypted connections (HTTPS), hashed passwords and PINs, and access controls on our systems.

9. Account & Data Deletion

Email barista@celsiuscoffee.com from the address linked to your account, or visit any Celsius Coffee outlet with photo ID. We will permanently delete your account, points balance, transaction history, and push tokens within 30 days of a verified request.

10. Children's Privacy

The Celsius Coffee app is not directed to children under 13. We do not knowingly collect personal data from children under 13.

11. Contact Us

For any enquiries about your personal data, contact us at any Celsius Coffee outlet or email barista@celsiuscoffee.com.

Celsius Coffee Sdn. Bhd.
D-U-N-S: 47-329-1793

Published in compliance with the Personal Data Protection Act 2010 (Act 709) of Malaysia.