Menu Close
Close
0 items - RM0.00 0
0 items - RM0.00 0

PRIVACY POLICY

Tocar Marketplace

Effective Date: 25 September 2026
Last Updated: 25 September 2026

Tocar Marketplace (“Tocar Marketplace”, “Tocar”, “we”, “us” or “our”) respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how we collect, use, process, disclose, store and protect your personal data when you access or use the Tocar Marketplace website, platform, applications, marketplace services, products and related services (collectively, the “Services”).

This Privacy Policy applies to visitors, registered users, customers, buyers, sellers, merchants, business partners and other individuals who interact with Tocar Marketplace.

Tocar Marketplace is committed to complying with applicable Malaysian data protection laws, including the Personal Data Protection Act 2010 (Act 709) (“PDPA”), as amended from time to time. The Malaysian Personal Data Protection Commissioner identifies privacy notices as an important mechanism for informing individuals about how their personal data is processed.

1. ABOUT TOCAR MARKETPLACE

Tocar Marketplace is an online marketplace that allows users to browse, purchase, sell and otherwise interact in relation to products and services offered through the platform.

The entity responsible for collecting and processing your personal data is:

Tocar Marketplace
Legal Entity: TOCAR SPORTS INTERNATIONAL (M) BHD
Company Registration No.: 202201028559 (1474256-K)
Registered Address: No.905 Block A, Phileo Damansara 1 Petaling Jaya, 46350 Selangor
Website: https://tocar.my
Privacy Email: enquiry@tocar.my
Support Email: enquiry@tocar.my

For purposes of this Privacy Policy, “Tocar Marketplace”, “Tocar”, “we”, “us” and “our” refer to the entity operating Tocar Marketplace.

2. WHAT IS PERSONAL DATA?

For purposes of this Privacy Policy, “personal data” generally means information relating directly or indirectly to an individual who can be identified from that information, whether alone or together with other information in our possession or likely to come into our possession.

Depending on how you use our Services, personal data may include your name, contact information, address, account information, transaction information, payment-related information, technical information and other information described in this Privacy Policy.

3. PERSONAL DATA WE COLLECT

The types of personal data we collect depend on how you interact with Tocar Marketplace.

3.1 Account Information

When you create an account, we may collect:

  • Full name;

  • Username;

  • Display name;

  • Email address;

  • Mobile or telephone number;

  • Password or authentication information;

  • Profile photograph;

  • Account preferences;

  • Account status;

  • Communication preferences.

3.2 Buyer Information

When you purchase products or services through Tocar Marketplace, we may collect:

  • Name;

  • Email address;

  • Telephone number;

  • Billing address;

  • Delivery address;

  • Order information;

  • Product information;

  • Transaction information;

  • Refund information;

  • Customer service communications;

  • Reviews and ratings;

  • Other information necessary to fulfil your order.

3.3 Seller and Merchant Information

If you register as a seller or merchant, we may collect additional information including:

  • Individual or business name;

  • Company registration number;

  • Business address;

  • Business contact details;

  • Seller profile information;

  • Product listings;

  • Product photographs;

  • Product descriptions;

  • Bank or payout information;

  • Tax-related information where required;

  • Business verification information;

  • Identification documents where required;

  • Information relating to your transactions and sales.

3.4 Payment Information

When you make a payment through Tocar Marketplace, payment-related information may be processed by our payment service providers.

Depending on the payment method, this may include:

  • Payment transaction information;

  • Payment method;

  • Transaction amount;

  • Currency;

  • Billing information;

  • Payment status;

  • Transaction reference;

  • Fraud and security information.

Where payment processing is handled by Stripe, sensitive payment credentials such as complete card details may be collected directly by Stripe rather than stored directly by Tocar Marketplace.

3.5 Technical and Device Information

When you use our website or Services, we may automatically collect:

  • IP address;

  • Browser type;

  • Browser version;

  • Operating system;

  • Device type;

  • Device identifiers;

  • Approximate location derived from technical information;

  • Website pages visited;

  • Referring website;

  • Date and time of access;

  • Session information;

  • Log information;

  • Website interaction information.

3.6 Communications

If you contact us, we may collect:

  • Email correspondence;

  • Telephone communications;

  • Chat messages;

  • Customer support requests;

  • Feedback;

  • Complaints;

  • Survey responses;

  • Other communications you provide to us.

3.7 Information You Provide About Other People

If you provide us with personal data belonging to another person, such as a recipient of an order, you are responsible for ensuring that you have the necessary authority or permission to provide that information to us.

4. HOW WE COLLECT PERSONAL DATA

We may collect personal data through:

  1. Account registration;

  2. Purchases and transactions;

  3. Seller registration;

  4. Product listings;

  5. Online forms;

  6. Customer support;

  7. Emails;

  8. Telephone calls;

  9. Chat or messaging functions;

  10. Surveys and feedback;

  11. Competitions and promotional activities;

  12. Cookies and similar technologies;

  13. Our website and applications;

  14. Third-party payment providers;

  15. Delivery and logistics providers;

  16. Business partners;

  17. Publicly available sources; and

  18. Other lawful means.

Where personal data is obtained from another person or organisation, we may take reasonable steps to provide the appropriate notice where required by applicable law.

5. PURPOSES OF PROCESSING PERSONAL DATA

We may collect, use and process your personal data for purposes including the following.

5.1 Providing Marketplace Services

We may use your information to:

  • Create and manage your account;

  • Provide access to Tocar Marketplace;

  • Facilitate purchases and sales;

  • Process orders;

  • Facilitate communication between buyers and sellers;

  • Facilitate delivery;

  • Manage returns and refunds;

  • Manage cancellations;

  • Provide customer support;

  • Handle complaints;

  • Resolve disputes.

5.2 Payment Processing

We may use personal data to:

  • Process payments;

  • Confirm transactions;

  • Process refunds;

  • Facilitate seller payouts;

  • Reconcile transactions;

  • Detect suspicious transactions;

  • Prevent payment fraud;

  • Handle payment disputes and chargebacks.

5.3 Seller Management

For sellers and merchants, we may use information to:

  • Verify seller accounts;

  • Review business information;

  • Process seller applications;

  • Manage product listings;

  • Facilitate sales;

  • Calculate commissions or fees;

  • Process payouts;

  • Monitor marketplace activity;

  • Prevent fraud and abuse;

  • Manage seller performance.

5.4 Security and Fraud Prevention

We may process personal data to:

  • Protect our Services;

  • Detect fraudulent activity;

  • Detect unauthorised access;

  • Prevent abuse;

  • Investigate suspicious transactions;

  • Protect users;

  • Protect our business;

  • Enforce our Terms and Conditions.

5.5 Customer Communications

We may use your information to:

  • Respond to enquiries;

  • Provide customer support;

  • Send order confirmations;

  • Send shipping updates;

  • Send payment notifications;

  • Send account notifications;

  • Notify you about changes to our Services;

  • Communicate important legal or security information.

5.6 Service Improvement

We may analyse information to:

  • Improve our website;

  • Improve marketplace functionality;

  • Improve user experience;

  • Develop new features;

  • Analyse marketplace activity;

  • Identify technical issues;

  • Conduct operational analytics;

  • Improve security.

6. STRIPE PAYMENT PROCESSING

Tocar Marketplace may use Stripe as a third-party payment service provider to process payments and, where applicable, payouts.

Stripe provides payment infrastructure that allows businesses to accept payments and facilitate payouts. Stripe may act as a service provider/data processor for certain activities and may also act as a data controller for other activities depending on the service and circumstances.

When you make a payment through Tocar Marketplace, relevant information may be provided to Stripe as necessary to process, authenticate and complete the transaction.

This information may include:

  • Name;

  • Email address;

  • Billing address;

  • Delivery address where relevant;

  • Transaction information;

  • Order information;

  • Payment method information;

  • IP address;

  • Device or technical information;

  • Information required for fraud prevention;

  • Information required for transaction verification.

Stripe may also receive transaction information relating to payments, refunds, disputes and other activities associated with the transaction. Stripe states that it may receive transaction data when an end customer makes a payment, receives a refund or otherwise transacts with a Stripe business user.

Where applicable, Stripe may share transaction information with financial institutions, payment method providers and other parties necessary to authenticate and process payments, prevent fraud and manage disputes.

Tocar Marketplace does not intend to store complete payment card credentials on its own systems where the payment information is processed directly by Stripe.

However, transaction records and payment status information may be retained by Tocar Marketplace for accounting, customer service, dispute resolution, fraud prevention and legal or regulatory purposes.

For more information about Stripe’s handling of personal data, please review:

Stripe Privacy Policy

Stripe Privacy Center

7. STRIPE CONNECT AND SELLER PAYOUTS

Where Tocar Marketplace uses Stripe Connect to onboard sellers, verify seller accounts or facilitate payouts, additional personal and business information may be processed by Stripe.

Seller information may include:

  • Name;

  • Email address;

  • Telephone number;

  • Business information;

  • Company registration information;

  • Address;

  • Bank account or payout information;

  • Identity verification information;

  • Information relating to the seller’s representatives;

  • Transaction and payout information;

  • Information required for fraud prevention and regulatory compliance.

Stripe may collect information about business users and their representatives for purposes including identity verification, regulatory requirements and fraud prevention.

Where Stripe Connect is used, Stripe may share information with Tocar Marketplace as necessary to provide the marketplace and Connect services. Stripe’s Connected Account Agreement describes data sharing between Stripe, connected accounts and the relevant Connect platform.

Sellers may also be required to provide information directly to Stripe as part of Stripe’s onboarding, verification or payout processes.

Stripe may independently process certain personal data under its own privacy policy and applicable legal requirements.

8. MARKETPLACE BUYER AND SELLER INFORMATION

Tocar Marketplace operates as a marketplace where buyers and sellers may interact.

Certain information may therefore need to be shared between relevant parties to facilitate transactions.

For example, depending on the transaction, sellers may receive information such as:

  • Buyer name;

  • Delivery address;

  • Telephone number;

  • Order details;

  • Product details;

  • Relevant transaction information.

Similarly, buyers may be provided with seller information such as:

  • Seller or store name;

  • Business name;

  • Product information;

  • Seller profile;

  • Public contact information;

  • Reviews and ratings.

Users must not misuse personal information obtained through Tocar Marketplace.

Personal information obtained through the platform must only be used for legitimate purposes connected with the relevant transaction or Services and must not be used for unsolicited marketing, harassment, fraud or other unlawful purposes.

9. DISCLOSURE OF PERSONAL DATA

We may disclose personal data to third parties where reasonably necessary to provide our Services, operate our business, process transactions, protect users or comply with applicable law.

These parties may include:

Payment Providers

Including Stripe and other payment processors used by Tocar Marketplace.

Sellers and Merchants

Where necessary to fulfil purchases and marketplace transactions.

Delivery and Logistics Providers

Including courier and logistics companies responsible for delivering orders.

Relevant information may include:

  • Name;

  • Delivery address;

  • Telephone number;

  • Order information;

  • Delivery instructions.

Technology Providers

We may use third-party providers for:

  • Cloud hosting;

  • Website infrastructure;

  • Databases;

  • Email delivery;

  • SMS;

  • Analytics;

  • Security;

  • Fraud prevention;

  • Customer support;

  • Software services.

Professional Advisers

Including:

  • Lawyers;

  • Accountants;

  • Auditors;

  • Consultants;

  • Insurance providers;

  • Other professional advisers.

Government and Regulatory Authorities

Where disclosure is required or permitted by law.

This may include:

  • Government authorities;

  • Law enforcement agencies;

  • Courts;

  • Regulatory bodies;

  • Tax authorities.

Corporate Transactions

Personal data may be transferred as part of:

  • A merger;

  • Acquisition;

  • Restructuring;

  • Sale of assets;

  • Financing;

  • Corporate reorganisation;

  • Similar business transaction.

10. COOKIES AND SIMILAR TECHNOLOGIES

Tocar Marketplace may use cookies, pixels, web beacons, local storage and similar technologies.

These technologies may be used to:

  • Keep you signed in;

  • Remember preferences;

  • Maintain shopping functionality;

  • Maintain marketplace functionality;

  • Analyse website traffic;

  • Understand website usage;

  • Improve website performance;

  • Detect security issues;

  • Prevent fraud;

  • Personalise certain content;

  • Support marketing activities.

You may configure your browser to reject or delete cookies.

However, disabling certain cookies may affect the functionality of the website.

Where required, we may provide additional cookie controls or consent mechanisms.

11. MARKETING AND PROMOTIONAL COMMUNICATIONS

Where permitted by applicable law, Tocar Marketplace may use your personal data to send information about:

  • Promotions;

  • Products;

  • Services;

  • Discounts;

  • Campaigns;

  • Events;

  • Marketplace announcements;

  • Newsletters.

Marketing communications may be delivered through:

  • Email;

  • SMS;

  • Push notifications;

  • Telephone;

  • Messaging platforms;

  • Other electronic communication channels.

You may opt out of marketing communications at any time.

You may do so by:

  • Clicking the unsubscribe link in marketing emails;

  • Using available account communication settings; or

  • Contacting us using the details in Section 19.

Opting out of marketing communications will not prevent us from sending essential service-related communications, such as order confirmations, payment notifications, security alerts and legal notices.

12. INTERNATIONAL TRANSFER OF PERSONAL DATA

Some of our service providers and technology partners may operate outside Malaysia.

For example, payment processing, cloud infrastructure, analytics or other technology services may involve the processing or storage of personal data outside Malaysia.

Where personal data is transferred outside Malaysia, we will take reasonable steps to ensure that the transfer is carried out in accordance with applicable Malaysian data protection requirements.

This may include using appropriate contractual, organisational or technical safeguards and obtaining consent where required.

Stripe may process personal data internationally as part of providing its services. Stripe’s privacy documentation describes its handling and sharing of personal data across its services and jurisdictions.

13. DATA SECURITY

We take reasonable technical and organisational measures to protect personal data against:

  • Unauthorised access;

  • Unauthorised disclosure;

  • Loss;

  • Misuse;

  • Alteration;

  • Destruction;

  • Accidental disclosure.

Security measures may include:

  • Access controls;

  • Authentication;

  • Encryption where appropriate;

  • Secure hosting;

  • Monitoring;

  • Logging;

  • Security procedures;

  • Employee access restrictions;

  • Technical safeguards.

However, no method of transmission over the internet or electronic storage can be guaranteed to be completely secure.

You are responsible for maintaining the confidentiality of your account credentials.

If you believe your account has been compromised, please contact us immediately.

14. DATA RETENTION

We retain personal data for only as long as reasonably necessary for the purposes for which it was collected, including:

  • Providing our Services;

  • Managing user accounts;

  • Processing transactions;

  • Maintaining financial records;

  • Resolving disputes;

  • Preventing fraud;

  • Enforcing agreements;

  • Complying with legal and regulatory obligations.

Different categories of information may be retained for different periods depending on the purpose and applicable legal requirements.

When personal data is no longer required, we may securely delete, anonymise or otherwise dispose of it in accordance with applicable requirements and our internal procedures.

15. YOUR PERSONAL DATA RIGHTS

Subject to applicable law and any applicable limitations, you may have rights relating to your personal data.

These may include:

15.1 Right to Access

You may request access to personal data that we hold about you.

15.2 Right to Correction

You may request that inaccurate, incomplete or outdated personal data be corrected.

15.3 Right to Withdraw Consent

Where processing is based on consent, you may withdraw your consent, subject to applicable legal or contractual restrictions.

Withdrawal of consent may affect our ability to provide certain Services.

15.4 Right to Object to Direct Marketing

You may request that we stop processing your personal data for direct marketing purposes.

15.5 Right to Data Portability

Where applicable under Malaysian law, you may have rights relating to the portability of your personal data.

15.6 Other Applicable Rights

You may have other rights available under applicable Malaysian data protection legislation and regulations.

The Malaysian Personal Data Protection Commissioner identifies access and information about the purposes and disclosures associated with processing among data-subject rights and protections.

16. HOW TO MAKE A PERSONAL DATA REQUEST

To make a request concerning your personal data, please contact us using the contact details provided in Section 19.

Your request should include sufficient information for us to:

  • Identify you;

  • Understand your request;

  • Locate the relevant personal data.

For security purposes, we may request additional information to verify your identity before processing your request.

We may refuse or limit a request where permitted or required by applicable law.

17. PERSONAL DATA OF CHILDREN

Tocar Marketplace is not intended to knowingly collect personal data from children without appropriate authorisation.

If you believe that a child has provided personal data to us without appropriate consent or authorisation, please contact us.

Where required by applicable law, we will take appropriate steps to address the situation.

18. THIRD-PARTY WEBSITES AND SERVICES

Tocar Marketplace may contain links to third-party websites, applications, payment providers, social media platforms and other services.

These third parties may operate under their own privacy policies.

We are not responsible for the privacy practices, security or content of third-party websites or services.

You should review the applicable privacy policy of any third-party service before providing personal data to that service.

This includes payment and financial services such as Stripe.

19. CONTACT US

If you have questions about this Privacy Policy, wish to exercise your personal data rights, or have a privacy-related complaint, please contact:

Tocar Marketplace
Legal Entity: [FULL LEGAL COMPANY NAME]
Company Registration No.: [COMPANY REGISTRATION NUMBER]
Address: [REGISTERED ADDRESS]

Privacy / Data Protection Email: [PRIVACY EMAIL]
General Support Email: [SUPPORT EMAIL]
Telephone: [PHONE NUMBER]

For personal data requests, please include sufficient information for us to identify you and process your request.

20. PRIVACY COMPLAINTS

If you believe that your personal data has been handled improperly, you should first contact us so that we can investigate and address your concern.

You may also have the right to lodge a complaint with the relevant Malaysian personal data protection authority where applicable.

We will endeavour to investigate privacy complaints and respond within a reasonable period.

21. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect:

  • Changes to our Services;

  • Changes to our business practices;

  • Changes to technology;

  • Changes to security practices;

  • Changes to applicable laws;

  • Changes to regulatory requirements;

  • Changes to our third-party service providers.

When appropriate, we may notify users of material changes through our website, account notifications, email or other appropriate communication channels.

The “Last Updated” date at the beginning of this Privacy Policy indicates when this Privacy Policy was most recently updated.

22. GOVERNING LAW

This Privacy Policy shall be governed by and interpreted in accordance with the laws of Malaysia.

Any dispute relating to this Privacy Policy shall be subject to the applicable laws and jurisdiction of Malaysia.

23. ACKNOWLEDGEMENT

By accessing or using Tocar Marketplace, you acknowledge that you have read and understood this Privacy Policy.

Where consent is required under applicable law, Tocar Marketplace will obtain the appropriate consent before processing personal data for the relevant purpose.

Nothing in this Privacy Policy limits any rights that cannot lawfully be excluded under applicable Malaysian law.

Tocar Marketplace

Website: https://tocar.my
Effective Date: 25 September 2026
Last Updated: 25 September 2026

Cart0
Cart0