PRIVACY POLICY

English Version

Effective Date: 21^st October 2026

Last Updated: 21^st October 2026

Platform Operator: PROACEX GLOBAL MARKETING

1. Introduction

My Happy Meal (“Platform”, “we”, “us” or “our”) is a digital platform designed to support school meal planning, ordering, payment administration, absence reporting, and related school and canteen operations.

This Privacy Policy explains how we collect, use, disclose, store, protect and otherwise process personal data when you access or use the Platform.

We are committed to handling personal data responsibly and in accordance with applicable Malaysian personal data protection laws, including the Personal Data Protection Act 2010 (“PDPA”), as amended, where applicable.

This Policy applies to parents and guardians, students whose information is submitted through the Platform, Canteen Owners, School Administrators, System Administrators and other authorised users.

By using the Platform, you acknowledge that you have been given access to this Policy. Where consent is required by law, we will obtain it through the appropriate consent process.

2. Who Is Responsible for Your Personal Data?

The Platform is operated by:

Legal Entity: PROACEX GLOBAL MARKETING

Privacy Contact Email: proacex.group@gmail.com

For the purposes of this Policy, “Platform Operator” refers to the legal entity identified above.

The Platform Operator's role depends on the circumstances of the processing. We may determine the purposes and means of processing certain information for account administration, platform security, billing, customer support and service improvement. In other circumstances, we may process information on behalf of a participating school or other organisation under its instructions and the applicable agreement.

Schools and Canteen Owners may also have their own responsibilities for personal data they collect or use independently. Their processing may be subject to their own privacy notices and legal obligations.

This Policy does not automatically make the Platform Operator responsible for every independent processing activity carried out by a school, Canteen Owner, payment provider or other third party.

Nothing in this section excludes any responsibility that the Platform Operator has under applicable law.

3. Personal Data We May Collect

The types of personal data collected depend on your role, the features you use and the information necessary to provide the relevant services.

3.1 Parents and Guardians

We may collect:

• Name, email address, telephone number and login credentials or authentication records.
• Account preferences, including language selection.
• Information about children linked to the account, such as name, class, school and relevant meal arrangements.
• Meal selections, order history, absence reports, credit records and payment status.
• Customer service enquiries, complaints and communications.
• Consent records and account security information.

3.2 Students and Children

Information about children may include:

• Name, class and assigned school.
• Parent or guardian association.
• Meal plans, orders, portions, add-ons and relevant service records.
• Absence reports and eligible credit records.

Parents or guardians should provide only information they are authorised to provide. Please do not submit unnecessary medical, identity or other sensitive information through the Platform.

3.3 Canteen Owners

We may collect:

• Individual and business names, contact details and business information.
• Account credentials, role and assigned school.
• Menu, pricing, meal availability and order-management records.
• Transaction, payment reconciliation and operational records.
• Communications, support requests and consent records.

3.4 School Administrators and System Administrators

We may collect:

• Names, contact details, account identifiers and login records.
• School or organisation affiliation, assigned role and access permissions.
• Administrative activities, system logs, audit records and security events.
• Support communications and relevant consent or authorisation records.

3.5 Payment and Technical Information

Depending on the services implemented, we may process:

• Order totals, payment status, transaction references, refund records and reconciliation information.
• Device, browser, IP address, access time, diagnostic information and security logs.
• Cookies, session identifiers and similar technical data where used by the Platform.

Payments may be handled by a third-party payment service provider. We do not intend to store full payment card credentials unless this is expressly disclosed and lawfully implemented. Payment providers may separately collect and process payment information under their own terms and privacy notices.

We do not intentionally collect personal data beyond what is reasonably necessary for the purposes described in this Policy, subject to applicable law.

4. How We Collect Personal Data

Personal data may be collected:

1. Directly from you when you register, log in, update your profile, submit an order, report an absence, make a payment or contact support.
2. From a parent or guardian who submits information about a child.
3. From a participating school or authorised organisation that creates, verifies or updates accounts and school assignments.
4. From a Canteen Owner in connection with menus, meal availability, orders and fulfilment.
5. From payment providers when they return transaction status, references or reconciliation information.
6. Automatically through the Platform's technical systems, logs, cookies or security mechanisms, where applicable.
7. From other sources where you have authorised the disclosure or where collection is otherwise permitted by law.

Where personal data is provided by someone other than the individual concerned, the person providing it must have the necessary authority and must comply with applicable legal requirements.

5. Why We Use Personal Data

Subject to applicable law, we may use personal data for the following purposes:

5.1 Platform and Account Operations

• Registering, authenticating and managing accounts.
• Assigning users to the correct role, school or organisation.
• Enforcing role-based access restrictions.
• Providing meal planning, ordering, absence reporting and account functions.
• Displaying relevant information in the appropriate user portal.

5.2 Orders, Payments and Credits

• Calculating order totals and maintaining order records.
• Processing or coordinating payments, refunds and reconciliation.
• Verifying payment status and investigating payment discrepancies.
• Assessing absence reports and administering eligible credits.
• Preventing duplicate claims, fraudulent transactions and unauthorised adjustments.

5.3 Communications and Support

• Responding to enquiries, complaints and technical support requests.
• Sending service notifications concerning orders, payments, account security, deadlines or operational changes.
• Communicating relevant information between parents, schools and Canteen Owners where authorised and necessary.

5.4 Security, Fraud Prevention and Enforcement

• Detecting suspicious activity, account misuse, unauthorised access and fraudulent claims.
• Maintaining access logs, audit trails and relevant transaction records.
• Investigating complaints, security incidents and suspected breaches of the Platform's terms.
• Protecting the rights, property, safety and legitimate interests of the Platform Operator, users and participating organisations.

5.5 Platform Maintenance and Improvement

• Diagnosing technical errors and improving reliability.
• Monitoring performance, usage patterns and system capacity.
• Testing updates and improving user experience.
• Producing aggregated or de-identified statistics where reasonably practicable.

5.6 Legal and Business Administration

• Complying with applicable laws, lawful requests and regulatory obligations.
• Maintaining appropriate accounting, audit, tax and business records.
• Establishing, exercising or defending legal claims.
• Managing business restructuring, a merger, acquisition or transfer of relevant business assets, subject to applicable law and appropriate safeguards.

5.7 Marketing

We may send promotional communications only where permitted by law and, where required, after obtaining separate consent.

Marketing consent is optional and is not a condition of using the Platform's core meal services. You may withdraw marketing consent or opt out through the available mechanism or by contacting us.

We will not treat acceptance of this Privacy Policy as automatic consent to optional marketing.

6. Children’s Personal Data

My Happy Meal is designed to support school meal administration and may process personal data relating to children.

Parents or legal guardians who submit a child's information confirm that they have the authority to do so for the relevant purpose and will provide accurate information.

We seek to limit children's information to what is reasonably necessary for the Platform's intended functions. Users must not submit unnecessary sensitive information about a child.

Access to children's data is restricted according to authorised roles and school assignments. A Canteen Owner should access only the information necessary for authorised operations at the school assigned to that account. A school administrator's access should be limited to the relevant school's authorised functions.

The Platform Operator may use technical and organisational controls to prevent unauthorised access, disclosure, alteration or misuse. However, no online system can be guaranteed completely secure.

If you believe that a child's information has been submitted without appropriate authority or is being misused, please contact us promptly.

7. Disclosure of Personal Data

We do not sell personal data as a standalone commercial product.

Subject to applicable law, we may disclose relevant personal data to the following categories of recipients where necessary for the purposes described in this Policy:

7.1 Participating Schools

Information may be shared with the relevant school and its authorised personnel for student administration, meal coordination, order management, customer support and other authorised school-related purposes.

7.2 Canteen Owners

Relevant information may be made available to the Canteen Owner assigned to the student's school so that the canteen can manage menus, prepare and fulfil orders, administer absence-related adjustments and respond to operational enquiries.

The Canteen Owner must not use such information for unrelated purposes or access information outside its authorised school assignment.

7.3 Payment and Financial Service Providers

Relevant order, transaction and payment information may be disclosed to payment processors, banks or other financial service providers to process payments, verify transactions, reconcile records, handle refunds and investigate disputes.

7.4 Technology and Operational Service Providers

We may engage third parties to provide hosting, storage, security, communications, customer support, maintenance, analytics or other services required to operate the Platform.

Where these providers process personal data on our behalf, we will seek to impose appropriate contractual, confidentiality and security obligations consistent with applicable law.

We do not guarantee the performance of independent third-party services. However, using a third party does not remove any legal obligation that remains with the Platform Operator.

7.5 Professional Advisers and Authorities

We may disclose relevant information to lawyers, auditors, insurers, regulators, law enforcement agencies or other authorities where reasonably necessary for legal advice, compliance, investigation, protection of rights or a lawful request.

7.6 Business Transactions

Personal data may be transferred as part of a proposed or completed merger, acquisition, restructuring or sale of relevant business assets, subject to applicable law, appropriate safeguards and any required notices or consents.

7.7 Other Disclosures

We may disclose information where you have authorised the disclosure, where it is necessary to provide a requested service, or where disclosure is otherwise permitted or required by law.

We do not authorise recipients to use personal data for purposes unrelated to the agreed service or applicable legal basis.

8. Role-Based Access and User Responsibilities

The Platform uses role-based access intended to restrict users to information relevant to their authorised responsibilities.

Users must:

• Keep their login credentials secure.
• Access personal data only for authorised purposes.
• Not download, copy, disclose or retain personal data unnecessarily.
• Not use student or parent information for personal, unrelated commercial or unauthorised marketing purposes.
• Notify the appropriate organisation or Platform Operator promptly of suspected unauthorised access or disclosure.
• Follow applicable confidentiality, data protection and security instructions.

Canteen Owners are responsible for using information made available to them only for legitimate operations at their assigned school. Schools and other organisations remain responsible for the independent activities they carry out using information under their own control.

The Platform Operator may restrict or suspend access where reasonably necessary to protect personal data, investigate suspected misuse or comply with law.

9. Data Security and Security Incidents

We will implement reasonable technical and organisational measures appropriate to the nature of the personal data and the risks involved, subject to applicable legal requirements.

Depending on the system design, measures may include access controls, authentication, encryption, logging, backups, restricted administrative permissions, staff confidentiality obligations and security reviews.

Users should understand that internet transmission, electronic storage and third-party services involve risks. No security method or electronic system can guarantee absolute protection against every threat.

If we become aware of a suspected personal data breach, we will assess and respond to it in accordance with applicable legal obligations. Where required, we will notify the relevant authority and affected individuals within the applicable timeframe and in the prescribed manner.

Users, schools and Canteen Owners should promptly report suspected loss, unauthorised access, disclosure or misuse of personal data to proacex.group@gmail.com.

Nothing in this Policy limits any statutory notification or remedial obligation that applies to the Platform Operator or another responsible organisation.

10. Data Retention and Deletion

We retain personal data only for as long as reasonably necessary for the purposes described in this Policy, subject to applicable law and legitimate operational requirements.

Retention periods may vary according to the type of information, the purpose of processing, outstanding orders or payments, accounting requirements, security needs, disputes and legal obligations.

When personal data is no longer required, we will take reasonable steps to delete it, destroy it or permanently de-identify it, where appropriate and technically practicable.

Closing an account does not necessarily result in the immediate deletion of all related information. Some records may need to be retained for outstanding transactions, refunds, audit trails, fraud prevention, legal claims or statutory requirements.

Where data is retained for these reasons, access and use should be restricted to the relevant purposes.

The specific retention periods and deletion procedures must be established and maintained in accordance with the Platform Operator's actual retention schedule.

11. Cross-Border Transfers

The Platform may use service providers or infrastructure located outside Malaysia, depending on the hosting, technical and operational arrangements actually implemented.

If personal data is transferred outside Malaysia, the transfer will be subject to the applicable legal requirements and safeguards.

We will not claim that personal data remains in Malaysia unless the actual hosting, backup, support and service-provider arrangements support that statement.

Further information about relevant cross-border processing may be obtained by contacting proacex.group@gmail.com, subject to security, confidentiality and legal restrictions.

12. Cookies and Similar Technologies

The Platform may use cookies, session identifiers or similar technologies to maintain login sessions, remember language preferences, improve security, diagnose errors and support essential functions.

If analytics or optional tracking technologies are implemented, their use will be disclosed as required by applicable law. Where consent is required, the appropriate consent mechanism will be provided.

You may be able to manage cookies through your browser settings. Disabling essential cookies or session technologies may affect certain Platform functions.

The exact cookies and technologies used should be documented according to the Platform's actual configuration.

13. Your Rights and Requests

Subject to applicable law, you may have rights to:

• Request access to personal data held about you.
• Request correction of inaccurate, incomplete or outdated information.
• Withdraw consent where processing is based on consent, subject to legal and contractual limitations.
• Request that certain processing be stopped or restricted where the law provides that right.
• Request data portability where applicable legal requirements are met.
• Make a complaint regarding the handling of personal data.

To submit a request, contact: proacex.group@gmail.com

To protect users and children, we may need to verify your identity, authority to act on behalf of another person, and the scope of your request before taking action.

We may request additional information reasonably necessary to verify a request. We may refuse or limit a request only where permitted by applicable law, including where an applicable exemption, another person's rights or a legal obligation requires it. Where appropriate, we will explain the reason.

Requests relating to a school's or Canteen Owner's independent processing may need to be directed to that organisation.

Withdrawing consent does not invalidate processing lawfully carried out before withdrawal. It may affect our ability to provide certain functions that require the relevant information.

14. Accuracy of Information

Users are responsible for providing accurate information and updating it when necessary.

If information about a parent, child, school, meal order or payment is incorrect, please update it through the available account function or contact the appropriate school, Canteen Owner or support channel.

The Platform Operator may rely on information submitted by users and authorised organisations unless there is reason to believe it is inaccurate or requires verification. This does not remove any duty imposed on the Platform Operator by applicable law.

15. Third-Party Websites and Services

The Platform may contain links to, or integrate with, third-party websites and services. These third parties may have their own privacy policies and data-handling practices.

Unless expressly stated otherwise, this Privacy Policy does not govern independent websites or services that we do not control.

Users should review the relevant third-party privacy notices before providing information directly to those providers.

16. Changes to This Privacy Policy

We may update this Policy to reflect changes in the Platform, our processing activities, service providers, legal requirements or operational practices.

The updated version will be published through the Platform with a revised “Last Updated” date.

Where a change materially affects users' rights or the purposes of processing, we will provide appropriate notice and obtain renewed consent where required by law.

Continued use of the Platform does not replace any consent or notice requirement imposed by applicable law.

17. Complaints and Contact

If you have questions, concerns or complaints about the handling of personal data, please contact:

Platform: My Happy Meal

Platform Operator: PROACEX GLOBAL MARKETING

Privacy Email: proacex.group@gmail.com

Please provide sufficient information to help us identify the issue, but do not send passwords, full payment card details or unnecessary sensitive information.

We will review privacy enquiries and complaints in accordance with our procedures and applicable law. You may also contact the relevant Malaysian personal data protection authority where permitted.