Last Updated: January 4, 2026
This Privacy Policy ("Policy") describes how NF Spring Sdn. Bhd. ("we", "our", or "us") collects, uses, and discloses your personal data in accordance with the Malaysia Personal Data Protection Act 2010 ("PDPA") when you use our official website (https://www.nongfuspring.com.my) (the "Site").
By accessing and using our Site, you acknowledge that you have read and understood the practices described in this Policy, and hereby consent to the collection, use and disclosure of your personal data in accordance with this Policy.
NF Spring Sdn. Bhd. (hereinafter referred to as "we", "our", or "us") recognizes the importance of your privacy and is committed to maintaining your trust when you use our Site. This Privacy Policy aims to clearly and comprehensively explain our information handling practices during your browsing of the Site, including what information we collect, why we collect it, how we protect it, and the rights you possess.
The data controller responsible for your personal data is [NF Spring Sdn. Bhd], a company incorporated in Malaysia.
When collecting information, we adhere to the principle of "minimum necessity," collecting and processing only the personal information essential for legitimate website functionality and, where feasible, conducting only statistical analysis of website visits and transmitting only the statistical results to Nongfu Spring Co., Ltd. (incorporated in China) .
The Site does not feature any interactive functions that require you to submit personal information, including but not limited to user registration, login, online ordering, customer service messages, or news email subscriptions. Therefore, during normal browsing, we do not collect any personal identification information from you, such as your name, phone number, email address, postal address, or identification number.
To enhance our website experience and analyze overall usage patterns, we employ industry-standard analytics tools. These tools collect only anonymous data for statistical purposes (such as browser type or session duration). All information is aggregated and presented as broad trends, and cannot be used to identify any specific individual.
| Category | Examples | Processing Purpose | Classification and Safeguards |
|---|---|---|---|
| Identifier | A pseudonymised unique device identifier (deviced) generated by the Software Development Kit ("SDK"). | To differentiate between devices for accurate analytics, such as calculating unique visitor counts and session frequency, device identifiers are randomly generated anonymous strings used only for aggregated analysis and not linked to personal identity. | Aggregated and anonymized data | This identifier is a randomised string. We process it in an aggregated and anonymised format for analytical purposes. While any persistent identifier carries a theoretical risk of indirect identification, we do not combine this identifier with other datasets to identify specific individuals. |
| Browsing Metadata | Page path, referral source, page title, and URL parameters. | To analyse content engagement, user navigation paths, and the performance of various Site pages to inform structural improvements. | Aggregated data | We implement technical measures to filter any potentially identifiable information from URL parameters. This category of data is utilised exclusively in an aggregated manner. |
| Technical Device Information | Screen resolution, preferred language, device category, and time zone. | To ensure the Site is displayed correctly across different devices and to perform regional analysis of traffic sources. | Aggregated analysis | Individually, these data points possess low identifiability. In combination, they may form a device fingerprint with a potential risk of indirect identification. Our use of this data is strictly limited to aggregated analysis. |
| Precise Location Data | Geographic coordinates (latitude and longitude). | For macro-level geographical analysis of Site usage. | No active collection of precise geolocation data | We hereby confirm that the Site currently DOES NOT actively collect or process precise geolocation data. Should this practice change in the future, we will adhere to the principle of "notice and consent," securing your explicit and prior consent as may be needed under applicable law before any collection occurs. |
3.3 We do not collect sensitive personal information as defined under the PDPA. This includes, but is not limited to, data concerning an individual's physical or mental health, political opinions, religious beliefs, or other similar beliefs. Our data collection practices are designed to comply with the provisions of the PDPA and to ensure the protection of personal data. We only collect information that is necessary for the purposes outlined in our privacy policy. We are committed to maintaining the highest standards of data privacy and security for all users in Malaysia and globally today.
We do not sell, trade, or rent out your information.
We only share the data described in Section 3.1 and Section 3.2 with third-party service providers who assist us in achieving the purposes outlined in this Policy. These data are shared with our third-party data analytics service providers. Such sharing is limited to what is strictly necessary to perform website usage analytics, traffic statistics and to improve the Site. We will not use the collected data for profiling, preference research, personalization of services, targeted advertising, marketing or market analysis. We have entered into strict data processing agreements with them, contractually obligating them to provide analytics services solely for us and requiring them to implement security measures commensurate with our own to protect your data.
Please be aware that the Site is hosted on servers located in the People's Republic of China. Consequently, any data collected through your use of the Site will be stored and processed in China, constituting a transfer of data outside of Malaysia. Nongfu Spring Co., Ltd. (incorporated in China) will be the data processor and recipient. Under PDPA, Cross-border transfers require your explicit consent. You may revoke this consent at any time by contacting the our service email (see Section 6.2 for contact details and procedures). We will ensure the receiving China maintain adequate data protection standards. All transfers will be governed by binding contractual clauses to enforce data protection obligations on recipients.
We may disclose necessary data when required by laws, regulations, litigation, or compulsory requests from government authorities.
The Site does not utilise any cookies for the purposes of tracking user behaviour, personalised marketing, or targeted advertising.
The data collection for analytics is facilitated through a Software Development Kit (SDK), which operates via a different technical mechanism than traditional browser cookies.
Under the PDPA, you have certain rights you may concern. You may exercise these rights by contacting us using the details provided in Section 9.
Subject to applicable law, you have the right to request access to and correction of your personal data in our possession or under our control. We reserve the right not to accede to such requests in accordance with applicable law, such as where the access request is frivolous or vexatious.
Where the collection, use, disclosure or processing of your personal data is based on your consent, you have the right to withdraw that consent, contacting with our service email (enquiries.my@nfspring.com) at any time.
You may instruct the Site to cease collecting your browsing data for analytics purposes by enabling the "Do Not Track" ("DNT") setting in your web browser. The Site is configured to recognise and respect the DNT signal. You can also clear your browser cache and local storage data to remove anonymous identifiers.
Please note that we may need to verify your identity before processing your request.
We do not collect, store, or process any children's personal information through this website. If you wish to obtain information about drinking water products for your child, please contact us through [official website contact information], and we will provide you with specialized consulting services.
Personal data processed for the Process will be retained only as long as necessary to fulfil the stated purposes, to meet legal or regulatory obligations, or to satisfy legitimate internal audit and dispute resolution needs. After the reasonable retention period expires, personal data will be securely deleted or irreversibly anonymized..
We may revise this Policy from time to time based on business development, technological updates, or changes in laws and regulations. Any updated version will be posted on this page, indicated by revising the "Last Updated" date at the top. For material changes, we will provide a prominent notice on the Site's homepage before the revision takes effect. We encourage you to review this Policy periodically for the latest information. If we plan to introduce user registration/login functionality in the future, we will reserve the right to include relevant clauses in this privacy policy and obtain your explicit consent.
This clause governs all communications relating to this Privacy Policy, including but not limited to queries, feedback, suggestions, complaints, and the exercise of your legal rights under the Malaysia Personal Data Protection Act 2010 ("PDPA").
For general non-data specific communications, you may contact our general administrative office. Please note that correspondence through these channels may be redirected to our Data Protection Office. for appropriate action.
Email: enquiries.my@nfspring.com
Telephone: +60 3 9388 0088
To safeguard all personal data, we are obligated to verify the identity of any individual submitting a request. We may require additional information to process your request effectively. Where permitted under the PDPA, a reasonable administrative fee may be levied for handling data access requests. We undertake to address all bona fide concerns in a timely manner and in strict accordance with the provisions of the PDPA.