Ohmaishoot.com Privacy Policy
Updated: 4 October 2026
1. Introduction
Ohmaishoot.com ("we", "our system") is a platform for
finding and buying photos from marathon and sports events. This document
explains how we collect, use and protect
your personal data.
2. Data We Collect
2.1 Checkout Data (Required)
- Full name — for orders
- Email — for order notifications & downloads
- Phone number — for customer support
- Billing address — for CHIP (payment gateway)
2.2 Face Search Data (Optional)
- Selfie/photo — that you submit for a search
- Face descriptor (128-dimension vector) — for face matching
- Quality metadata — lighting, angle, clarity
2.3 Analytics Data (Automatic)
- Device type (mobile/desktop)
- Pages visited
- Activity times
- Referral source (e.g. Google, Instagram)
- IP address (anonymised)
3. How We Use Data
| Data |
Purpose |
Retention Period |
| Name, Email, Phone |
Process orders, send notifications, support |
3 years (tax requirements) |
| Selfie Photo |
Face search, photo matching |
30 days or on request |
| Face Descriptor |
Face matching in the database |
1 year or on request |
| Analytics Data |
Usage analysis, system improvement |
180 days |
4. Your Rights (Under Malaysia’s PDPA & the GDPR)
- Right of Access — request a copy of your data
- Right to Rectification — correct inaccurate data
- Right to Erasure — request deletion of your data
- Right to Portability — receive your data in a standard format
- Right to Object — object to certain processing
How to Make a Request:
Email [email protected] with the subject
"Data Subject Rights Request". We will respond within 30 days.
5. Data Security
- ✅ Database encryption (AES-256)
- ✅ TLS 1.2+ for all connections
- ✅ No credit card data stored (handled by CHIP)
- ✅ Admin authentication with session tokens
- ✅ Daily backups stored encrypted
6. Third-Party Data Sharing
| Third Party |
Data Shared |
Purpose |
| Google Drive |
Album metadata, thumbnails |
Photo storage |
| CHIP (orders before October 2026: ToyyibPay) |
Name, Email, Payment Amount |
Payment processing |
| Gmail SMTP |
Name, Email |
Order notifications |
Agreements: We have signed Data Processing
Agreements (DPAs) with each third-party provider.
7. Cookies & Tracking
- localStorage (Visitor ID) — to track user sessions
- Analytics Cookies — to measure usage
- Session Cookies — for admin login
You can disable cookies in your browser settings.
8. Data Breaches
If we detect a data breach, we will:
- Notify the authorities within 72 hours
- Notify affected users by email
- Prepare a full incident report
- Carry out remediation steps
9. Contact Us
Privacy Officer: [email protected]
Response Time: Within 7 business days
10. Policy Changes
We will announce significant changes to this policy
by email or with a notice on the website.