Effective date: June 4, 2026 | Last updated: June 4, 2026 | Version: MY v1.1
This Policy is issued in accordance with the Personal Data Protection Act 2010 (Malaysia), as amended by the Personal Data Protection (Amendment) Act 2024 (the "PDPA").
Note on language (mandatory): The PDPA's Notice and Choice Principle requires this notice to be made available in both Bahasa Malaysia and English. A Bahasa Malaysia version must be published alongside this English version before launch.
PICTOREAL Inc. ("DUCPIC," "we," "us," or "our"), as data controller, operates the DUCPIC mobile application, website, and related services (the "Service") — a K-content fandom travel platform offering user-generated spot discovery, an in-app community, and location-based features. PICTOREAL Inc. is a company organised under the laws of the Republic of Korea.
This Policy explains how we process the personal data of users in Malaysia in respect of commercial transactions, consistent with the PDPA. Your use of the Service is also governed by our Terms of Service, which include provisions on limitation of liability and dispute resolution.
In accordance with the PDPA (as amended), we have appointed a Data Protection Officer (DPO) accountable for our compliance with the PDPA. You may contact our DPO at [email protected] (Attn: Data Protection Officer).
We process: account and registration data (email, nickname, hashed password, social-login identifier, age or date of birth for age verification); optional profile data (profile photo, favourite artists); user-generated content (posts, reviews, photos, comments, route plans); location data (your device's precise location, only when you use location features); technical and usage data (IP address, cookies, device information, usage history, access logs); event and promotion data (name, contact, delivery address, if you participate); and commerce data (payment, billing/delivery address, transaction history, if and when paid features launch).
We do not seek to process sensitive personal data (which, under the PDPA as amended, includes information on physical or mental health, political opinions, religious beliefs, the commission of offences, and biometric data). If you include such data in UGC, you do so voluntarily and consent to its processing for operating the Service.
We process personal data for the following purposes: to create and manage your account and confirm age eligibility; to provide and operate the Service, including content, community and location-based features; to personalise content and recommendations; to communicate service notices (see Section 7); to administer events and promotions; to detect and prevent fraud, misuse and security incidents; to comply with legal obligations and enforce our terms; and (if applicable) to process payments and bookings.
We process personal data with your consent or on another lawful basis permitted under the PDPA. Consenting to optional or secondary processing is not a condition of using the core Service. You may limit the processing of your personal data, and withdraw consent, by contacting our DPO or adjusting your device or in-app settings.