Privacy Policy

Lens Lepak is a camera and cinema gear rental service based in Subang Jaya, Selangor, Malaysia. This policy explains what personal data lenslepak.com collects, why, and what rights you have over it under Malaysia's Personal Data Protection Act 2010 (PDPA).

The booking form on this site collects: your full name, phone or WhatsApp number, email address, and any notes you choose to add about your shoot.

That's the full extent of what the website itself collects. We do not collect identity documents through the website. If you go ahead with a booking, a copy of your IC is requested separately, through a private WhatsApp conversation after your request is reviewed, never through the public booking form.

To review and confirm your booking request, verify your identity for the rental agreement, send you booking confirmations and updates, and reply to general enquiries sent through the site or WhatsApp.

We don't use anything you submit for marketing emails or sell it to anyone.

Booking details are stored in Supabase, a hosted database provider. Confirmation and notification emails are sent through Resend. Both are service providers we use to run the booking system, not parties we share your data with for their own purposes.

IC copies exchanged over WhatsApp are handled through Meta's WhatsApp platform and are not uploaded to or stored on lenslepak.com.

Booking records are kept for as long as a booking is active or upcoming, and for a reasonable period afterward for accounting and dispute purposes. You can ask us to delete your data once there's no active or pending booking tied to it - see the contact section below.

Under the PDPA, you can ask to see what personal data we hold about you, ask us to correct it if it's wrong, withdraw consent for us to hold it, or ask us to delete it. Message us on WhatsApp or email to make any of these requests, and we'll get back to you.

The public website doesn't use advertising or tracking cookies. A single technical cookie is used to keep staff logged into the internal admin dashboard - it has nothing to do with visitor tracking and isn't set unless someone logs into that dashboard.

If this policy changes, the update will be posted on this page with a new effective date. Continuing to use the site after a change means you accept the updated version.