01About Doonia and this policy
Doonia is a campaign platform operated by Dreamskingdoms Sdn. Bhd. (202401010049 (1555899-W)), part of DREAMS ("we", "us"). Brands use Doonia to run campaigns where people take part by sending a receipt or other entry on WhatsApp or through a web page.
This policy explains how personal data is collected, used, stored, protected and shared through doonia.io, app.doonia.io, campaign entry pages and the WhatsApp numbers connected to Doonia. It is aligned with the Personal Data Protection Act 2010 (PDPA) of Malaysia, as amended.
For other DREAMS services, the DREAMS Privacy Policy applies.
02Who is responsible for your data
| You are | Who decides |
|---|---|
| Campaign participants | The brand running the campaign decides why and how your data is used. Under the PDPA, the brand is the data user and we process your data on its behalf, following its instructions and this policy. The campaign's own rules name the organiser. |
| Business users | When you use the Doonia portal for your company, we are responsible for your account data. |
03What personal data we collect
| Category | Details |
|---|---|
| Contact details | Your WhatsApp number and WhatsApp profile name. Your name, only if you choose to give it. |
| Entries | Receipt photos and the details read from them, such as outlet, date, time, amount, items and receipt number. Any category you choose and the status of each entry with the reason for it. |
| Messages | Messages exchanged with the campaign's WhatsApp number, with their delivery status. |
| Consent | When and how you agreed to the campaign terms and your preferred language. |
| Rewards | Details of any reward you win, codes or PINs sent to you and any details the campaign rules require to deliver a reward. |
| Technical data | For web entries: IP address and device information, used to limit abuse. A digital fingerprint of each photo, used to detect duplicate entries. |
| Business users | Name, work email, role, sign-in records and a log of actions taken in the portal. |
| Connected WhatsApp accounts | For businesses that connect a WhatsApp account: account and phone number identifiers, display name, message templates and other data Meta provides through the WhatsApp Business Platform. |
What we do not collect
We do not ask for health information, religious beliefs, political opinions, biometric data, passwords or banking details. Receipts sometimes show part of a card number. We do not use payment details shown on receipts and you may cover them before sending.
Cookies
doonia.io does not use analytics or advertising cookies. The Doonia portal uses essential browser storage only, to keep business users signed in.
04How we use your data
| Purpose | How the data is used |
|---|---|
| Running the campaign | Receiving your entries, reading and checking receipts against the campaign rules and keeping a record of each entry. |
| Talking to you | Replying on WhatsApp or on the web page about your entries, results and rewards. |
| Draws and rewards | Placing valid entries into draw rounds, selecting winners and reserves and delivering rewards. |
| Fairness and fraud prevention | Detecting duplicate or altered receipts, enforcing entry limits and blocking abuse. |
| Reporting to the brand | Giving the brand running the campaign its entries, results and campaign performance. |
| Business accounts | Providing the portal, support and service updates to business users. |
| Legal duties | Meeting obligations under Malaysian law and protecting the rights and safety of participants, brands and us. |
We do not use participant data for our own marketing and we do not sell personal data.
05AI-assisted reading and human review
Receipt photos are read by an AI service, which extracts the details printed on the receipt. Doonia's rules then check those details against the campaign's conditions.
- Entries that are unclear, borderline or unusual are held for a person to review before a decision is made.
- If the reading service is unavailable, your entry is held for a person. It is never rejected because of a fault on our side.
- You can ask for any decision on your entry to be reviewed by a person.
- We do not use your receipts or messages to train AI models.
06Legal basis for processing
| Basis | When it applies |
|---|---|
| Consent | You agree to the campaign terms before your first entry counts. You may withdraw consent at any time. |
| Contract | Processing needed to run a campaign you have joined, or to provide the portal to a business. |
| Legal obligation | Processing required under Malaysian law. |
| Legitimate interests | Preventing fraud, keeping the platform secure and keeping an accurate record of draws, where these do not override your rights. |
08International transfers
Some of our service providers store or process data on servers outside Malaysia, including in Singapore, the United States and other countries. Where data leaves Malaysia, we take reasonable steps to keep it protected to a standard consistent with the cross-border transfer provisions of the PDPA.
09How we protect your data
- Encrypted connections (SSL/TLS) for all data sent to and from Doonia.
- Access limited by role, so business users only see the campaigns they are assigned to.
- Phone numbers masked in the portal where full numbers are not needed.
- A log of who reviewed, changed or decided each entry.
No method of transmission or storage is completely secure. We take reasonable steps to protect your data but cannot guarantee absolute security.
10How long we keep data
| Data | Retention |
|---|---|
| Campaign data | For the length of the campaign and a reasonable period after it, for verification, reward delivery, reporting and disputes. It is then deleted or anonymised, unless the brand asks for earlier deletion or the law requires us to keep it longer. |
| Draw records | A record of winners and draw results may be kept for as long as needed to show the draw was fair, or as the law requires. |
| Business accounts | While the account is active and a reasonable period after it is closed. |
11Your rights
| Right | What it means |
|---|---|
| Access | Ask for a copy of the personal data we hold about you. |
| Correction | Ask us to correct data that is inaccurate or incomplete. |
| Withdraw consent | Stop taking part at any time. Entries already made may no longer count once consent is withdrawn. |
| Limit processing | Ask us to stop using your data for a particular purpose. |
| Portability | Where the relevant regulations are in force, ask for your data in a commonly used format. |
| Deletion | Ask us to delete your data. See our data deletion page. |
To use any of these rights, email [email protected] or tell us in the campaign's WhatsApp chat. We will acknowledge your request within 21 days. We may confirm your identity first, for example by checking the request comes from the same WhatsApp number. Where the brand is the data user, we handle the request on its behalf or pass it to them.
12Data breaches
If a personal data breach is likely to cause significant harm or is of a significant scale, we will notify the Personal Data Protection Commissioner and affected people as required under the PDPA, and inform the brand concerned.
13Children
Campaigns on Doonia are intended for people aged 18 and above unless the campaign's own rules say otherwise. We do not knowingly collect data from children outside those rules.
14Changes to this policy
We may update this policy from time to time. The version on this page is the current one and the date at the top shows when it last changed.
15Contact and governing law
Dreamskingdoms Sdn. Bhd., E-32-02, Menara SUEZCAP 2, KL Gateway, No. 2, Jalan Kerinchi, Gerbang Kerinchi Lestari, 59200 Kuala Lumpur, Malaysia. Email [email protected].
This policy is governed by the laws of Malaysia. Disputes are subject to the exclusive jurisdiction of the civil courts of Malaysia sitting in Kuala Lumpur.