ROOTS LIVE BOOKING
Privacy Notice / Notis Privasi
Effective: 10 September 2026
This notice explains how Roots Bistro handles personal data submitted through the Roots Live booking service. Versi Bahasa Malaysia disediakan selepas versi Bahasa Inggeris.
1. Data we collect
We collect the booking contact’s name, mobile number and email; ticket quantities; event and payment status; optional song requests; and any allergy, sensitivity or accessibility information you choose to provide. Billplz processes payment details on its hosted checkout; Roots does not collect your bank password or card credentials.
2. Why we use it
We use this data to hold capacity, process and verify payment, issue tickets, arrange tables and accessibility, operate check-in, respond to changes or refunds, prepare the singer playlist, prevent fraud, keep accounting records and improve event operations.
3. Disclosure and processing
Data is available only to authorised Roots staff and service providers needed to operate the booking, including Cloudflare for hosting and database services and Billplz for payment processing. We do not sell personal data. Service providers may process data outside Malaysia subject to their safeguards and applicable law.
4. Your choices and rights
Required booking details are marked as such. Song requests and special notes are optional. You may ask to access or correct your data, withdraw optional consent, or raise a privacy complaint by calling the Roots contact number shown on the booking website. Some records may still be retained where required by law or needed to establish or defend a claim.
5. Security
We use access controls, encrypted HTTPS transport, restricted administrator access, signed payment callbacks and audit logs. No online system is risk-free; suspected incidents are investigated and escalated under our response process.
6. Retention
| Data category | Retention rule |
|---|---|
| Incomplete, expired or failed bookings | 30 days after the booking is closed |
| Allergy, sensitivity and accessibility notes | 30 days after the event |
| Song requests | 90 days after the event |
| Paid booking contact details | 24 months after the event, then anonymised |
| Payment, refund and audit records | 7 years where needed for accounting, tax, fraud prevention or legal claims |
| Deleted data in Cloudflare D1 recovery history | Up to the active D1 Time Travel window |
When a retention period ends, identifying contact details are deleted or anonymised while minimum transaction records may be retained for legal and accounting purposes.
Notis Privasi Bahasa Malaysia
Roots Bistro mengumpul nama, nombor telefon, e-mel, bilangan tiket, status bayaran, permintaan lagu pilihan serta maklumat alahan, sensitiviti atau aksesibiliti yang diberikan secara sukarela. Data digunakan untuk tempahan, pengesahan bayaran, tiket, susunan meja, daftar masuk, bayaran balik, operasi acara dan rekod perakaunan.
Data hanya boleh diakses oleh kakitangan Roots yang diberi kuasa dan penyedia perkhidmatan yang diperlukan seperti Cloudflare dan Billplz. Kami tidak menjual data peribadi. Anda boleh meminta akses atau pembetulan, menarik balik persetujuan pilihan, atau membuat aduan privasi melalui nombor hubungan Roots pada laman tempahan. Tempoh penyimpanan adalah seperti jadual di atas; selepas itu maklumat pengenalan akan dipadam atau dinyahkenal pasti kecuali rekod minimum yang perlu disimpan di sisi undang-undang.