Privacy policy

Last updated: September 13, 2026

This policy explains what personal data Hill to Street collects when you visit or buy from hilltostreet.com, why we collect it, who we share it with, and what rights you have over it.

We are Silver Lining Collection, trading as Hill to Street, registered in Malaysia under registration number 002858468-H, at KL Palace Court, B6-12, 10 Jalan Kuchai Jaya, Taman Kuchai Jaya, 58200 Kuala Lumpur, Malaysia. In this policy "we", "us" and "our" mean Hill to Street.

For anything in this policy, contact sales@hilltostreet.com.

This policy is written to meet the Malaysian Personal Data Protection Act 2010 (as amended). If you are in the United Kingdom or the European Economic Area, the UK GDPR and EU GDPR also apply to you, and the sections marked UK/EEA customers set out the additional rights you have.

1. What we collect

When you place an order Your name, billing and delivery address, email address, phone number, and the contents and value of your order. Payment card details are entered directly into our payment provider's systems — we never see or store your full card number.

When you create an account Your name, email address, password (stored encrypted), and your saved addresses and order history.

When you contact us Whatever you choose to tell us by email, and our replies.

When you subscribe to our emails Your email address, and whether you open and click our messages.

When you leave a product review Your name (or the display name you choose), your rating and review text, and any photos you upload.

When you simply browse Your IP address, browser and device type, the pages you look at, what you searched for on the site, how you arrived (for example from Instagram or a Google search), and cookie identifiers. This is collected automatically.

What we do not collect We don't ask for and don't want your identity card number, passport number, banking passwords, or any information about your health, religion, political opinions or similar sensitive matters. Please don't send these to us.

2. Why we use it, and our legal basis

What we use it for	Legal basis (PDPA)	Legal basis (UK/EU GDPR)
Taking payment, packing and shipping your order, sending order updates	Necessary to perform our contract with you	Contract
Answering your questions and handling returns	Necessary to perform our contract with you	Contract
Fraud prevention and keeping the site secure	Our legitimate interest in protecting the business	Legitimate interests
Keeping tax and accounting records	Legal obligation	Legal obligation
Sending marketing emails	Your consent	Consent
Analytics, understanding how the site is used	Your consent, via the cookie banner	Consent
Advertising and measuring ad performance	Your consent, via the cookie banner	Consent
Publishing your product review	Your consent	Consent

We do not sell your personal data. We have never done so and have no plans to.

3. Who we share it with

We share only what each party needs to do its job.

Who	What they do	Where they process it
Shopify	Runs our online store, checkout and customer database	Canada, USA, and other locations
Our payment providers	Take and verify your payment	Varies by provider
DHL Express	Delivers international orders	Germany and destination country
Our Malaysian courier	Delivers domestic orders	Malaysia
Google (Analytics, Merchant Center, Search Console)	Site analytics and product listings	USA and globally
Judge.me	Collects and displays product reviews	USA
Mailchimp and SmartrMail	Send our marketing emails	USA
MLVeda	Converts displayed prices into your currency	India / USA

We also disclose personal data where the law requires it — to a court, a regulator, or a law enforcement agency acting under proper authority — and to our accountants and professional advisers under a duty of confidence.

If the business is ever sold or restructured, customer data may transfer to the buyer. We'd tell you before that happened.

4. Sending data outside Malaysia

We sell to customers in more than 30 countries and our suppliers are mostly outside Malaysia, so your data will be processed abroad — principally in the United States and the European Union.

Where we transfer personal data out of Malaysia we do so on the basis that the receiving party is contractually bound to protect it to a standard comparable to the PDPA.

UK/EEA customers: transfers out of the UK or EEA are made under the European Commission's Standard Contractual Clauses (and the UK Addendum where relevant), which our processors incorporate into their terms. You can ask us for details.

5. How long we keep it

Data	Kept for
Order and transaction records	7 years from the end of the financial year, as Malaysian tax law requires
Account details	While your account is open, then 12 months after you close it
Marketing contacts	Until you unsubscribe, then we keep a suppression record so we don't email you again by mistake
Customer service messages	2 years
Product reviews	Until you ask us to remove them
Analytics data	Up to 14 months

6. Your rights

Under the PDPA you may:

Ask what we hold about you and get a copy
Correct anything inaccurate or out of date
Withdraw your consent to marketing or to any processing based on consent
Limit how we process your data, including asking us to stop using it for direct marketing
Ask us to delete data we no longer have a reason to keep
Ask for your data in a portable form so it can be moved to another provider

UK/EEA customers additionally have the right to object to processing based on legitimate interests, the right to erasure, and the right not to be subject to decisions made solely by automated means. We don't make any automated decisions that produce legal or similarly significant effects.

To exercise any of these, email sales@hilltostreet.com. We'll respond within 21 days as the PDPA requires, and within one month for UK/EEA requests. We may ask you to confirm your identity first — only to make sure we're not handing your data to someone else.

If you're not satisfied with how we've handled it, you can complain to the Personal Data Protection Commissioner of Malaysia (pdp.gov.my). UK customers can complain to the Information Commissioner's Office (ico.org.uk); EEA customers to their national data protection authority.

7. Cookies and tracking

Cookies are small files stored on your device. We use four kinds:

Strictly necessary - keep you logged in, remember your basket, process checkout. The site cannot work without these, so they're always on.
Analytics - tell us which pages people visit and where they leave. Google Analytics.
Marketing - let us measure and target advertising.
Preferences - remember your currency and language.

Everything except the strictly necessary cookies runs only if you agree through the cookie banner. You can change your mind at any time via the cookie settings link in our footer, or by clearing cookies in your browser.

We do not respond to browser "Do Not Track" signals, as there is no agreed standard for them. We do honour Global Privacy Control signals where our platform supports it.

8. Keeping it secure

The site runs over HTTPS. Card payments are handled by PCI-DSS compliant providers and never touch our own systems. Access to customer data in our Shopify admin is limited to the people who need it, and protected by two-step authentication.

No system is perfectly secure. If a breach occurs that is likely to cause you significant harm, we will notify you and the Personal Data Protection Commissioner without undue delay, as the PDPA requires.

9. Children

Our store is not intended for children under 18, and we don't knowingly collect their data. If you believe a child has given us personal data, email us and we'll delete it.

10. Changes

If we change this policy we'll update the date at the top. For changes that materially affect your rights, we'll tell you by email or a notice on the site.

11. Contact

Email sales@hilltostreet.com
Post Hill to Street, KL Palace Court, B6-12, 10 Jalan Kuchai Jaya, Taman Kuchai Jaya, 58200 Kuala Lumpur, Malaysia.