MCDONALD’S PRIVACY STATEMENT
Effective Date: 1 Jan 2025

At McDonald’s, we respect your concerns about privacy. This Privacy Statement (“Statement”) describes the personal information practices of McDonald’s with respect to your personal information when you interact with us in person or via Web sites and mobile apps, including the types of personal information we collect, how we may use this information, and with whom we may share it.

  1. 1. Information We Collect

    We may collect personal information about you when you visit one of our restaurants, use McDonald’s Web sites (“Sites”), or use our web or mobile device applications (“Mobile Apps”). We refer to our Sites and Apps collectively as “Online Services”.

    (A)  The types of personal information we collect may include:

    • Transaction information, such as product purchased, price, method of payment and payment details.

    • Personal details such as name, postal address, email address, phone number, date of birth nationality, race, particulars of identity card/passport, photograph, image and other contact information when you provide that information to us, such as if you register with our Online Services, log-in to Wi-Fi, or enter a McDonald’s contest, competition, prize draw, promotions.

    • Demographic information such as age or gender.

    • Account information, such as username, password, and other identifiers or credentials used to access our Online Services or to acquire McDonald’s products and services.

    • Other personal information you choose to provide when you interact with McDonald’s (including through social media and call centers).

    • If you are seeking employment with us or seeking to enter into a contractual relationship with us, information such as income, employment record and references, tax, EPF & SOCSO details, banking and credit card details, sensitive information such as physical or mental health conditions, religious beliefs or criminal records and such other information as may be required for specific reasons during the performance of contract.

    (B)  The circumstances in which you provide personal information may include when you:

    • purchase products at our restaurants or seek for services;

    • register to use our Online Services;

    • request to receive marketing or other communications;

    • use our Wi-Fi networks, kiosks or other in-store technologies;

    • engage with us through our websites and social media channels;

    • participate in our marketing and promotional activities, market surveys and analytics;

    • enter in one of our contests, competitions or prize draws;

    • seek our participation in any organized event or program;

    • submit information when providing feedback;

    • use interactive features of our Online Services;

    • communicate with us or our authorized agents;

    • seek employment with us; or

    • seek to enter into a contractual relationship with us.

    Where indicated, it is obligatory to provide your personal information to us to enable us to process your participation in the above activities. Should you decline to provide such obligatory personal information, we may not be able to process your request.

    (C)  Information Collected Through Automated Means:

    We may use automated technology to collect information from your computer system or mobile device when you visit our restaurants, use our Online Services, or in-restaurant technology. Automated technology may include cookies, local shared objects, and web beacons. Additional information regarding the us of cookies and other automated technologies is provided in this Statement below.

    The information we collect may include your:

    • internet protocol (IP) address;

    • computer or mobile-device operating system and browser type;

    • type of mobile device and its settings;

    • unique device identifier (UDID) or mobile equipment identifier (MEID) of your mobile device;

    • device and component serial numbers;

    • advertising identifiers (for e.g.: IDFAs and IFAs) or similar identifiers;

    • referring webpage (a page that has led you to our Sites or Mobile Apps) or application;

    • online activity on other websites, applications or social media;

    • the linked sites, third-party websites, applications or social media where you share Online Services content;

    • visits to our restaurants, where recorded using digital technology (e.g. Closed Circuit Television (CCTV) recording); and

    • activity related to how you use our Online Services, Mobile Apps, or in-restaurant technology, such as the pages you visit on our Online Services.

    The providers of third-party apps, tools, widgets and plug-ins on our Online Services, such as Facebook "Like" buttons, also may use automated means to collect information regarding your interactions with these features. This information is subject to the privacy policies or notices of these providers.

    (D)  Location Information:

    McDonald’s Online Services and in-restaurant technologies may collect precise information about the location of your mobile device or computer using geolocation and location presence awareness technologies such as GPS, Wi-Fi, Bluetooth, or cell tower proximity. For most mobile devices and computer systems, you are able to withdraw your permission for McDonald’s to acquire this information on your location through the device or Web browser settings. If you have questions about how to disable collection of precise location information, we recommend you contact your mobile device service provider, the device manufacturer, or your Web browser provider. Please note that certain Online Services and in-restaurant technologies may not function properly without information about your location. If you would like us to delete location information we have collected that is identifiable to you, please contact us at the email or postal address listed below. Please note that we may be required by law to retain certain information.

    (E)  Information From Other Sources:

    We may collect information about you from the McDonald’s Family. The McDonald’s Family consists of McDonald’s Corporation and McDonald’s Global Markets LLC, and their affiliates, and subsidiaries (“McDonald’s Entities”), and franchisees of McDonald’s Entities, business partners, and vendors (e.g., food delivery platforms, data providers, or payment processors) or from public sources (e.g., your public social media posts).

    (F)  Combined Information:

    We may combine personal information that we collect with information we receive from other sources, information about your prior transactions with McDonald’s and information that is automatically collected.

  2. 2. How We Use the Information We Collect:

    (A)  McDonald’s may use information collected from each category for the following purposes:

    • to fulfil your requests, provide our products, services and fulfil our contractual obligations with you, including payment processing;

    • to send communications to you about your orders, purchases or accounts with McDonald’s;

    • to communicate with you about and administer your participation in contests, competitions, prize draws, offers, promotions or special events;

    • to provide customer support, respond to, and communicate with you about your requests, questions and comments;

    • to manage our relationship with you, including feedback management and for customer surveys;

    • to enable you to post and interact with McDonald’s through social media and blogs;

    • to identify users of our Online Services and gather demographic information about our users;

    • to personalize your experience on our Online Services and in-restaurant technologies, such as providing you with content in which you may be interested, and making navigation to our Sites and Mobile Apps easier;

    • to send information to your contacts if you request us to do so;

    • if you give us permission, to communicate with you about products and services of McDonald’s or our business partners that we believe may interest you;

    • to provide you with general and personalized electronic and non-electronic direct marketing information and support our targeted advertising initiatives concerning our products and services (including contests, competitions, prize draws, special events, offers, promotions);

    • to perform data analytics, including consumer and operations research, trend analysis, and financial analysis to determine the effectiveness of our sales marketing and advertising efforts, and to analyse market trends and future customer demand;

    • to analyse, evaluate and improve our business, products, offers, promotions, Online Services, overall customer experience including the development of new products, services and other technologies;

    • to administer our Online Services and Mobile Apps and to help diagnose technical and service problems;

    • to ensure the security of our Online Services and in-restaurant technology including the detection, prevention and investigation of attacks;

    • to protect against, identify and prevent fraud and other criminal activity, claims and other liabilities;

    • to protect the rights, safety, health and security of our customers, our employees, our franchisees, and the general public, and to protect our property;

    • to anonymise your information for further internal and external use in a manner that does not identify you;

    • to comply with legal obligations, our policies or our Standards of Business Conduct; and

    • to establish, exercise or defend a legal claim.

    We may use the information we obtain about you in other ways for which we provide specific notice at the time of collection.

  3. 3. How We Share the Information We Collect

    McDonald’s may share all or substantially all categories of your personal information with:

    • members within the McDonald's Family. The McDonald’s Family includes McDonald’s Corporation, its affiliates, subsidiaries, suppliers, vendors and franchisees, inside or outside of Malaysia. Members of the McDonald’s Family that receive this information from McDonald’s are not authorised to use or disclose the information except as provided in this Privacy Statement;

    • vendors that are involved in your customer experience, including product or service delivery (e.g., food delivery platforms); and/or vendors that help us operate our business such as providing data processing and other information technology services, administering promotions, contests and prize draws, conducting research and performing analytics, and personalizing individual McDonald’s experiences as well as those who use the information to detect or prevent fraud for us, and who may use the information to provide fraud detection and prevention services to others. We do not authorize these vendors to use the personal information or to disclose it for any purpose other than to perform services on our behalf.

    • public authorities and courts;

    • buyers or other parties involved in a corporate transaction if, for strategic of other business reasons, we decide to sell or transfer all or part of our business; and

    • our professional advisers such as our legal representatives, auditors and insurance brokers.

      • We do not sell your personal information for monetary consideration and only share your information as described in this Privacy Statement or as otherwise communicated to you at the time we collect your information.

      McDonald’s reserves the right to use or disclose personal information as needed to satisfy any law, regulation or legal request, to protect the integrity of our Online Services and in-restaurant technologies, to bring or defend against legal claims, to protect the rights, interests, safety and security of McDonald’s, McDonald’s employees or franchisees, or members of the public, or in connection with the investigation of fraud, illegal activity or violation of McDonald’s policy.

  4. 4. Children’s Privacy Notice

    McDonald’s understands the importance of privacy of users of our Online Services. We are especially committed to protecting the privacy of children who visit or use our Online Services. This Children's Privacy Notice is designed to answer your questions regarding our practices with respect to personal information we collect through our Online Services from children under the age of 18.

    (A)  What Personal Information Does McDonald’s Collect?

    We offer many features on our Sites, like games and colouring books, which do not require a child to provide any personal information. On occasion, however, we may collect personal information, such as an email address from children as part of an activity. For example:

    • We may collect a child's email address to notify the child if he or she has won or lost a contest, competition or prize draw. In that event, we will notify the child using the email address the child supplies. We will not keep the email address or use it for any other purpose.

    • We may collect a child's email address in order to respond to a request from the child on a one-time basis, such as to send the child a screen saver. In this case we promptly delete the email address from our system once we have responded, and we do not use the address for any other purpose.

    We will not collect other personal information from a child under the age of 18 (subject always to applicable law), such as a postal address or telephone number, without the consent of a parent or guardian. If parent or guardian consent is required, we will collect the email address of the parent or guardian so we can provide notice of our information practices and/or seek the parent's or guardian's consent.

    McDonald’s will not condition a child's participation in any online activity on the child's disclosure of more personal information than is reasonably necessary to participate in that activity

    (B)  How Does McDonald’s Use the Personal Information It Collects?

    We use email addresses submitted by a child in order to respond to the child's request or to notify the child if he or she has won or lost a contest, competition or prize draw they entered. We use the email address of a parent or guardian in order to provide the parent notice of our information practices or to seek the parent's or guardian's consent.

    (C)  How Does McDonald’s Share Personal Information?

    We may share a child's personal information with third parties to the extent reasonably necessary to protect the security or integrity of our Online Services, take precautions against liability, or respond to judicial process or requests from other governmental authorities, or when we believe disclosure is necessary or appropriate to prevent physical harm or financial loss, or in connection with an investigation of suspected or actual illegal activity.

    We also may share personal information collected from children with vendors that perform services for McDonald’s. These services may include hosting our Sites, providing technical services to McDonald’s, fulfilling requests or administering a contest, competition or prize draw. We do not authorize such vendors to disclose the personal information we share with them other than as necessary to perform the relevant service for McDonald’s.

    (D)  Requests from Parents Regarding Our Children's Privacy Practices.

    Parents may review personal information we have collected from their child that has not been deleted, and can request that the personal information be deleted from our records if it has not been already. Parents also may refuse to permit further collection or use of their child's personal information, when the parent has previously provided consent. To do so, please contact us at the address, telephone number or email address provided below with your request.

    (E)  Who Should I Contact with Questions about Children’s Privacy?

    We urge parents to regularly monitor and supervise their children's online activities. If you have any questions about our children’s privacy practices, please contact us at the postal/email address provided below.

  5. 5. Your Choices

    You can elect not to receive marketing communications from McDonald’s by contacting us at https://www.mcdonalds.com.my/contact, or postal/email address provided below. Please note that if you opt out of receiving marketing communications from us, we may still send communications to you concerning your transactions, accounts with McDonald’s and any contests, competitions or prize draws in which you have enrolled.

  6. 6. Access to and Correction and Deletion of Personal Information

    If at any time you would like to access, correct, or delete personal information we have collected from you, please contact us at the email or postal address listed below. Please note that we may be required by law to retain certain information. Before McDonald’s is able to provide you with any information or correct any inaccuracies, we may ask you to verify your identity and/or provide other details to help us respond to your request. If you are below the age of 18, a parent, guardian or a person who is responsible for you may request access to, correction or deletion of your personal data.

  7. 7. Cookies and Similar Technologies

    McDonald’s uses cookies and other similar technologies to collect information for the purposes described in this Privacy Statement under “How We Use the Information We Collect.”

    (A)  Cookies

    A "cookie" is a text file that websites send to a visitor's computer or other Internetconnected device to uniquely identify the visitor's browser or to store information or settings in the browser. Like most websites, McDonald’s uses cookies for a variety of purposes in order to improve your online experience. For example, we track the total number of visitors to our Sites on an anonymous aggregate basis. We may also employ cookies so that we remember you when you return to the Site, to keep track of the items in your shopping cart if you purchase merchandise online, to administer certain contests and to help customize your McDonald’s web experience. We may associate personal information with a cookie file in those instances. Both we and others (such as out advertising networks) may collect personal information about our visitors’ online activities, overtime and across third-party websites, when using our Online Services.

    Use the options in your web browser if you do not wish to receive a cookie or if you wish to set your browser to notify you when you receive a cookie. Click on the “Help” section of your browser to learn how to change your cookie preferences. If you disable all cookies, you may not be able to take advantage of all features available at our Sites.

    (B)  Other Technologies

    We may use other technologies, including web beacons and JavaScript, which sometimes work together with cookies and other means with our Sites and Mobile Apps to uniquely identify your device. These other technologies help enable features on our Sites and within our Mobile Apps.

    We may also use certain technologies to determine whether you have opened an e-mail or clicked on a link contained in an e-mail.

    Please note the following:

    • We offer certain features that are available only through the use of cookies and other similar technologies.

    • We use both session and persistent cookies and other tracking technologies. Tracking technologies (e.g., cookies) can either be persistent (i.e., they remain on your computer until you delete them) or session-based (i.e., they last only until you close your browser). You are always free to decline tracking technologies if your browser permits, although doing so may interfere with your use of Online Services.

    • We may encode and protect the tracking cookies and other tracking technologies that McDonald’s sets, so that only we can interpret the information stored in them.

    • Where video is available on our Online Services, we may target and track the videos you view. You consent to our tracking of your video viewing through Online Services or third-party social media for up to two years, or as permitted by applicable law, or until consent is withdrawn.

  8. 8. Targeted Advertising

    On our Online Services, we may collect information about your online activities for use in providing you with advertising tailored to your individual interests. This section of our Privacy Statement provides details and explains how to exercise your choices.

    You may see certain ads on other websites because we participate in advertising networks. Ad networks allow us to target our messaging to users through demographic, interest-based and contextual means. These networks track your online activities over time by collecting information through automated means, including through the use of cookies, web server logs, web beacons and other technologies. The networks use this information to show you advertisements that may be tailored to your individual interests. The information our ad networks may collect includes information about your visits to websites that participate in the relevant advertising networks, such as the pages or advertisements you view and the actions you take on the websites. This data collection takes place both on our Online Services and on third-party websites that participate in the ad networks. This process also helps us evaluate our marketing efforts.

    Please note that even if you opt out, you will continue to receive advertisements, but they will not be tailored to your specific interests.

  9. 9. Links to Other Websites and Social Media

    Our Online Services may offer links to third-party websites that are not operated by McDonald’s. If you visit one of these linked websites, you should review the website’s privacy policy, terms and conditions, and other policies. We are not responsible for the policies and practices of third-parties. Any information you submit to those third-parties is subject to their privacy policy, terms and conditions, and other policies.

  10. 10. Information Security

    We will otherwise treat your personal information as private and confidential and will not disclose your information to anyone outside the McDonald’s Family except where:

    • where you have given permission, where we are required or permitted to do so by law;

    • where required or authorised by any order of court, tribunal or authority, whether governmental or quasi-governmental with jurisdiction over McDonald’s Family;

    • where we may transfer rights and obligations pursuant to our agreement(s) with you; and/or

    • where we are required to meet our obligations to any relevant regulatory authority (whether in or outside Malaysia).

    McDonald’s is committed to taking appropriate measures designed to keep personal information secure. We have in place technical, administrative, and physical procedures designed to protect personal information from accidental, unlawful or unauthorized loss, access, disclosure, use, alteration, or destruction. While we take efforts to safeguard our information systems, no website, mobile application, computer system, or transmission of data over the Internet or any other public network can be guaranteed to be 100% secure.

  11. 11. Retention of Personal Information

    We retain personal information for the period of time necessary to fulfill the purposes outlined in this Privacy Statement and per McDonald’s records retention policies unless a longer retention period is required or permitted by law.

  12. 12. International Data Transfers

    McDonald’s is a franchisee in the McDonald’s Family, a global organization with business processes, management structures and technical systems that cross borders. As such, we may share information about you within the McDonald’s Family and transfer it to countries in the world where the McDonald’s Family carries on business in connection with the uses identified above and in accordance with this Privacy Statement. These countries may not have the same level of legal data protection as the country in which you initially provided the information.

  13. 13. Changes to our Privacy

    We may change this Privacy Statement from time to time. If we change the Privacy Statement, we will post the revised version here and change the “Effective Date” listed at the top of this Statement. We encourage you to check our official website periodically for the most up-to-date version of our Statement.

  14. 14. Party Names

    Throughout this Statement, “McDonald’s” refers to GERBANG ALAF RESTAURANTS SDN BHD (Registration No. 198001011565 (65351-M)), the Developmental Licensee of McDonald’s in Malaysia.

  15. 15. How to Contact Us

    In line with our Standards of Business Conduct, we hold ourselves to ethical standards when it comes to data privacy and protection, and we welcome any feedback or questions you may have concerning the collection and processing of your personal information. Our contact details are as follows:

    Postal Address : Legal Department
    Gerbang Alaf Restaurants Sdn Bhd
    Level 6, Bangunan TH Damansara Uptown 3
    No. 3, Jalan SS 21/39, 47400 Petaling Jaya
    Selangor Darul Ehsan
    Malaysia
    Attention : Legal Director
    Email Address : [email protected]