PDPA Compliance Notice

Act: Personal Data Protection Act 2010 (Act 709) Effective: 15 March 2026 Regulator: JPDP Malaysia Version: 1.0

🛡️ This notice is issued by SLV Group Sdn. Bhd. (operator of PropertyHub.my) in compliance with Malaysia's Personal Data Protection Act 2010 (PDPA / Act 709). It sets out our obligations as a data processor and your rights as a data subject.

1. Data Controller Information

The data controller responsible for your personal data is:

Company Name: SLV Group Sdn. Bhd.
Platform: PropertyHub.my
Registration: Malaysia (SSM Registered)
Data Protection Officer: Designated DPO, SLV Group Sdn. Bhd.
DPO Contact: privacy@propertyhub.my
Postal Address: SLV Group Sdn. Bhd., Kuala Lumpur, Malaysia

2. The Seven PDPA Principles

PropertyHub.my processes personal data in accordance with all seven principles of the PDPA 2010:

⚖️

1. General Principle — Consent

We process personal data only with the data subject's consent, except where permitted by law. You provide consent when registering, making a booking, or submitting a dispute.

🎯

2. Notice & Choice Principle

We notify you of the purposes for which your data is collected at the point of collection via this notice, our Privacy Policy, and registration forms. You have the right to choose whether to provide optional data.

🔍

3. Disclosure Principle

We do not disclose your personal data to third parties except as described in our Privacy Policy and this notice. All data sharing is limited to purposes directly related to platform operation.

🔒

4. Security Principle

We implement appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, modification, or disclosure. This includes SSL encryption, password hashing, and access controls.

✅

5. Retention Principle

Personal data is retained only for as long as necessary for the stated purpose or as required by law. Financial records are retained for 7 years per Malaysian statutory requirements.

📋

6. Data Integrity Principle

We take reasonable steps to ensure personal data is accurate, complete, and up to date. You may update your data through your account settings at any time.

👁️

7. Access Principle

You have the right to access and correct your personal data held by us. Requests may be submitted to privacy@propertyhub.my and will be processed within 21 days.

3. Categories of Personal Data Collected

We collect the following categories of personal data:

Identity Data: Full name, IC number (for verified Partners only), date of birth.
Contact Data: Email address, phone number, WhatsApp number, residential address (unit number and building).
Account Data: Username, encrypted password, account type, registration date.
Transaction Data: Booking references, amounts paid, payment method, payment gateway references.
Service Data: Service descriptions, listing photos, availability, pricing set by Partners.
Communications Data: Messages sent through the platform, dispute submissions, support enquiries.
Technical Data: IP address, browser type, device type, cookies, session data.
Usage Data: Pages visited, search queries, listings viewed, booking history.

📌 We do not collect sensitive personal data as defined under the PDPA (race, religion, health, political opinions, criminal record) unless voluntarily and explicitly provided in a dispute description.

4. Purposes of Processing

Personal data is processed for the following specific purposes:

Account creation, authentication, and management.
Facilitating bookings between Residents and Partners.
Processing payments and generating digital receipts.
Operating the TribunalBot dispute resolution system.
Sending transactional communications (booking confirmations, receipts, reminders).
Verifying Partner credentials and qualifications.
Detecting fraud and preventing misuse of the platform.
Complying with legal and regulatory obligations under Malaysian law.
Analysing platform usage to improve features and user experience (anonymised).
Marketing communications (only with your explicit consent, opt-out available at any time).

5. Legal Basis for Processing

Under PDPA 2010, we rely on the following legal bases:

Consent: For account registration, marketing communications, and optional data collection.
Contractual Necessity: For processing bookings, payments, and delivering platform services.
Legal Obligation: For financial record-keeping, anti-money laundering compliance, and responding to regulatory requests.
Legitimate Interest: For fraud detection, platform security, and anonymised analytics.

✅ Where we rely on consent as the legal basis, you may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.

6. Data Transfers & Third Parties

6.1 Service Partners Within the Platform

When you make a booking, relevant booking details (name, unit number, date, service requested) are shared with the Partner providing the service. This is necessary to fulfil the contract.

6.2 Payment Processors

Transaction data is shared with certified payment gateways: iPay88 Sdn. Bhd., Touch 'n Go Digital Sdn. Bhd., PayNet (FPX), and DuitNow. These providers are bound by Bank Negara Malaysia regulations and their own PCI DSS compliance obligations.

6.3 AI Processing (Claude API)

TribunalBot uses the Anthropic Claude API for dispute analysis. Dispute-related data submitted for AI review may be processed on Anthropic's servers. We implement data minimisation — only dispute content relevant to the case is transmitted, and personally identifiable information is minimised where possible.

6.4 Cloud Hosting

Our platform is hosted on Hostinger servers. Data is primarily stored in servers located within or compliant with applicable data protection standards. We do not intentionally transfer personal data outside Malaysia except as described above.

6.5 No Data Sales

We do not sell, rent, or trade personal data to any third party for their own commercial purposes.

7. Your Rights as a Data Subject

Under PDPA 2010, you have the following rights:

👁️
Right of Access

Request a copy of the personal data we hold about you. We will provide this within 21 days.

✏️
Right of Correction

Request correction of inaccurate, incomplete, or outdated personal data held about you.

🚫
Right to Withdraw Consent

Withdraw consent for processing where consent is the legal basis (e.g. marketing emails). Withdrawal does not affect prior lawful processing.

⛔
Right to Limit Processing

Request that we stop or limit processing of your data for specific purposes, where there is no overriding legitimate interest or legal obligation.

📦
Right to Data Portability

Request a copy of your data in a structured, commonly-used, machine-readable format (e.g. CSV or JSON).

🗑️
Right to Erasure

Request deletion of your personal data, subject to our legal retention obligations (e.g. financial records required by law to be retained for 7 years).

⚠️ Some rights may be limited where processing is necessary for legal compliance, contractual obligations, or fraud prevention. We will always explain the basis for any limitation.

8. How to Exercise Your Rights

📋 Submit a Data Subject Request

To exercise any of your rights under PDPA, follow these steps:

Email us at privacy@propertyhub.my with the subject line "PDPA Data Request"

Include your full name, email address registered on the platform, and the specific right you wish to exercise

We may request proof of identity to verify your request (e.g. a photo of your IC)

We will acknowledge your request within 3 business days and respond within 21 days

Data access requests are provided free of charge for the first request per year

9. Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will:

Notify the Department of Personal Data Protection Malaysia (JPDP) within 72 hours of becoming aware of the breach.
Notify affected data subjects without undue delay if the breach is likely to result in significant harm.
Provide information on the nature of the breach, categories of data affected, approximate number of individuals affected, and steps taken to mitigate the breach.

To report a suspected security issue or data breach, contact security@propertyhub.my immediately.

10. Complaints & Regulatory Authority

If you believe we have not handled your personal data in accordance with PDPA 2010, you may:

First contact us at privacy@propertyhub.my to resolve the matter directly.
If unsatisfied with our response, lodge a complaint with:

🏛️ Department of Personal Data Protection Malaysia (JPDP)

Website: www.pdp.gov.my
Email: aduan@pdp.gov.my
Phone: 03-8911 5000
Address: Aras 3, Blok F2, Kompleks F, Pusat Pentadbiran Kerajaan Persekutuan, 62530 Putrajaya

🛡️ Data Protection Enquiries

Our Data Protection Officer is available to assist with any PDPA-related questions.

privacy@propertyhub.my