Privacy Policy
1. Data Controller Information
Data Controller: Harta Pribumi Heritage(CA0426810-X)
Address: Kenwingston Business Centre, Persiaran Bestari, 63000 Cyberjaya, Selangor, Malaysia
Privacy Email: [email protected]
Phone: +60 11-5458 3515
Hartanah Bumiputera is a trading name owned and operated by Harta Pribumi Heritage.
If you have any questions regarding how we process your personal data, please contact our Data Protection Officer at the address above.
2. Personal Data We Collect
2.1 Data You Provide Directly
| Data Category | Example | Collection Purpose |
|---|---|---|
| Identity Information | Full Name, Profile Photo | Account Verification, Profile Display |
| Contact Information | Email address, phone number | Communication, important notices |
| Professional information | REN number, company name | Licensed Agent Verification |
| Uploaded content | Property photos, description | Property listing views |
| Transaction Details | Subscription payment record | Premium subscription management |
2.2 Data Collected Automatically
- Usage data: Pages visited, access time, searches performed, properties viewed.
- Technical data: IP address, browser type, operating system, device used.
- Cookie data: Session cookies for login authentication, preference cookies (language, display settings).
- Analytics data: Number of listing views, link clicks, shares, initiated contacts (for agents).
2.3 Data from Third Parties
- Google OAuth: Name, email address, and profile photo when you sign in using Google. We only receive basic public profile information.
- Payment provider: Payment status and transaction reference only — we do not store credit card details directly.
3. Purpose of Data Processing
We process your personal data for the following purposes:
- Service Delivery: Managing your account, displaying property listings, facilitating communication between buyers/tenants and agents.
- Platform Security: Detecting and preventing fraud, abuse, and illegal activity.
- Service Improvement: Analysing usage patterns to enhance Platform features and user experience.
- Communication: Sending service notices, policy updates, security alerts, and (with your consent) marketing communications.
- Legal Compliance: Complying with legal obligations, including court orders and requests from law enforcement authorities.
- Dispute Resolution: Handling complaints, appeals, and legal action.
4. Legal Basis of Processing
Under PDPA 2010, we process personal data based on the following grounds:
- Consent: You agree to this Policy when registering and using the Platform.
- Contract: Processing necessary to execute the agreement between you and the Platform.
- Legitimate Interest: Processing for Platform security, fraud prevention, and service improvement.
- Legal Obligations: Compliance with relevant Malaysian laws.
4.1 Specific Consent for Data Processing and Hosting
By registering, completing your profile, or posting a property Listing on the Platform, you hereby agree and provide explicit consent that your personal data — including but not limited to mobile phone number, email address, REN (Registration of Estate Agent) number and your company/agency details — will be processed and hosted within the Platform for the purposes stated in this Policy, including display to other users (e.g., buyers/tenants) to enable property connections and transactions. If you do not agree with this processing, you are advised not to register or post such information on the Platform.
5. Data Sharing with Third Parties
We do not sell your personal data to any third parties. We only share data in the following circumstances:
| Recipient | Shared Data | Purpose |
|---|---|---|
| Service provider (hosting, email) | Technical Information Required | Platform Operations |
| Google LLC | OAuth token only | Google Sign-In Verification |
| Payment provider | Transaction Details | Processing subscription |
| Enforcement authority | By court order | Legal compliance |
| BOVAEA | Agent REN Number | Agent licence verification |
All third-party service providers are required to comply with PDPA 2010 and are not permitted to use your data for other purposes.
6. Cross-Border Data Transfer
Some of our service providers (such as Google) operate outside Malaysia. Cross-border data transfers are only carried out when:
- The recipient country has a data protection level equivalent to Malaysia.
- An appropriate data protection agreement has been implemented.
- You have given explicit consent for the said transfer.
Such transfer is subject to regulations prescribed under Section 129 PDPA 2010.
7. Data Retention Period
| Data Type | Storage Period | Reason |
|---|---|---|
| Active account data | Throughout active account + 2 years | Dispute resolution |
| Property Listings | 3 years after listing expires | Transaction Records |
| Log analytics | 24 months rolling | Service improvement |
| Payment Records | 7 Years | Tax requirements (LHDN) |
| Security Log | 12 months | Security incident investigation |
After the retention period expires, data will be securely deleted or fully anonymised.
8. Your Rights Under PDPA 2010
To submit applications related to the above rights, email [email protected] with subject "PDPA APPLICATION". We will respond within 21 working days as required by law.
9. Cookies and Tracking Technologies
9.1 Cookie Types
- Essential Cookies: Session sign-in token — required for basic Platform functions. Cannot be disabled.
- Functional Cookies: Saves display preferences and language settings. Can be disabled without affecting core functions.
- Analytics Cookies: Helps us understand how users interact with the Platform for improvement purposes.
9.2 Cookie Management
You can control and delete cookies through your browser settings. However, disabling essential cookies may impair sign-in functions and Platform usability.
10. Data Security
We implement appropriate technical and organisational security measures to protect your personal data, including:
- Data encryption in transit (TLS/HTTPS) and at rest.
- Role-based access control — staff only access data required for their duties.
- Periodic security audits and penetration testing.
- Data incident response procedure compliant with notification requirements under PDPA 2010.
In the event of a material data breach, we will notify the PDPA Commissioner and affected users within the timeframe prescribed by law.
11. Children's Privacy
This platform is not intended for individuals under 18 years of age. We do not knowingly collect children's personal data. Should we discover that a child's data has been collected without parental or guardian consent, we will delete it immediately. Parents who find that their child has registered an account may contact us for data deletion.
12. Link to Third-Party Website
The Platform may contain links to third-party websites. This Privacy Policy does not apply to those websites. We encourage you to read the privacy policy of every website you visit.
13. Privacy Policy Amendment
We reserve the right to amend this Privacy Policy at any time to reflect changes in law, technology, or our business practices. Material amendments will be notified to you via email or prominent notice on the Platform at least 14 days before taking effect. Continued use of the Platform after the effective date is deemed acceptance of the amended Policy.
14. Governing Laws
This Privacy Policy is governed by Malaysian law, specifically:
- Personal Data Protection Act 2010 (PDPA 2010)
- Communications and Multimedia Act 1998
- Computer Crimes Act 1997
Contact our Data Protection Officer: [email protected] | Phone: +60 11-5458 3515 | Office hours: Monday–Friday, 9 am – 6 pm
Privacy Policy
1. Data Controller Information
Data Controller: Harta Pribumi Heritage(CA0426810-X)
Address: Kenwingston Business Centre, Persiaran Bestari, 63000 Cyberjaya, Selangor, Malaysia
Privacy Email: [email protected]
Phone: +60 11-5458 3515
Hartanah Bumiputera is the trading name owned and operated by Harta Pribumi Heritage.
If you have any questions about how we process your personal data, please contact our Data Protection Officer at the address above.
2. Personal Data We Collect
2.1 Data You Provide Directly
| Data Category | Examples | Purpose of Collection |
|---|---|---|
| Identity information | Full name, profile photo | Account verification, profile display |
| Contact information | Email address, phone number | Communication, important notices |
| Professional information | REN number, company name | Licensed agent verification |
| Uploaded content | Property photos, descriptions | Property listing display |
| Transaction information | Subscription payment records | Premium Subscription Management |
2.2 Data Collected Automatically
- Usage data: Pages visited, access time, searches performed, properties viewed.
- Technical data: IP address, browser type, operating system, device used.
- Cookie data: Session cookies for login verification, preference cookies (language, display settings).
- Analytics data: Number of listing views, link clicks, shares, contacts initiated (for agents).
2.3 Data from Third Parties
- Google OAuth: Name, email address, and profile photo when you log in using Google. We only receive basic public profile information.
- Payment providers: Payment status and transaction reference only — we do not store credit card details directly.
3. Purpose of Data Processing
We process your personal data for the following purposes:
- Service Delivery: Managing your account, displaying property listings, facilitating communication between buyers/tenants and agents.
- Platform Security: Detecting and preventing fraud, abuse, and unlawful activity.
- Service Improvement: Analysing usage patterns to enhance the Platform's functionality and user experience.
- Communication: Sending service notices, policy updates, security alerts, and (with your consent) marketing communications.
- Legal Compliance: Complying with legal obligations, including court orders and requests from enforcement authorities.
- Dispute Resolution: Managing complaints, appeals, and legal action.
4. Legal Basis for Processing
Under PDPA 2010, we process personal data based on the following grounds:
- Consent: You agree to this Policy when registering and using the Platform.
- Contract: Processing necessary to perform the agreement between you and the Platform.
- Legitimate Interest: Processing for Platform security, fraud prevention, and service improvement.
- Legal Obligation: Compliance with applicable Malaysian law.
4.1 Specific Consent for Processing and Hosting of Data
By registering, completing your profile, or posting a property listing on the Platform, you hereby agree and provide explicit consent that your personal data — including but not limited to your mobile phone number, email address, REN (Registration of Estate Agent) number, and company/agency details — will be processed and hosted on the Platform for the purposes stated in this Policy, including display to other users (e.g. buyers/tenants) to enable contact and property dealings to be carried out. If you do not agree to this processing, you are advised not to register or post such information on the Platform.
5. Third-Party Data Sharing
We do not sell your personal data to any third party. We only share data under the following circumstances:
| Recipient | Data Shared | Purpose |
|---|---|---|
| Service providers (hosting, email) | Necessary technical information | Platform operations |
| Google LLC | OAuth token only | Google login verification |
| Payment providers | Transaction information | Subscription processing |
| Enforcement authorities | Pursuant to court order | Legal compliance |
| BOVAEA | Agent's REN number | Agent licence verification |
All third-party service providers are required to comply with PDPA 2010 and are not permitted to use your data for any other purpose.
6. Cross-Border Data Transfer
Some of our service providers (such as Google) operate outside Malaysia. Cross-border data transfers are only carried out when:
- The recipient country has a level of data protection equivalent to Malaysia's.
- Appropriate data protection agreements have been implemented.
- You have given explicit consent for the transfer.
Such transfers are subject to the rules set out under Section 129 of PDPA 2010.
7. Data Retention Period
| Data Type | Retention Period | Reason |
|---|---|---|
| Active account data | For as long as the account is active + 2 years | Dispute resolution |
| Property listings | 3 years after listing expiry | Transaction records |
| Analytics logs | 24-month rolling window | Service improvement |
| Payment records | 7 years | Tax requirements (LHDN) |
| Security logs | 12 months | Security incident investigation |
After the retention period expires, data will be securely deleted or fully anonymised.
8. Your Rights Under PDPA 2010
To submit a request relating to the rights above, email [email protected] with the subject "PDPA REQUEST". We will respond within 21 working days as required by law.
9. Cookies and Tracking Technologies
9.1 Types of Cookies
- Essential Cookies: Login session tokens — required for the Platform's basic functions. Cannot be disabled.
- Functional Cookies: Store display preferences and language settings. Can be disabled without affecting core functionality.
- Analytics Cookies: Help us understand how users interact with the Platform for improvement purposes.
9.2 Cookie Management
You may control and delete cookies through your browser settings. However, disabling essential cookies may affect login functionality and use of the Platform.
10. Data Security
We implement appropriate technical and organisational security measures to protect your personal data, including:
- Encryption of data in transit (TLS/HTTPS) and at rest.
- Role-based access controls — staff only access data necessary for their duties.
- Regular security audits and penetration testing.
- Data incident response procedures that comply with notification requirements under PDPA 2010.
In the event of a material data breach, we will notify the PDPA Commissioner and affected users within the time frame prescribed by law.
11. Children's Privacy
This Platform is not directed at individuals under the age of 18. We do not knowingly collect children's personal data. If we discover that a child's data has been collected without parental or guardian consent, we will delete it promptly. Parents who find that their child has registered an account may contact us to have the data deleted.
12. Third-Party Website Links
The Platform may contain links to third-party websites. This Privacy Policy does not apply to such websites. We encourage you to read the privacy policy of every website you visit.
13. Privacy Policy Amendments
We reserve the right to amend this Privacy Policy at any time to reflect changes in law, technology, or our business practices. Material amendments will be communicated to you via email or a prominent notice on the Platform at least 14 days before they take effect. Continued use of the Platform after the effective date is deemed acceptance of the amended Policy.
14. Governing Law
This Privacy Policy is governed by the laws of Malaysia, specifically:
- Personal Data Protection Act 2010 (PDPA 2010)
- Communications and Multimedia Act 1998
- Computer Crimes Act 1997
Contact our Data Protection Officer: [email protected] | Phone: +60 11-5458 3515 | Office hours: Monday–Friday, 9am – 6pm
