Privacy Policy

1. Who we are

This website and its services are operated by Malaysia Property Guide. For the purposes of the PDPA, Malaysia Property Guide is responsible for the personal data described in this policy. In this policy, “we”, “us” and “our” mean Malaysia Property Guide, and “you” means anyone who uses the site.

The technology and software that run this website are owned by City Commerce Sdn Bhd, a company registered in Malaysia.

Questions about this policy, or about your personal data, go to info@malaysiapropertyguide.com.

2. What this policy covers

This policy applies to the Malaysia Property Guide website and to everything you do on it, including:

It does not cover the websites of other companies that we link to, or the pages of our payment providers, which are governed by their own privacy notices.

• joining the waitlist for the course;
• pre-registering for a book that is not published yet;
• creating and using an account;
• buying the video course or the ebook;
• booking and attending a paid consultation;
• contacting us through the contact form, by email or on WhatsApp.

3. The personal data we collect

We collect only what the activity you are doing needs. Depending on what you do, we may collect the following.

We never receive your card number, expiry date or security code. You enter those on our payment provider’s secure form, and we receive only the amount, the currency, the outcome of the payment and the provider’s reference for it.

We do not ask for sensitive personal data as the PDPA defines it, such as health information, political or religious beliefs or criminal records. Please do not send it to us.

• Waitlist — your full name, your email address and your mobile number.
• Book pre-registration — your first and last name, your email address, your mobile number and the book you pre-registered for.
• Contact form — your name, your email address, your mobile number if you give it, the subject you choose and your message. Messages reach us by email and are not stored in our database.
• Account — your name, email address, mobile number, preferred language and time zone, and a password if you choose one. Passwords are stored only as one-way hashes and cannot be read back.
• Sign-in and verification — one-time codes and sign-in links that we send by email or WhatsApp, stored in hashed form with an expiry time, and the IP address that requested them.
• Purchases — what you bought, the amount and currency, whether payment completed, the payment provider’s reference, the mobile number you gave at checkout and any discount code you used. If you buy the ebook, your email address is printed on every page of your copy.
• Consultations — the session you booked and its time, the time zone and language you booked in, a copy of your name, email address and phone number as they were when you booked, any notes you wrote for the consultant, and the meeting link.
• Course progress — which lessons you have started and finished, so that the site can put you back where you stopped.
• WhatsApp — the messages you send us, our replies, and whether the messages we send you were delivered and read.
• Click records — when you press a button or link on a public page: the page, the button or link and where it leads, the date and time, your IP address, your approximate country, your device type, browser and operating system, and the host name of the site you came from (never its full address).
• Sign-in records — when you sign in to your account: the time, the IP address you signed in from and the country it belongs to, your device type, browser and operating system (read from your browser's identification string, which we do not keep), and whether you used a password or an email link. We also note the last time you were active in the member area.
• Technical data — your IP address as it reaches our server when a page is served. We also use a shortened form of your IP address to sign the video links issued to you, so that a link cannot be used from another network.

4. Why we use it, and on what basis

We use personal data only for the purposes below. Each item we ask for serves one of them, and we do not collect data in case it might be useful later.

We rely on your consent, given when you submit a form that says what it is for, or on any other basis the PDPA allows: for example, where the processing is necessary to perform a contract with you, such as when you buy a course or a consultation, or to comply with a legal obligation.

• To send you news and offers about the course by email or WhatsApp after you join the waitlist, and to tell you when a book you pre-registered for is ready.
• To create and run your account, and to keep you signed in if you choose.
• To take payment, issue your receipt and give you access to what you bought.
• To schedule your consultation, send you the meeting link and let the consultant prepare for the call.
• To remember your progress through the course.
• To reply to you when you contact us by the contact form, by email or on WhatsApp.
• To keep the site secure, including limiting repeated requests, detecting abuse and stopping paid video links being shared with other people.
• To understand which links and buttons visitors use, and from which countries and devices, so that we can improve the site.
• To keep the accounting and tax records that Malaysian law requires.

5. Your consent

Where we rely on your consent, you can withdraw it at any time by emailing info@malaysiapropertyguide.com or, for offer emails, by using the unsubscribe link they carry. Withdrawing consent stops further processing based on it. It does not undo what has already happened, and it does not remove records that the law requires us to keep.

If you decline to give us information that a service needs, we may not be able to provide that service. For example, without an email address we cannot tell you when the course opens.

6. Who we share it with

We do not sell, rent or trade your personal data, and we do not send your name, email address or mobile number to any advertiser or data broker. We share personal data only with the service providers that run the site, and only the part each one needs to do its job. Payment providers and Google also handle what they receive under their own privacy policies, as sections 2 and 12 explain:

We may also disclose personal data where the law requires it, to a court or a regulator, or to establish or defend a legal claim, for example if you dispute a payment with your bank. Our video is served from our own server, not from a third-party video platform.

• Payment providers — Stripe, which takes card and FPX bank-transfer payments, and PayPal where it is offered at checkout. They receive what a payment needs and send us back only the outcome and its reference.
• Email delivery — Mailgun, which sends our receipts, sign-in links, verification codes and messages to your email address.
• WhatsApp gateway — the messaging service that carries our WhatsApp messages and verification codes to the mobile number you gave us, and carries your replies back to us.
• Hosting — our hosting provider, which runs the servers and the database on which the site and its data are kept.
• Google Analytics — measures how visitors reach and use the site, as described in section 12.
• Google Fonts — serves the typefaces the pages are set in. The request reveals your IP address and browser to Google.
• Consultants — the consultant taking your session sees your name, your contact details and any notes you wrote, so that they can prepare for and hold the call.

7. Transfers outside Malaysia

Some of our providers process data outside Malaysia. Google, Stripe and PayPal operate internationally, and our email and hosting providers may hold data in other countries. Data about you will also cross a border whenever you use the site from outside Malaysia.

Where we transfer personal data outside Malaysia, we do so only as the PDPA allows, for example with your consent, or where the transfer is necessary to perform a contract with you or to carry out steps you have asked for. We send each provider only what it needs.

8. How long we keep it

We keep personal data only for as long as the purpose it was collected for requires, and then we delete it or make it anonymous. The periods below are the ones the site applies.

• Waitlist entries and book pre-registrations — until you ask us to remove you, or until we no longer need them to tell you about the course or the book.
• Your account — for as long as you have an account with us.
• Verification codes and sign-in links — minutes. They expire on a timer and cannot be used afterwards.
• Consultation notes — 24 months after the session, then erased automatically.
• Click records — 400 days, then deleted automatically.
• Sign-in records — 400 days, then deleted automatically, and deleted at once if you ask us to erase your data.
• Purchase and booking records — for as long as Malaysian accounting and tax record-keeping law requires, and as needed to deal with a payment dispute.
• WhatsApp messages — for as long as they are needed to reply to you and to keep track of our dealings with you.
• Server logs — for as long as our hosting provider keeps them in the ordinary course of running its servers.

9. How we protect it

The site is served over HTTPS. Passwords are stored only as one-way hashes that cannot be read back, by us or by anyone who obtains the database. Verification codes and sign-in links are stored in the same way, expire quickly and can be used only once. Card details never enter our systems.

Access to the administration panel is limited to our own staff and protected by a password. Paid video is served through short-lived signed links tied to the network you are watching from, so a link copied from one person’s browser does not work in another person’s.

No system is perfectly secure, and we do not claim otherwise. If a breach affecting your personal data occurs, we will act on it, and we will tell you and the relevant authority where the law requires it or where it is appropriate.

10. Your rights

Under the PDPA you have the following rights over your personal data, and we will respect them:

To use any of these rights, email info@malaysiapropertyguide.com from the address we hold for you, or tell us in your message which email address or mobile number your request relates to, so that we can confirm it is you. We will respond within 21 days. The PDPA allows a fee for a data access request. We do not intend to charge one, and we will tell you before charging anything.

If you are not satisfied with how we handle your request, you may complain to the Personal Data Protection Commissioner of Malaysia. We would rather you told us first, so that we can put it right.

• Access — ask for a copy of the personal data we hold about you.
• Correction — ask us to correct data that is inaccurate, incomplete or out of date. You can change your name, email address, mobile number, language and time zone yourself in your account.
• Withdraw consent — ask us to stop processing data based on your consent, including all marketing.
• Stop direct marketing — ask us to stop using your data for direct marketing.
• Stop harmful processing — ask us to stop processing that causes, or is likely to cause, you substantial damage or distress.
• Erasure — ask us to remove your identity from our records, except the records the law requires us to keep (see section 8).

11. Children

This site is for adults who buy, or consider buying, property. We do not direct it at children and we do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, tell us at info@malaysiapropertyguide.com and we will delete it.

12. Cookies and analytics

The site sets a small number of cookies: a session cookie, a security token and, if you choose it, a “remember me” cookie. Our Cookie Policy lists each one, what it does and how long it lasts.

We use Google Analytics 4 to measure how visitors reach and use the site. It sets two cookies, and it receives the pages you visit, your approximate location derived from your IP address, and your device and browser, under a random identifier rather than your name. We do not send it your name, email address or mobile number. We have turned on Google’s advertising features, so Google can use this data to build audiences for advertising on its networks. Where you are signed in to a Google account, Google may link this visit to your activity on your other devices. For visitors in the European Economic Area, the United Kingdom and Switzerland, analytics and advertising storage is switched off, so measurement there is limited. Our Cookie Policy explains how to block these cookies anywhere else.

The click records described in section 3 are our own. They are stored on our server, they do not use cookies, and they carry no user identifier.

13. Changes to this policy

We will update this policy when what we do with personal data changes, for example when we add a provider, a new purpose or a new retention period. The “last updated” date at the top shows which version you are reading. Where a change is significant, we will tell the people it affects.

14. Contact us

For privacy questions, requests to see or correct your data, and complaints, email info@malaysiapropertyguide.com.