01
Key definitions
This section provides simple explanations of terms used in this policy. Definitions are given with real-case examples where useful, for instance a buyer submitting documents for a property purchase or an agent uploading a developer's completion statement.
Personal data means information that identifies an individual, such as name, identification number, contact details, and transaction records. Example: buyer identity and contact details used to prepare SPA documents.
Processing refers to any operation performed on personal data — collection, recording, storage, consultation, sharing and deletion. Example: scanning an ID for a title application and storing it in a secure case file.
User denotes any person who interacts with HartanahHub services through HartanahHub.club, including buyers, sellers, agents, developers and mortgage officers involved in a case.
Service means the legal coordination, document preparation, title checks and related advisory activities provided by HartanahHub in connection with property transactions.
Cookies are small data files stored on a device to help HartanahHub.club recognize returning visitors, remember preferences and support analytics related to transaction workflows and content use.
02
Data we collect
We collect information needed to manage property cases efficiently. Below we list typical items submitted by users, data created automatically during site use, and information we may obtain from banks, developers or registries in the course of a transaction.
03
Information you provide
When you engage HartanahHub for legal coordination, you or your representative may provide the following items to complete your case file:
- Identity documents: national ID, passport or company registration for parties to the transaction
- Contact details: telephone numbers, email addresses, postal address (e.g. Jalan Padang Mat Sirat, Kampung Pokok Asam, 07000 Langkawi)
- Transaction documents: Sale and Purchase Agreements, deposit receipts, developer completion certificates and bank loan forms
- Business details as required for bank coordination: bank account identifiers, loan references and related correspondence
- Property details: title numbers, land office records, strata identifiers and floor plans supplied for due diligence
- Authorisations and consents: signed letters of authority, power of attorney or verification forms for third-party interactions
04
Information collected automatically
When you use HartanahHub.club or communicate with us, some data is generated automatically to help operate the site and manage cases.
- Log data: IP address, access times, pages viewed and browser type to diagnose issues and understand common case pathways
- Device information: operating system and device identifiers used to optimise the site interface for practical checklists and document uploads
- Session records: timestamps of document uploads and milestone confirmations for each transaction scenario
- Cookies and local storage data supporting user preferences and returning-case workflows
- Analytics derived data: aggregated patterns such as common delays at developer handover stages, used to improve guidance
- Error reports and diagnostic logs when document submission or title search processes fail
05
Data from third parties
To complete cases we routinely receive information from external parties; we limit requests to what is necessary for a scenario.
- Banks and business institutions: loan status, instrument lodgement confirmation and payment instructions
- Developers and agents: completion statements, OC copies, and handover schedules
- Government registries: land office title status, encumbrance records and official search results
06
Why we use personal data
We process personal data for a set of practical purposes tied to typical transaction cases. Each purpose is illustrated with an example workflow.
- To perform contract obligations: prepare and manage SPA documents and title mutation steps (example: coordinating deposit release and SPA signing).
- To communicate with stakeholders: schedule appointments, send milestone updates and request missing documents (example: notifying parties of land office appointment).
- To verify identity and ownership: perform title searches and ID checks necessary for registration and bank compliance (example: matching ID to land title for transfer).
- To liaise with banks and developers: platform necessary transaction details to complete lodgement and settlement (example: providing bank with signed instrument for stamping).
- To improve services: analyze anonymized case timelines to reduce common delays (example: reviewing developer handover cases to refine checklists).
- To comply with legal obligations: retain records for statutory reporting and audit related to property transactions (example: keeping copies of executed SPAs for statutory periods).
- To resolve disputes: retain correspondence and version history relevant to case resolution (example: preserving negotiation versions of SPA clauses).
- To protect rights and property: process data needed to prevent fraud or unauthorised transfers (example: flagging inconsistent title information during due diligence).
07
Legal basis for processing
We rely on lawful grounds aligned with the needs of each case. Typical grounds include contract performance, legal compliance and legitimate interests. For EU/EEA residents, additional details are given under the GDPR section.
- Performance of a contract: processing necessary to provide legal coordination and complete a property transaction.
- Legal obligation: processing required to comply with land office procedures, taxation rules or anti-funds laundering checks.
- Legitimate interests: processing to manage client relationships, detect fraud, and improve operational workflows where those interests are not overridden by individual rights.
- Consent: when you explicitly agree to optional marketing communications or non-essential processing activities.
08
Cookies and tracking technologies
HartanahHub.club uses cookies to support session management, preferences and analytics related to case flows. You can manage cookie settings as described below.
We use session cookies for secure logins, persistent cookies to remember preferences, and analytics cookies to measure usage patterns across common transaction scenarios.
Categories include: strictly necessary (required for case submission), performance (analytics on milestone bottlenecks), and functional (language and display preferences).
You can control cookie settings through your browser and via the cookie banner on HartanahHub.club. Disabling performance cookies may limit our ability to improve common case processes.
Full cookie policy for HartanahHub.club
09
How we share data
We share personal data only with parties directly involved in a transaction or where required by law. Sharing is limited to the minimal data needed for each specific case action.
- With banks and business intermediaries to process loan lodgement and settlement instructions.
- With developers, agents and other legal representatives to coordinate handover and documentation.
- With government authorities when required for registration, stamping or statutory compliance.
- With professional advisers such as surveyors or licensed valuers when their input is necessary for a case.
- With analytics providers in aggregated, anonymized form to improve service pathways and reduce delays in common scenarios.
- With successors or purchasers of HartanahHub business assets if ownership changes, limited to transaction-related records necessary for continuity.
10
International transfers
Some processing may involve transfer to service providers or partners outside Malaysia, for example when coordinating with foreign banks or foreign-based analytics providers. Transfers are limited and only done where necessary for the transaction.
When data is transferred internationally we use contractual safeguards, data minimization and vendor assessments to ensure appropriate protection consistent with the purposes described in this policy.
11
Data retention
Retention periods depend on the type of data and the transaction scenario. We retain records to meet legal requirements and to support potential post-completion enquiries.
Account and client records are kept for a minimum of 7 years after case closure to align with common professional and tax record-keeping practices in Malaysia.
Communications and case correspondence are retained for the duration of the transaction and for a period thereafter where necessary to resolve disputes or meet statutory obligations.
Technical logs and analytics are retained in aggregated or anonymized form for trend analysis; raw diagnostic logs are deleted once no longer needed to resolve issues, typically within 12 months.
On request and subject to statutory retention requirements, we will delete or anonymize personal data that is no longer necessary for the purposes for which it was collected.
12
Security of your information
We apply administrative, technical and physical safeguards to protect personal data, including access controls, encrypted storage for sensitive documents and regular security reviews. Security measures are designed around practical case workflows and risk scenarios such as fraudulent title claims or unauthorized document access.
- Encrypted storage of case files and document uploads with role-based access for assigned case managers.
- Two-factor authentication for sensitive account access and transaction approvals.
- Regular backups, vulnerability assessments and staff training on secure handling of client documents.
13
Your rights
Depending on applicable law and your status, you may have rights to access, correct, delete or restrict processing of your personal data. Below we summarise common rights and how they apply to typical property transaction scenarios.
- Access: request a copy of personal data we hold about you, for example the documents stored in your case file and a log of milestones.
- Correction and deletion: request correction of inaccurate data or deletion where retention is no longer required by law or case needs.
- Objection and restriction: object to certain processing activities or request restriction where legal bases permit, for example where processing is based on legitimate interests and you contest it.
- Request correction: You may request rectification of inaccurate personal data we hold about you, for example if your name, identity document number or contact details are incorrect. In practice we follow a documented scenario: a client provided an updated title deed and we corrected their profile within five business days after verifying documents.
- Request deletion: You can ask us to delete personal data when it is no longer necessary for the purpose collected. Example case: a prospective buyer withdrew from a purchase and asked to remove scanned ID from our intake records; we retained anonymised transaction logs for compliance and removed the identifying files within our standard retention schedule.
- Restriction of processing: You may request limitation of processing while a dispute over accuracy or lawfulness is resolved. A practical case involves a vendor contesting a data field used in a conveyancing checklist; we frozen further processing of that field pending review and documented the restriction.
- Object to processing: Where processing is based on our legitimate interests, you can object and we will assess whether our reasons override your interests. Scenario: an owner objected to marketing communications targeted by property type; we suspended targeted communications to that owner and reviewed the profiling criteria.
- Portability: Where technically feasible, we can provide your personal data in a structured, commonly used, machine-readable format to you or another controller. Case example: transferring client contact and transaction summaries to a new legal advisor via secure encrypted file transfer on client instruction.
14
Information for EU/EEA residents
Although HartanahHub is based in Malaysia, certain GDPR provisions may apply when we process personal data of individuals located in the European Economic Area in connection with offering services or monitoring behaviour. This section describes how we approach data subjects' rights and our legal bases in cross-border scenarios, with examples and documented workflows that demonstrate our compliance steps.
GDPR applicability is assessed case-by-case. For example, when an EEA-based buyer instructs HartanahHub on due diligence for a Malaysian property, we conduct a data flow assessment, identify legal bases for processing, and communicate rights and retention timelines in writing. If you are located in the EEA and believe GDPR applies to you, contact us so we can confirm the applicable safeguards.
- Lawful bases: We rely on contract performance, legal obligations (e.g., anti-funds laundering checks), legitimate interests (limited, balanced against your rights) and, where required, explicit consent for marketing communications. Example: identity verification is processed under legal obligations and contract performance when completing conveyancing.
- Transfers outside EEA: When data is transferred outside the EEA, we implement appropriate safeguards such as standard contractual clauses or rely on adequacy determinations where available. Practical case: sharing due diligence reports with a foreign tax advisor under contractual safeguards and encrypted channels.
- Data protection by design: For cross-border transactions we document minimisation and encryption measures. Scenario: a multi-jurisdiction purchase required segregated access to sensitive files; we created role-based controls and audit trails to limit exposure.
- Record keeping and accountability: We keep a record of processing activities relevant to EEA data subjects and can provide summaries to supervisory authorities when lawfully requested. Example: a compliance audit required export of processing logs for a specific transaction; we produced a redacted activity log demonstrating lawful bases and retention dates.
If you consider we processed your personal data in breach of GDPR when applicable, you can raise a complaint with HartanahHub through our contact channels. We will contribute and respond according to our internal escalation matrix. If unresolved, you have the right to lodge a complaint with the relevant supervisory authority in your jurisdiction.
15
How to exercise your privacy rights
To request access, correction, deletion, portability, restriction or objection, contact our Data Protection Officer at the address below or via email. Include your full name, Business ID or client reference where available, and supporting documentation to verify identity. We respond based on the scenario presented and may request additional information to prevent unauthorised disclosure.
[email protected]
We aim to acknowledge receipt of rights requests within 5 business days and to provide a substantive response within 30 calendar days. For complex requests that require additional verification or consultations with third parties, we will inform you of any reasonable extension and the reasons for delay.
16
Marketing communications and profiling
We use contact details to send property alerts, legal updates and event invitations relevant to real estate transactions. Marketing messages are sent based on preferences you provide. Example: a client selected 'commercial property alerts' and received a tailored bulletin with case studies on lease assignments. Profiling is limited to improving service relevance and we document profiling rules and decision processes.
You can opt out of marketing at any time by clicking the unsubscribe link in emails or by contacting us directly. Upon receiving an unsubscribe request we will stop promotional messages within 5 business days while retaining transactional messages necessary for an active instruction or legal compliance.
17
Children's data
Services provided by HartanahHub are directed to adults involved in property transactions. We do not knowingly collect personal data from children for marketing purposes. If we become aware that a minor's data was collected without appropriate consent, we take steps to delete the data unless processing is necessary for a legitimate professional purpose under law.
18
Third-party links and referrals
Our site may link to third-party services such as local land registry portals, escrow providers and valuation platforms. These services have separate privacy notices. Example: when we refer you to an independent surveyor, their data handling is governed by their own policy. We recommend reviewing third-party privacy terms before providing personal data.
19
Changes to this privacy policy
We review this policy periodically to reflect legal or operational changes. Material changes will be posted on HartanahHub.club with the effective date and, where required, we will notify clients directly. A practical case: an update to retention schedules following a regulatory change is summarised and communicated to affected clients with implementation instructions.