Privacy Notice

Last updated: 2026-09-29

This notice explains how RumahHQ Development Sdn Bhd ("RumahHQ", "we", "us") processes your personal data under the Personal Data Protection Act 2010 [Act 709], as amended by the Personal Data Protection (Amendment) Act 2024 [Act A1727]. It is our written notice under the Notice and Choice Principle (section 7) and applies to this website, our forms, and our WhatsApp, phone and email conversations with you. It is issued in Bahasa Malaysia and English; if they differ, the Bahasa Malaysia version prevails.

On this page

1. 1. Key terms
2. 2. The law and when the 2024 amendments took effect
3. 3. The seven principles and how we apply them
4. 4. The data we collect
5. 5. Where your data comes from
6. 6. Why we use your data
7. 7. Who we share it with
8. 8. Transfers outside Malaysia
9. 9. How we protect your data
10. 10. How long we keep it
11. 11. Your rights
12. 12. How to make a request
13. 13. Withdrawing consent and stopping marketing
14. 14. Data Protection Officer
15. 15. Language of this notice and changes
16. 16. Contact us
17. 17. Complaints to the Commissioner
18. Frequently asked questions

1. Key terms

• Personal data: information about you in connection with a commercial transaction from which you can be identified, such as your name, phone number or the answers you give in a form.
• Sensitive personal data: information about physical or mental health, political opinions, religious or similar beliefs, the commission or alleged commission of an offence and, since 1 April 2025, biometric data. We do not ask for any of these on this website.
• Data controller: the party that decides why and how personal data is processed. For your data here, that is RumahHQ Development Sdn Bhd. The Act called this a "data user" until the 2024 amendment renamed it from 1 April 2025.
• Data processor: a party that processes personal data only on the data controller's behalf, such as a hosting or messaging provider.
• Data subject: you, the person the data is about. Under the amended Act this does not include a deceased person.

2. The law and when the 2024 amendments took effect

The Personal Data Protection (Amendment) Act 2024 received Royal Assent on 9 October 2024. The Minister of Digital brought it into force in three stages by gazette notification P.U. (B) 522, dated 19 December 2024.

3. The seven principles and how we apply them

Section 5 of the Act requires every data controller to follow seven Personal Data Protection Principles.

4. The data we collect

4.1 Data you give us in each form

4.2 Data recorded with every form

• Your consent record: that you ticked the privacy consent box, the version of this notice (currently 2026-09-29) and the time; and whether you ticked the separate, optional marketing box.
• The page and language you used, and campaign details of how you arrived (for example utm_source, gclid or fbclid, the first page you landed on and the referring website).
• The type of phone number you gave (Malaysian mobile, landline or international), worked out from the number itself.
• The country your connection comes from. Your IP address is used at the moment you submit, to limit repeated submissions and to run the anti-spam check; we do not put it in your customer record.

4.3 Other ways you give us data

• WhatsApp with Aiman, our WhatsApp AI agent, and our team: your number, your WhatsApp profile name and what you write.
• Email and phone: your address or number and what you tell us.
• The eligibility calculator runs in your browser and sends no data. Only if you press the button to ask for help does it pass your income and commitment ranges to the Register Interest form, inside your browser tab, for you to review before sending.
• Cookies and browser storage: see the Cookie Policy.

4.4 Required or voluntary?

Giving us personal data is voluntary. Within a form, fields marked with an asterisk are needed to handle that request: without them we cannot reply to your registration, prepare your land report or process your application. You can always talk to us on WhatsApp instead. The marketing box is optional and unticked by default.

5. Where your data comes from

We collect personal data directly from you. Please do not give us another person's details (for example a co-owner or another heir) unless they have agreed; we will then treat their data under this notice too.

6. Why we use your data

We will not use your data for a purpose unrelated to these without telling you first and, where the Act requires, asking for your consent.

7. Who we share it with

8. Transfers outside Malaysia

This website is hosted on Cloudflare's global network, and some of the service providers in section 7, including the technology and AI model providers used for Aiman, run cloud services whose servers may be outside Malaysia. Your data may therefore be stored or processed in other countries, and any such transfer follows this section.

Since 1 April 2025, section 129 of the amended Act allows a data controller to transfer personal data outside Malaysia where the destination has a law substantially similar to the Act, or ensures a level of protection at least equivalent to it. A transfer is also allowed in the situations listed in section 129(3), including where you have consented, where it is needed to perform a contract with you, or where the data controller has taken all reasonable precautions and exercised all due diligence so that the data will not be processed in a way that would breach the Act if it were in Malaysia. We transfer data only on one of these grounds, and only to providers who process it on our instructions.

9. How we protect your data

• Forms are sent over an encrypted (HTTPS) connection to our own server first, never straight from your browser to our customer records.
• Our server checks every submission (where it comes from, its size, the answers, a spam check and a limit on repeated submissions) before passing it on.
• Passwords and keys for our systems stay on the server; none are sent to your browser.
• Your name and answers are never put in a web address, and are never sent to analytics or advertising tools.
• Access to records is limited to staff who need it for the purposes in section 6.
• Since 1 April 2025 our data processors must themselves comply with the Security Principle.

9.1 If a data breach happens

A "personal data breach" means any breach, loss or misuse of, or unauthorised access to, personal data. Since 1 June 2025, section 12B requires a data controller that has reason to believe a breach has occurred to notify the Personal Data Protection Commissioner as soon as practicable, and to notify affected people without unnecessary delay where the breach causes or is likely to cause significant harm. The Commissioner's Data Breach Notification Guideline (version 1.0, 25 February 2025) explains that a breach must be notified to the Commissioner where it causes or is likely to cause significant harm, and sets the deadlines at no later than 72 hours from the breach for the Commissioner, and no later than 7 days after that notification for affected people. It treats harm as significant where, for example, the data could lead to physical harm, financial loss or identity fraud, is sensitive, or the breach affects more than 1,000 people. We follow these rules.

10. How long we keep it

The Retention Principle (section 10) says data may not be kept longer than its purpose needs. We keep each type of data as follows, then delete it, destroy it or anonymise it so it no longer identifies you.

11. Your rights

11.1 Fees and limits

The Act allows a data controller to charge a prescribed fee for a data access request; if a fee applies, we will tell you before we process the request. The Act also lets a data controller refuse an access request in limited cases, for example if it cannot confirm who you are or find the data, or if complying would disclose another person's data without their consent. If we refuse, we will tell you why in writing.

12. How to make a request

1. Write to us Email hello@rumahhq.com.my with the subject "Data request", addressed to the Data Protection Officer. You may also start on WhatsApp.
2. Say what you want Access, correction, withdrawal, stop marketing or portability, and which form or conversation it relates to.
3. We confirm it is you We may ask for details to confirm your identity and to find your data, as the Act allows (s. 32).
4. We act Within 21 days for access and correction requests, or we tell you in writing why we need more time.
5. You get a written reply What we did, and a copy of your data where you asked for one. Not satisfied? You may complain to the Commissioner.

12.1 What to include

• Your full name and the phone number or email you used with us.
• Which form, conversation or project the request is about, and roughly when.
• What you want: a copy, a correction (with the correct details), withdrawal of consent, no more marketing, or transfer to another data controller (with its name and contact).
• If you act for someone else (for example as a parent or under a power of attorney), proof that you may act for them.

12.2 Common mistakes

• Writing from a number or email we have never seen, with no way to link it to your record. Tell us the details you originally used.
• Asking for "all my data" when you only need one thing. A precise request is answered faster.
• Withdrawing consent when you only want to stop marketing. Stopping marketing keeps your registration; withdrawing consent ends it.

13. Withdrawing consent and stopping marketing

Withdrawing consent. Tell us in writing (email hello@rumahhq.com.my, or a WhatsApp message to Aiman at 011-5454 2461) that you withdraw your consent. Once we receive it we stop processing your data for the purposes above and delete or anonymise it, except records the law requires us to keep. Withdrawing consent may mean we can no longer assist you, for example with your registration or land report.

Stopping marketing. Marketing is sent only if you ticked the separate marketing box. Tell us at any time, by email or on WhatsApp, that you do not want it; the rest of your registration stays in place.

14. Data Protection Officer

Since 1 June 2025, section 12A requires a data controller to appoint one or more Data Protection Officers, accountable for compliance with the Act, and to notify the Commissioner of the appointment. Address privacy requests and questions to the Data Protection Officer at the email in section 16.

15. Language of this notice and changes

Section 7(3) of the Act requires this notice, and the means to exercise your choices, to be in the national language and English. Use the language switch at the top of the page to read the other version; you may write to us in either language. When we change this notice we update the date and version shown here. Every form records the version you agreed to, so we can always tell which notice applied to you. If a change affects how we use data you already gave us, we will tell you before it applies.

16. Contact us

• RumahHQ Development Sdn Bhd (attention: Data Protection Officer)
• Address: No. 36, Tingkat 1, Jalan Raya Barat, Kawasan 6, 41000 Klang, Selangor
• Email: hello@rumahhq.com.my
• WhatsApp (Aiman): 011-5454 2461

17. Complaints to the Commissioner

Please contact us first so we can put things right. You may also complain in writing to the Personal Data Protection Commissioner (section 104): Level 8, Galeria PjH, Jalan P4W, Persiaran Perdana, Presint 4, 62100 Putrajaya; call centre 03-7456 3888; email aduan@pdp.gov.my.

Frequently asked questions

Related: Cookie Policy, Terms of Use, Disclaimer.

Notice version 2026-09-29. General information only, not legal advice.

Sources

(6)

• Personal Data Protection Act 2010 [Act 709], Malay and English text (PDP Commissioner) — read 2026-09-24
• Personal Data Protection (Amendment) Act 2024 [Act A1727] — read 2026-09-24
• P.U. (B) 522/2024: appointment of dates of coming into operation of Act A1727 — read 2026-09-24
• Personal Data Protection Guideline: Data Breach Notification, version 1.0 (25 February 2025) — read 2026-09-24
• Seven Personal Data Protection Principles (PDP Commissioner) — read 2026-09-24
• Rights of data subjects (PDP Commissioner) — read 2026-09-24