General privacy statement

This section explains key terms used in the policy to make the details easier to apply in concrete situations.

We collect data to provide services, manage engagements, comply with legal obligations, and improve our offerings. Collection is limited to what is necessary for those purposes.

Data you may provide when engaging our services or using the site includes the following categories:

• Contact details: name, email address, phone number provided for scheduling or correspondence.
• Business information: agency name, business registration number, role within the agency, and address.
• Transactional data: records of appointments, invoices, payment confirmation, and service agreements.
• Case materials: documents and files you submit for review, such as contracts, title documents, and correspondence relevant to an advisory matter.
• Feedback and communications: messages platform with our advisors and notes from consultations.
• Optional profile data: preferences and non-sensitive professional details you choose to provide to improve service delivery.

We also collect certain information automatically when you visit our website or use online tools.

• Device and browser information: device type, operating system, browser version.
• Usage data: pages visited, time spent, navigation paths, and feature interactions for service improvement.
• Log data: IP address, access times, and error reports used for diagnostics and security monitoring.
• Analytics identifiers: anonymous identifiers used by analytics tools to measure site performance and feature uptake.
• Location data: coarse location derived from IP address to support regional compliance and content localization.
• Cookie data: values stored in cookies where you have given consent or where cookies are strictly necessary.

We may receive data about you from trusted third parties to facilitate services or improve accuracy of records.

• Payment processors for invoice settlement and transaction records.
• Public registers and land offices when verification of titles or encumbrances is required for advisory work.
• Professional partners engaged for specific services, such as document translation or specialized contribute.

We process data for specific business and regulatory purposes. Each purpose is tied to the minimal data needed to achieve it.

• To provide legal reviews, templates, and advisory services requested by clients.
• To manage client relationships: scheduling, invoicing, and follow-up communications.
• To comply with legal obligations, including tax, anti-funds laundering checks, and regulatory reporting where applicable.
• To operate, maintain, and improve website features and content relevant to real estate professionals.
• To detect and prevent fraud, abuse, and security incidents affecting our services or clients.
• To personalise communications and provide relevant case studies or service suggestions based on professional interest.
• To retain records necessary for dispute resolution or to demonstrate compliance in regulatory reviews.
• To collect aggregated insights used internally to refine checklists, templates, and audit protocols.

Where applicable, we rely on a lawful basis to process personal data. For service-related processing we use contractual necessity and legitimate interest; for certain compliance tasks we rely on legal obligations.

• Contractual necessity: processing required to perform the services you have requested, such as contract review or advisory work.
• Legal compliance: processing necessary to comply with statutory obligations, for example tax or anti-funds laundering requirements.
• Legitimate interests: limited processing to operate and improve the service, secure systems, and prevent fraud, balanced against user rights.
• Consent: used only where you have explicitly agreed to optional uses such as marketing communications or non-essential cookies.

We limit disclosure of personal data to parties that have a specific role in service delivery or legal compliance. Where we share data, we require appropriate protections.

• Service providers involved in payments, hosting, and analytics under contract to process data on our instructions.
• Professional advisers and third-party partners engaged for a specific client matter, only with the client’s instruction or where necessary for service delivery.
• Government, regulators, or law enforcement when required by Malaysian law or a valid legal process.
• Successors or purchasers in the event of a business transfer, subject to protections and notice to affected users where legally required.
• Public registries and land authorities when verification of property records is necessary for advisory work.
• Aggregated and anonymised information that does not identify individuals and is used to improve services.

We apply administrative, technical, and organisational measures proportionate to the sensitivity of the data. Controls include access restrictions, encrypted storage for sensitive documents, secure backups, and regular security reviews aligned with practical risk assessments.

• Access control: role-based access and multifactor authentication for privileged accounts.
• Encryption: encrypted storage and transport for sensitive client documents and communications.
• Monitoring and incident response: logging, routine audits, and an incident response plan to address security events.

You have rights to access and control personal data we hold about you, subject to applicable legal limitations and the need to preserve records for regulatory compliance.

• Right to access: request a copy of personal data we hold about you.
• Right to rectification: request correction of inaccurate or incomplete data.
• Right to erasure: request deletion where data is no longer necessary and deletion does not conflict with legal obligations.
• Right to object and to restrict processing: raise objections or request restriction where legitimate interests are the basis for processing.
• Right to restriction of processing — request limits on how we use specific personal data when accuracy is contested or processing is unlawful but you oppose deletion.
• Right to data portability — request a machine-readable copy of data you provided to AgentHubRumah for transfer to another service where technically feasible.
• Right to object — object to direct marketing communications and to processing based on legitimate interests; we will review objections and adjust processing or document the lawful basis for retention.
• Right to withdraw consent — where processing is based on consent for newsletters or marketing, you may withdraw consent at any time; withdrawal affects future processing but does not make prior processing unlawful.

• Lawful basis: We document the lawful basis for each processing activity (consent, contract performance, legal obligation, vital interests, public task, or legitimate interests) and provide this information on request.
• Data minimisation: We collect only the personal data necessary for the specified purpose, such as property transaction records, agent credentials, and communications relevant to advisory services.
• Accuracy and retention: We keep records accurate for transactional purposes and retain data for as long as needed to comply with contractual, legal, or regulatory obligations, using retention schedules appropriate to the category of data.
• Security measures: Technical and organisational measures, such as access controls and encrypted backups, are used to protect personal data. Where transfers outside the EEA are necessary, we rely on mechanisms that provide adequate safeguards.

If you are in the EEA and you consider our processing of your personal data to breach applicable data protection law, you may file a complaint with the supervisory authority in your member state. You can also contact AgentHubRumah first to attempt resolution by emailing [email protected] or writing to our address.

AgentHubRumah does not intentionally collect personal data of children under 16 for service sign-ups. If we become aware that data from a child has been collected without appropriate consent, we will take steps to remove the data. If you believe a child’s data is held by us, contact [email protected].

Our site and communications may include links to third-party sites such as industry partners, government registries, or payment providers. These sites have their own privacy practices. We recommend reviewing third-party privacy policies before submitting personal data; AgentHubRumah is not responsible for external practices.

We review and update this privacy policy to reflect evolving services, legal requirements, and practical cases from our work with realtors. Significant changes will be posted on AgentHubRumah.club with an updated effective date. For material changes affecting your rights, we will make reasonable efforts to notify affected users.