Privacy Notice
Issued under the Notice and Choice Principle of the Personal Data Protection Act 2010 (Act 709) by Hartanah Makmur Realty Sdn Bhd, the data user.
This notice explains what personal data we collect through this website, why we collect it, who we pass it to, how long we keep it and what you can require us to do about it. A Bahasa Malaysia version of this notice is available on request from the Data Protection Contact named at the end. Where the two versions differ, the Bahasa Malaysia text prevails, as the Act requires.
Real estate agency is a prescribed class of data user under the Act, so we are registered with the Personal Data Protection Commissioner and practise to the seven Personal Data Protection Principles. The Personal Data Protection (Amendment) Act 2024 additionally requires us to appoint a data protection officer and to notify the Commissioner of a personal data breach; the Data Protection Contact below performs that role.
1. What we collect, and when
We do not require you to identify yourself to browse listings. Personal data reaches us only when you choose to send it.
Enquiry form on the contact page
The form on the contact page asks for your name, email address, an optional telephone or WhatsApp number, the nature of your enquiry and whatever you write in the message field.
Read this next part carefully, because it is unusual and it is in your favour. That form does not transmit anything. It assembles the text you typed and hands it back to you as a prefilled WhatsApp message or email that you send yourself, from your own account. Until you press send in WhatsApp or in your mail client, the data stays in your browser and never reaches our servers at all. Once you do send it, we receive it in the ordinary way and it is governed by this notice.
Viewing requests and property enquiries
When you ask to view a listing — by WhatsApp, telephone, email or in person — we record your name, contact details, the property concerned, the date and time of the appointment and any brief you give us about budget, area, tenure preference or intended use. Where you attend a viewing we may also record attendance for the safety of the occupier and of our negotiator, and because vendors and landlords are entitled to know who has been through their property.
If you go on to transact
Progressing to an offer, a booking fee, a tenancy or a Sale and Purchase Agreement requires considerably more: identity document details, residential address, employment and income information for loan referral, bank details for the handling of deposits, and the customer-due-diligence records we are obliged to keep as a reporting institution under the Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001. We will tell you at the time exactly what is needed and why.
Technical data
Our hosting provider records standard server logs — IP address, user agent, pages requested, timestamps — for security and diagnostics. This website sets no advertising or analytics cookies and embeds no third-party tracking script. Typefaces are served from our own domain rather than fetched from a font provider.
One exception is worth naming plainly: the map on the contact page is an embedded frame served by OpenStreetMap. Loading that page therefore causes your browser to contact the OpenStreetMap Foundation directly, and their servers will see your IP address under their own privacy policy. We chose OpenStreetMap precisely because it needs no account, no API key and no advertising identifier.
2. Why we use it
- To answer your enquiry and to arrange, confirm and follow up viewings.
- To match you against listings, and to alert you to a property that fits a brief you have given us.
- To negotiate on your behalf and to communicate offers to the vendor, landlord or their agent.
- To administer a transaction through to Memorandum of Transfer, tenancy stamping or key handover.
- To satisfy our own legal duties: anti-money-laundering due diligence, tax records, stamping submissions, and the conduct obligations of a registered estate agency practice.
- To defend or bring a claim, and to answer a complaint made to a regulator.
We do not sell personal data. We do not pass your details to a data broker or to a lead-generation platform. We will not add you to a marketing list on the strength of a single enquiry; if we ever run a market-update mailing you will be asked to opt in, and every message will carry an unsubscribe route.
3. Consent and lawful basis
Most of our processing rests on the consent you give when you submit an enquiry or engage us. Some of it does not need your consent because the Act permits it — where processing is necessary to perform a contract you are party to, to comply with a legal obligation, or to protect your vital interests. Anti-money-laundering and tax records fall into that second group, which is why they survive a withdrawal of consent.
4. Who we share it with
Your data is disclosed only for the purposes above, and only to:
- Our own negotiators. The negotiator handling your matter, and the principal, who supervises every file. Negotiators practise under this firm’s estate agency registration and are bound by the same confidentiality obligation we are.
- The other side of the transaction. Where you make an offer, the vendor or landlord — and their agent, if they have one — will be told your name and the terms of your offer. They cannot properly consider it otherwise.
- Panel solicitors. The conveyancing firm handling the Sale and Purchase Agreement, the tenancy or the transfer, once you have chosen one.
- Financiers. Mortgage bankers you have asked us to introduce you to. We pass the details needed to obtain an indicative margin of finance, and only after you have asked us to make the introduction.
- Valuers and other professionals. Registered valuers, building inspectors, photographers and floor-plan draughtsmen engaged on a specific instruction.
- Authorities. The Inland Revenue Board for stamping, the land office, the Board of Valuers, Appraisers, Estate Agents and Property Managers Malaysia, and any authority with a lawful right to require disclosure.
- Service providers. Our hosting, email and document storage suppliers, under contract and only so far as needed to run those services.
Some of those suppliers store data on servers outside Malaysia. Where that happens we satisfy ourselves that the data enjoys protection comparable to the Act before the transfer is made.
5. How long we keep it
- Enquiries that do not become an engagement
- Twelve months from the last contact, then deleted. If you ask us sooner, sooner.
- Viewing records
- Twelve months from the viewing, unless the viewing led to an offer, in which case the record joins the transaction file.
- Completed transaction files
- Seven years from completion, which is the period our tax and company record-keeping obligations require.
- Anti-money-laundering due diligence
- Six years from the completion of the transaction or the end of the business relationship, as the AMLA 2001 requires of a reporting institution.
- Marketing consents
- Until you withdraw them, plus a minimal suppression record so that we can prove you asked to be removed and can avoid contacting you again.
When a retention period ends the data is deleted or irreversibly anonymised. We do not keep personal data indefinitely on the theory that it might one day be useful.
6. Security
Access to client files is restricted to the negotiator on the matter and the principal. Devices are password protected and encrypted, accounts use multi-factor authentication, and this site is served over HTTPS. No system is perfect; if a breach occurs that is likely to cause you significant harm, we will notify the Commissioner and you, as the amended Act requires.
7. Your rights
Under the Act you may:
- Ask for access to the personal data we hold about you, and for a copy of it. A prescribed fee may apply, and we will reply within the statutory period.
- Ask us to correct data that is inaccurate, incomplete, misleading or out of date.
- Withdraw your consent to processing at any time. We will stop, save where we are required by law to continue — an anti-money-laundering record, for instance, cannot be deleted on request.
- Require us to stop processing for direct marketing entirely, with no reason given and no fee.
- Limit the processing of data where you dispute it, or object to it on grounds that cause, or are likely to cause, damage or distress.
Withdrawing consent while a transaction is in progress will usually end our ability to act for you, because we cannot negotiate on behalf of someone whose details we may not disclose to the other side. We will tell you plainly if that is the consequence before acting on the request.
8. Complaints
Raise it with the Data Protection Contact first — most issues are a misunderstanding and are fixed the same week. If you are not satisfied, you may complain to the Personal Data Protection Commissioner. Matters touching the conduct of estate agency practice may also be raised with the Board of Valuers, Appraisers, Estate Agents and Property Managers Malaysia.
9. Data protection contact
Write to the Data Protection Contact, Hartanah Makmur Realty Sdn Bhd, Suite 15-3, Level 15, Menara Makmur, No. 218, Jalan Ampang, 50450 Kuala Lumpur, Wilayah Persekutuan Kuala Lumpur, Malaysia, or email hello@hartanahmakmur.com.my. Telephone +60 3-2181 8800 during office hours. Please put access and correction requests in writing so that we can verify who is asking.
10. Changes to this notice
We may revise this notice as our practice or the law changes. The review date below always reflects the current version. A change that materially affects how we use data you have already given us will be notified to you directly rather than published quietly.
Last reviewed . These documents are published by Hartanah Makmur Realty Sdn Bhd and are governed by the laws of Malaysia. They are written to be read, not to be impressive; if any part of them is unclear, ask us before you rely on it.