Privacy Notice

1. Who we are

The data user (data controller) is [Company name] (registration no. [Company registration no. (SSM)]), [Registered business address] (“NILE Home”, “we”, “us”). NILE Home is a property posting platform for Penang, Malaysia: anyone can post a listing, agents can apply for a verified tick, and service providers can post profiles.

Our Data Protection Officer is [Data Protection Officer name], [DPO email address]. General contact: [Contact email address].

2. Personal data we collect

We collect the following, mostly from you directly:

• Account: your email address (required to sign in; we send a 6-digit code instead of a password), a display name (the part of your email before the “@” until you change it), your chosen interface language, and the time you accepted the Terms of Use and which version.
• Profile (optional): profile picture, role (for example agent, banker, renovator, designer, lawyer), agency or company name, areas served, languages spoken and, for agents, your licence number. These are shown on your public profile.
• Listings and service profiles: title, description, price, size, rooms, property type, estate or area, a map pin (rounded to about 110 metres when it is not tied to an estate) and photos. Photos are re-encoded in your browser before upload. Listings and service profiles are public.
• Messages: the text of messages you send and receive in the platform's chat, and the conversations they belong to. Messages are visible only to you and the other person (and, where needed for a report or a legal duty, to our authorised staff).
• Verification (blue tick) applications: your full name, licence or registration number (for example REN, REA or PEA for agents), company name, company registration number, a note, and photos of proof documents you upload. The documents are private: only you and our authorised staff can open them.
• Reports and support: reports you file against a post or profile, and support messages (your email, subject and message).
• Technical data: your IP address, browser and device type, and security and error records. Cloudflare, which hosts the site, processes this when you visit. We also keep short-lived records of login-code and contact-form requests (email address and IP address) to stop abuse.
• Cookies and similar storage: one strictly necessary session cookie that keeps you signed in; and, in your browser's local storage, your language choice, whether you dismissed the language banner, and your map display mode. We do not use advertising or tracking cookies. Cloudflare Turnstile may be used on forms to tell people from bots; it checks signals from your browser and IP address for that purpose only.

We do not ask for your phone number, identity card number or bank details, and we never show phone numbers on the platform. Please do not put them in your listings or messages. Supplying your email address is necessary to use an account; everything else is optional, except what a verification application asks for (without it we cannot verify you).

3. Why we use your data

• To create and secure your account, send your login codes and keep you signed in.
• To publish your listings and profiles, and let other users contact you through in-platform messages.
• To verify licences and registrations for ticks, and to keep the tick accurate.
• To send service emails: login codes, reminders that a listing is about to expire (3 days before the 30-day expiry), answers to your support messages and the result of a verification application. We do not send marketing email.
• To keep the platform safe: checking posts against automated rules (for example contact details, links, repeated posts and banned words), reviewing reports, and removing content or suspending accounts that break the Terms of Use or the posting rules. A person reviews flagged posts; trusted authors' clean posts may be approved automatically.
• To prevent abuse and fraud, fix errors, and keep the service running and secure.
• To meet our legal duties and respond to lawful requests from authorities, and to establish or defend legal claims.
• To produce anonymous, aggregate statistics (for example counts of posts or article views). These do not identify you.

We do not sell your personal data, and we do not use it for advertising.

4. Your consent

When you sign in or sign up you must tick “I agree to the Terms of Use and Privacy Notice” before we send a login code. We record which version you accepted and when. If we change these documents in a material way you are asked to accept the new version before you can post or send messages; you can still read the site.

You can withdraw your consent at any time by deleting your account (see section 11) or by writing to us. Withdrawing consent means we can no longer provide the account and posting features. It does not affect what we did before, or data we must keep by law.

5. Who we share data with

• Other users and the public: your listings, service profile, display name, picture, tick, agency, areas, languages and (for agents) licence number are public, including to search engines. Your email address is never shown to other users. Messages are shared only with the person you are writing to.
• Cloudflare, Inc. (our hosting and security provider and data processor): runs the website, the database (D1), photo storage (R2), the real-time chat and the network that delivers the site. It processes data only for us and under its contract.
• Resend (our email delivery provider and data processor): receives your email address and the content of service emails so it can deliver them.
• Authorities, courts and others: when the law requires, for example a court order or a request from the police or a regulator such as the Board of Valuers, Appraisers, Estate Agents and Property Managers (BOVAEAP), or when needed to protect rights, safety and property.
• A successor: if the business is sold or reorganised, your data may pass to the new owner, who must respect this notice.

We do not sell data or give it to advertisers or data brokers. Our processors may use sub-processors, and we require them to protect your data and to tell us of any breach.

6. Transfers outside Malaysia

Cloudflare and Resend run global systems. Your data may therefore be stored or processed outside Malaysia, including in the United States and other countries where they operate. We transfer data abroad only to the extent needed to provide the service, with your consent given under section 4, and where the recipient is bound by contract to protect the data to a standard comparable to the PDPA. If you do not agree, please do not use the platform.

7. How long we keep data

• Account, profile, consent record: until you delete your account.
• Listings: a listing is shown for 30 days and then stops appearing publicly; you can renew it. An expired or taken-down listing stays in your account (not public) until you delete it or your account. When you delete a listing, it disappears at once and its photos are erased from storage; a short inactive text record may remain until your account is deleted.
• Photos that were uploaded but never used in a listing or application: deleted automatically after 24 hours.
• Messages and conversations: until you delete your account. Deleting an account removes the conversations you took part in, so the other person no longer sees them either.
• Verification applications and proof documents: until you delete your account.
• Reports you filed and support messages: until you delete your account. Support messages sent without an account are kept until you ask us to erase them.
• Login codes: valid for 10 minutes. Records of login-code and contact-form requests (email and IP address): at most 7 days.
• Technical error records: 30 days. Email delivery records (they do not store the recipient): 30 days.
• Moderation records (what an administrator did and why, such as removing a post or suspending an account): kept as long as needed for safety, disputes and legal compliance.
• Backups: our database keeps backups for 30 days, so deleted data can remain in backups until they expire. We do not restore deleted data except to recover from a failure.
• Anything the law requires us to keep is kept for as long as the law requires.

8. Security

We protect your data with encrypted connections (HTTPS), passwordless email-code sign-in, limits on login and message attempts, private storage for verification documents, access to administrator tools restricted to named staff and recorded in an audit log, and a ban on showing email addresses or phone numbers to other users. No system is perfectly secure, so please also protect your email account.

If a personal data breach occurs that causes or is likely to cause significant harm, we will notify the Personal Data Protection Commissioner and the affected users as the PDPA requires, without undue delay.

9. Our processors and the 2024 amendments

The PDPA, as amended in 2024, makes data processors directly responsible for security and requires breach notification, a Data Protection Officer and data portability. We use processors only under written contracts that require them to follow our instructions, keep data secure, help us respond to your requests and notify us promptly of any breach.

10. Your rights

Under the PDPA you may:

• ask whether we hold personal data about you and get a copy (access). On the Me page, “Download my data” gives you a file with your profile, listings, messages, applications and consent history immediately; you can use it up to 3 times a day;
• ask us to correct data that is inaccurate, incomplete or out of date (most details you can edit yourself on the Me page);
• withdraw your consent, or ask us to limit processing;
• ask us to delete your data (the Me page has “Delete my account”);
• ask us to transfer your data to another provider (data portability): the downloaded file is a structured, machine-readable JSON file for this purpose;
• ask us not to use your data for direct marketing (we do not do any).

To use a right that the Me page does not cover, write to [DPO email address]. We may ask you to prove your identity first. We will reply within 21 days. We may refuse or limit a request only on the grounds the PDPA allows, and we will tell you why.

11. Deleting your account

On the Me page choose “Delete my account”. This removes your account, sign-in sessions, profile, listings and service profiles, photos, saved items, messages and conversations, reports and support tickets, verification applications and documents, and your consent history. It cannot be undone. Copies in backups expire within 30 days, and moderation records are kept as described in section 7.

12. Complaints

If you are unhappy about how we handle your personal data, please contact our Data Protection Officer first at [DPO email address]. You may also complain to the Personal Data Protection Commissioner of Malaysia (Jabatan Perlindungan Data Peribadi, www.pdp.gov.my).

13. Children

NILE Home is for people aged 18 and over. We do not knowingly collect data from anyone under 18. If you think a child has given us data, write to [DPO email address] and we will delete it.

14. Changes to this notice

We may update this notice. The version and effective date are shown below. When we make a material change we will ask you to accept the new version before you can post or send messages, and we keep earlier versions on request.

15. Version

Version: 2026-10-26 v1. Effective: 2026-10-26.