Privacy Notice (PDPA)

Last updated: [to be confirmed] · Version: draft 0.1

This Privacy Notice explains how BuatNow collects, uses and protects your personal data, in line with Malaysia's Personal Data Protection Act 2010 (PDPA), as amended by the Personal Data Protection (Amendment) Act 2024. [to be confirmed]

1. Who is responsible for your data

The data user is [to be confirmed] (SSM registration no. [to be confirmed]), [to be confirmed]. Contact for privacy matters: [to be confirmed]. Data Protection Officer: [to be confirmed].

2. Personal data we collect

Early registration (Daftar Awal): name, phone / WhatsApp number, email (optional), whether you are a job owner, worker or business sponsor, state and area, the job types you are interested in, your preferred language, and your consent record.
Advertising enquiries: business name, your name, email or phone, country, the format you are interested in and your message.
Contact form messages: your name, contact details and message.
BuatNow account: email address, password (stored only in hashed form by our account provider), name, phone number and whether you joined to give jobs, get jobs or advertise; your package and points; the jobs, job details and photos, worker listings, availability, rates and contact details you add; quotes you send or accept; jobs marked done, and ratings and comments you give or receive.
Shown to other users: job titles, details, photos, areas, timing, budgets and quotes counts; worker listings with ratings, grades and jobs done. A worker's contact details are shown only to members with a paid package. Bids are seen by the job owner and the worker who sent them. Posts and bids show your first name and the first letter of your last name. When a job owner hires a worker, the two of them see each other's name and phone number for that job.
On your device: your sign-in session (kept in your browser's local storage so you stay signed in), your country and language choice, and anything you add while accounts are not available in your view. You can delete these by signing out and clearing your browser's site data.
Technical data: our hosting provider may record basic technical data such as IP address, browser type and pages requested, for security and to run the site. [to be confirmed]

We do not ask for sensitive personal data (such as health or religious beliefs) and ask you not to include it in messages.

3. Why we use it

To run your account: show your jobs and listings, pass quotes between job owners and workers, record ratings and points, switch on packages you pay for, and send account emails (confirming your email, resetting your password).
To contact you about BuatNow's launch and your early registration, including by WhatsApp, SMS, phone or email.
To give you the launch offer you registered for, where it applies.
To reply to enquiries and support requests.
To plan where to launch first (for example, which states and job types have the most interest).
To keep BuatNow secure, prevent fraud and spam, and meet our legal obligations.

We rely on your consent, which you give when you tick the consent box on our forms or when you create an account. You can withdraw it at any time (see section 7). If you do not give the data marked as required, we cannot register you or reply to you.

4. Who we share it with

Service providers who process data for us, such as our website and form host (Netlify, Inc.), our account and database provider (Supabase, Inc., project hosted in [to be confirmed]) and [to be confirmed]. They may store data outside Malaysia, including in the United States. We use providers that protect data to a standard comparable to the PDPA.
Authorities, where the law requires it.
A buyer or successor if BuatNow's business is sold or reorganised, under the same protections.

We do not sell your personal data. Other users see only what is described in section 2. Once booking launches, a job owner and the worker they book will see the details needed to do the job, and this notice will be updated before then.

5. How long we keep it

We keep early-registration data until BuatNow launches in your area and for up to [to be confirmed] after, or until you ask us to delete it. We keep account data while your account is open and for [to be confirmed] after you close it. In both cases we keep data longer only where the law requires it.

6. Security

We take practical steps to protect your data from loss, misuse and unauthorised access, including encrypted (HTTPS) connections and limited access to submissions. If a data breach is likely to cause you significant harm, we will notify you and the Personal Data Protection Commissioner as the law requires.

7. Your rights

Access and correction: ask for a copy of your personal data or ask us to correct it.
Withdraw consent / stop messages: reply "STOP" to any WhatsApp message or email us, and we will stop contacting you about marketing.
Deletion: ask us to delete your registration or your account.
Data portability: where the law gives you this right, ask us to send your data to another provider.

Send requests to [to be confirmed]. We may need to confirm your identity and will reply within the time the PDPA allows (generally 21 days). [to be confirmed]

8. Cookies and local storage

BuatNow uses your browser's local storage to keep you signed in and to remember your country, language and anything you add on the website. Fonts and the account script are served from our own site; account requests go to our account provider (Supabase). We do not currently use advertising cookies. [to be confirmed]

9. Children

BuatNow is meant for adults. If you are under 18, please ask a parent or guardian before registering.

10. Changes

We will post any changes to this notice here with a new date, and tell registered users about important changes.

11. Contact and complaints

Contact us first at [to be confirmed] or WhatsApp +60 11-1006 1918. You may also complain to the Personal Data Protection Commissioner of Malaysia (Jabatan Perlindungan Data Peribadi).