LEGAL · PRIVACY

Privacy Policy

This notice explains what personal data Terasquad Technologies Sdn. Bhd. collects when you use IdealHub, why we collect it, who we share it with, and the rights you have under Malaysia's Personal Data Protection Act 2010. It is provided in English and Bahasa Malaysia.

Last updated 27 October 202612 sections · 7 min readPDPA 2010 (Act 709)

Read inBahasa MalaysiaEnglish

KEY POINTS

The short version

We are the data controller: Terasquad Technologies Sdn. Bhd. (1251640-V), Kuala Lumpur.

We collect far more than an email — tenancy paperwork, identity documents, payslips and payment records.

We never sell your data. We share it only with processors who need it, and authorities where the law requires.

You can access, correct, port or delete your data at any time — access requests are answered within 21 days.

Who this policy covers

IdealHub is operated by Terasquad Technologies Sdn. Bhd. (1251640-V), a company registered in Malaysia with its registered address at No 23-2, Jalan Radin Bagus 3, Bandar Baru Sri Petaling, 57000 Kuala Lumpur. For the purposes of the Personal Data Protection Act 2010 ("PDPA"), we are the data controller of the personal data described in this notice.

This notice applies to everyone who deals with us: guests booking a stay, tenants signing a tenancy, landlords listing or handing over a unit, job applicants, and anyone who contacts us. It covers idealhub.com, our subdomains, our apps, and any service we deliver offline.

It does not cover third-party sites we link to, or a landlord handling your data independently. Where a landlord collects and uses your data for their own purposes, they are a separate controller and their own notice applies.

Two language versions

This notice is published in English and Bahasa Malaysia, as section 7(3) of the PDPA requires. The Bahasa Malaysia notice in section 02 is the statutory version.

Notis Bahasa Malaysia

Notis Perlindungan Data Peribadi di bawah seksyen 7 Akta Perlindungan Data Peribadi 2010. Versi Bahasa Malaysia ini merupakan notis rasmi yang dikehendaki oleh undang-undang.

Pengawal Data

Terasquad Technologies Sdn. Bhd. (1251640-V), No 23-2, Jalan Radin Bagus 3, Bandar Baru Sri Petaling, 57000 Kuala Lumpur.

Data peribadi yang dikumpul

Nama penuh, nombor kad pengenalan atau pasport, alamat, nombor telefon, alamat e-mel, dokumen perjanjian sewaan, penyata bank, slip gaji, maklumat pembayaran dan deposit, serta maklumat teknikal seperti alamat IP dan kuki.

Tujuan pemprosesan

Menyediakan perkhidmatan penyewaan jangka pendek dan jangka panjang, mengesahkan identiti, memproses pembayaran dan bayaran balik, menyediakan perkhidmatan e-pengseteman, pengurusan hartanah dan pengubahsuaian, serta mematuhi kewajipan undang-undang dan perakaunan.

Pendedahan kepada pihak ketiga

Pembekal perkhidmatan pembayaran, penyedia pengehosan data, pembekal e-mel dan SMS, juruaudit dan peguam, kontraktor penyelenggaraan, serta pihak berkuasa seperti LHDN, mahkamah dan polis apabila dikehendaki oleh undang-undang.

Hak anda

Anda berhak untuk mengakses data peribadi anda, membetulkannya, menarik balik persetujuan, meminta pemindahan data, dan menolak pemprosesan untuk pemasaran langsung. Permintaan akses akan dijawab dalam tempoh dua puluh satu (21) hari.

Hubungi

Pegawai Perlindungan Data, ask@idealhub.com atau +603 2789 9017, untuk sebarang pertanyaan atau aduan.

The data we collect

We collect what we need to let you rent, let a property, or work with us — nothing gathered just in case. These are the full categories. We tell you at the point of collection where an item is optional.

Identity and contactFull name, MyKad or passport number, phone, email, current address.

Tenancy and stay recordsSigned agreements, inventory and condition reports, check-in and check-out notes, access codes issued to you.

Financial informationPayslips, bank statements, rent and deposit records, refund and payout details. Access is restricted.

Guarantors and refereesName, contact and relationship of anyone guaranteeing a tenancy or providing a reference.

Property and premisesUnit details, meter readings, maintenance photos, and CCTV in common areas of managed buildings.

Technical and usageIP address, device and browser, pages viewed, and cookie identifiers.

Sensitive personal data

We process sensitive personal data — health, religious belief, political opinion, commission of an offence, biometric data — only with your explicit consent or where the PDPA permits it without consent. In practice this is rare: a medical reason for an early exit, or an identity document that carries your photograph.

Why we use your data

We use personal data for the purposes below. If we want to use it for something new, we tell you first — and where consent is the basis, we ask again.

Providing the service

Taking bookings and tenancy applications, preparing agreements, arranging check-in and keys, answering support requests.

Payments and refunds

Charging rent, holding deposits, processing refunds, and reconciling settlements through our payment gateways.

Identity and eligibility

Confirming who you are before a tenancy is signed or a key released, and screening for fraud.

E-stamping

Preparing your agreement for submission to LHDN and storing the stamped certificate.

Property management and renovation

Scheduling inspections, maintenance and works, and coordinating vendors who need unit access.

Legal, tax and accounting

Keeping the records company and tax law require, and responding to lawful requests.

Marketing

Sending guides and offers only where you have opted in. Every message carries an unsubscribe link.

Security

Detecting abuse, preventing fraud, and keeping an audit trail of who accessed what.

Consent and your choices

Where we rely on consent, we ask for it separately and record when and how you gave it — a tick box at sign-up, a signature on an application, or a written instruction by email. Silence is not consent.

Some processing does not need your consent because it is necessary to perform our contract with you — for example passing your name to the e-stamping portal — or to comply with the law. Service messages about a booking you have made do not depend on marketing consent.

Withdrawing consent

Email ask@idealhub.com or change your settings. Withdrawal takes effect from the moment we receive it and does not make past processing unlawful. If you withdraw consent for something essential — identity verification, for instance — we may not be able to continue the booking or tenancy.

If you are under 18

Our services are for people aged 18 and over. Where a minor's data is provided — a child named as an occupier, for example — we require consent from a parent or guardian, as the PDPA requires.

Marketing and direct contact

You can stop marketing at any time without affecting service messages about your booking. You also have a right under the PDPA to require us to stop processing your data for direct marketing, and we will act on it immediately. We never pass your details to third parties for their own marketing.

Who we share it with

We do not sell personal data and we do not rent it. We share it only with the classes of recipient below, and only the part they need to do the job.

Payment gatewayseGHL, 2C2P, iBill and MOLPay process card and FPX payments. We never store full card numbers.

Cloud and hostingAmazon Web Services, with primary data and media stored in the Malaysia region.

Communication providersEmail, SMS and WhatsApp delivery of confirmations, statements and updates.

Accounting and invoicingOur accounting system and tax agents, for invoices, payouts and statutory records.

Vendors and contractorsCleaners, handymen and renovation crews receive only the address, access details and job scope.

Professional advisersLawyers, auditors and insurers, where advice or a claim requires it.

Banks and stamping agentsFor payouts, deposit returns and submissions to LHDN.

AuthoritiesLHDN, the courts, police and regulators, where the law requires or permits disclosure.

Written contracts with every processor

Each processor acts on our written instructions and is contractually required to protect your data, tell us promptly if it is breached, and return or delete it when the engagement ends.

Where your data goes

Our primary systems and media storage sit in the Amazon Web Services Malaysia region. Some processors — payment infrastructure, email delivery and support tooling — may process data outside Malaysia.

Under section 129 of the PDPA we may transfer personal data outside Malaysia where the destination has a law substantially similar to the PDPA or ensures an adequate level of protection, where you have consented, where the transfer is necessary to perform our contract with you, or where another statutory exception applies.

Where we rely on consent for a transfer, we tell you which country before you give it. You can ask for the current list of processors and their locations by emailing ask@idealhub.com.

How long we keep it

We keep personal data only as long as we need it for the purpose we collected it, or as long as the law requires. These are the standard periods.

RECORD	HOW LONG	WHY
Booking and tenancy records	7 years after the tenancy ends	Company and tax law
Invoices and payments	7 years	Tax and audit
Identity documents and payslips	12 months after the tenancy ends	Verification only
Marketing consents	Until withdrawn, plus 2 years	Proof of compliance
Support conversations	3 years	Repeat issues
CCTV in common areas	30 days, unless needed for an incident	Security
Breach register	2 years from the breach	PDPA guideline

When a period ends we delete or anonymise the data. If you ask us to close your account we do so, except for records we must keep by law — we tell you which ones and why.

Security and data breaches

We protect data with encryption in transit, role-based access so staff see only what their job needs, unique logins with enforced password rules, logging of access to tenancy documents, and contractual security obligations on every processor. No system is perfect, so we plan for the day something goes wrong.

Where a personal data breach causes or is likely to cause significant harm, we notify the Personal Data Protection Commissioner as soon as practicable and within 72 hours of becoming aware of it. We then notify affected individuals without undue delay and within 7 days of notifying the Commissioner. We keep a register of every breach for at least two years.

What counts as significant harm

Physical harm, financial loss, a negative effect on credit records, misuse for illegal purposes, exposure of sensitive data, data that combined with other information could enable identity fraud, or a breach affecting more than 1,000 people.

Your rights under the PDPA

These rights come from the Personal Data Protection Act 2010. They apply to everyone whose data we hold, including tenants, guests, landlords and applicants.

RIGHT	WHAT IT MEANS	TIMING
Access	A copy of the personal data we hold about you, and what we use it for.	21 days
Correction	Have inaccurate, incomplete or out-of-date data put right.	21 days
Withdraw consent	Stop processing that relies on your consent, without affecting what we did before.	21 days
Data portability	Have your data sent to another controller, where the formats are compatible.	21 days
Direct marketing	Require us to stop processing your data for marketing. No questions asked.	Immediately
Deletion	Close your account and delete your data, except what we must keep by law.	30 days
Complaint	Escalate to the Personal Data Protection Commissioner if we get it wrong.	Any time

To exercise any right, email ask@idealhub.com with the subject Data Request and tell us what you want. We may ask you to verify your identity first, because we will not hand your data to someone else. An access request may attract a fee under the Personal Data Protection (Fees) Regulations 2013 — we tell you the amount before we start.

Malaysian law does not give an absolute right to erasure. What you do have is the right to withdraw consent — and when you do, we delete everything we are not legally required to keep.

Cookies and analytics

We use four kinds of cookie: essential (login, security, remembering your search), functional (language and currency), analytics (aggregated page and funnel data), and marketing (only where you have opted in).

You can refuse non-essential cookies, and you can clear or block cookies in your browser — but essential cookies are what keep you logged in and your booking intact.

Malaysia has no standalone cookie law

We treat cookies as personal data processing under the PDPA, which is why marketing cookies wait for your consent rather than being switched on by default.

Contact us and the DPO

Where the PDPA thresholds are met — personal data of more than 20,000 data subjects, or sensitive or financial data of more than 10,000 — we maintain a Data Protection Officer registered with the Commissioner, and publish their contact here as the guidelines require.

DPO

Data Protection Officer

ask@idealhub.com · +603 2789 9017 · Terasquad Technologies Sdn. Bhd. (1251640-V), No 23-2, Jalan Radin Bagus 3, Bandar Baru Sri Petaling, 57000 Kuala Lumpur.

Complaining to the Commissioner

If you are not satisfied with how we have handled a request, you may complain to the Personal Data Protection Commissioner, Aras 6, Kompleks Kementerian Komunikasi dan Multimedia, Lot 4G9, Persiaran Perdana, Presint 4, 62100 Putrajaya, or through www.pdp.gov.my. We would rather fix it first — write to the DPO and we will respond within 21 days.

Related policiesTerms of Use and Refund Policy

Questions about your personal data?

Ask us what we hold, request a copy, or have your account and data deleted.