Privacy Policy

1. Introduction

Hikayat ("we", "us", "our") operates a residential rental introduction service from Jalan Sri Hartamas 8, Sri Hartamas, 50480 Kuala Lumpur, Malaysia. We take the handling of personal information with care and have prepared this policy to explain, in plain language, what data we collect, how we use it, and what rights you hold in relation to it.

This policy applies to information gathered through our website at hikayat.info and through direct correspondence with our team. By using our website or submitting an enquiry, you acknowledge that you have read and understood this policy.

For questions about this policy, please write to [email protected].

2. Information We Collect

We collect personal information only when you choose to provide it. This typically occurs when you:

• Submit an enquiry through our contact form (name, email address, phone number, message content)
• Correspond with us directly by telephone or email
• Engage us for a service arrangement and enter a formal client relationship

We also collect non-personal technical data automatically when you visit our website, including your browser type, pages visited, time spent on the site, and referring URL. This data is collected in aggregate and is not linked to individual identities unless you have provided your details separately.

We do not collect sensitive personal data (such as financial account details, identity document numbers, or health information) through our website forms.

3. Legal Basis for Processing

Under Malaysia's Personal Data Protection Act 2010 (PDPA), we process your personal data on the following grounds:

• Consent — where you have submitted a form or made direct contact requesting information
• Contractual necessity — where data is required to perform a service you have engaged us to provide
• Legitimate interests — for internal record-keeping, service improvement, and responding to enquiries
• Legal compliance — where we are required by law to retain or disclose certain records

Enquiry data submitted through our contact form is held for a period of 24 months from the date of last interaction. Client service records are retained for seven years following the conclusion of a service engagement in accordance with Malaysian commercial record-keeping requirements. You may request earlier deletion at any time (subject to legal retention obligations).

4. How We Use Your Information

Personal information you share with us is used for the following purposes:

• Responding to your enquiry and discussing your residential requirements
• Arranging property viewings and coordinating with building owners or agents on your behalf
• Preparing tenancy documentation and managing move-in coordination where engaged
• Contacting you with relevant updates during an active service engagement
• Improving our website and understanding how visitors interact with our content

We do not use your personal data for automated decision-making or profiling. We do not sell or rent your personal information to third parties. We do not use your details to send unsolicited marketing unless you have expressly indicated that you are open to receiving occasional communications from us.

5. Sharing Your Information

We may share your information in the following limited circumstances:

• Property owners and agents — only when directly required to arrange a viewing or tenancy, and only with information necessary for that purpose
• Professional advisers — legal, accounting, or compliance professionals where required for a service engagement
• Technology providers — our website may use third-party tools such as Google Analytics and Facebook Pixel for website performance measurement. These providers operate under their own privacy policies
• Legal requirements — where disclosure is required by a court order, regulatory authority, or applicable Malaysian law

In all cases, we share the minimum amount of information necessary for the stated purpose.

6. Data Protection Measures

We maintain appropriate technical and organisational safeguards to protect personal information against unauthorised access, loss, or misuse. These include:

• Secure, encrypted connections (HTTPS) for all website data transmission
• Access controls limiting data to personnel with a legitimate need
• Regular review of third-party service providers for compliance with data protection standards
• Internal procedures for identifying and responding to potential data incidents

In the event of a data breach that is likely to result in risk to your rights, we will notify you and the relevant authority in accordance with our obligations under the PDPA.

7. Cookies

Our website uses cookies to support basic site functionality, understand how visitors navigate the site, and (where consent has been given) to support marketing measurement. Cookies are small text files stored in your browser. We use the following categories:

• Essential cookies — required for the website to function; cannot be disabled
• Analytics cookies — help us understand usage patterns and improve the website
• Marketing cookies — support advertising measurement tools including Google and Facebook
• Preference cookies — remember your settings and choices across visits

You can review and adjust your cookie preferences at any time through our Cookie Policy page.

8. Your Rights

Under Malaysia's Personal Data Protection Act 2010 and applicable data protection principles, you have the right to:

• Access — request a copy of the personal information we hold about you
• Correction — ask us to correct inaccurate or incomplete information
• Withdrawal of consent — withdraw any consent you have previously given, which will not affect the lawfulness of prior processing
• Restriction — ask us to limit the ways in which we use your data while a dispute is being resolved
• Erasure — request deletion of your personal information, subject to legal retention requirements
• Complaint — lodge a complaint with the Personal Data Protection Commissioner Malaysia if you believe your data has been handled improperly

To exercise any of these rights, please write to us at [email protected]. We will respond within 21 days.

9. Third-Party Links

Our website may contain links to external websites or services operated by third parties. We have no control over the privacy practices of those sites and are not responsible for their content or data handling. We encourage you to review the privacy policy of any third-party site you visit.

10. Children's Privacy

Our services are intended for adults aged 18 and above. We do not knowingly collect personal information from persons under the age of 18. If you believe that a minor has submitted personal information through our website, please contact us and we will take steps to remove it promptly.

11. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our services, applicable law, or data handling practices. When material changes are made, we will update the "last updated" date at the top of this page. Where the changes are significant, we will take reasonable steps to inform active clients directly.

Continued use of our website following an update constitutes acknowledgement of the revised policy.

12. Contact Us

If you have questions, requests, or concerns about this privacy policy or the handling of your personal data, please contact us through any of the following: