Last updated: [date]
This notice explains how FTech IT Consulting Sdn Bhd ([SSM no.]), the company behind OutletBooking ("we", "us"), collects and uses personal data, as required by the Personal Data Protection Act 2010 ("PDPA").
1. Who this notice covers
| You are… | Who decides how your data is used |
|---|---|
| A business owner or staff member with an OutletBooking account | We do. We are the data user for your account data. |
| A customer booking through a business's booking page | The business you book with is the data user. We store and process your data on its behalf as its data processor. Questions about your booking data should go to that business first. |
| A visitor who contacts us through the website | We do. |
2. Personal data we collect
Business owners and staff
- Name, email address, mobile number, password (stored only as a secure hash).
- Business details: business name, booking link, address, phone, logo, SSM number and tax identification number (TIN) if you give them for receipts.
- Your ToyyibPay User Secret Key, if you connect payments. It is encrypted, and is never shown to staff or to our own staff.
- Plan payments: amount, date, status, ToyyibPay reference and receipt number. We do not receive your card number or online banking login.
- Usage and device data: sign-in times, app version, push notification token and error logs.
Customers of a business
- Name and mobile number.
- Answers to the business's booking questions (for example plate number, property address, number of players).
- Booking details: service, date and time, staff or resource, status, notes.
- Payment status and ToyyibPay reference for deposits or payments. Payments go directly to the business's own ToyyibPay account; we do not receive your card or banking login details.
Website visitors
- Details you enter in the contact form (name, business, mobile, email, message).
- Basic technical data such as IP address and browser type, for security.
3. Why we use it
- To create and run accounts, and to sign you in securely.
- To take, confirm, remind, change and cancel bookings, and show them to the business and its staff.
- To process plan payments and send receipts.
- To send service messages: email confirmations, password resets, staff invitations, trial and renewal reminders, and push notifications.
- To provide support and answer enquiries.
- To keep the service secure, prevent fraud and fix problems.
- To meet legal, tax and accounting requirements.
We do not sell personal data. We send marketing messages only if you agree, and you can stop them at any time.
4. Is it compulsory?
Name, email or mobile number, and a password are needed to open an account. Name and mobile number are needed to make a booking. If you don't give them, we (or the business) can't provide the service. Other information is optional unless the business marks a booking question as required.
5. Who we share it with
- The business you book with, and the staff it allows to see bookings.
- ToyyibPay, to process payments.
- Service providers who run the service for us: database and server hosting ([Supabase / provider], [Railway / Render], [Vercel]), file storage ([provider]), email delivery (Resend), push notifications (Expo) and error monitoring ([Sentry]). They may only use the data to provide their service to us.
- Authorities, when the law requires it.
- A buyer or successor if our business is sold or merged, under the same protections.
6. Data stored outside Malaysia
Our servers are located in [Singapore], and some service providers may process data in other countries. When we transfer data outside Malaysia, we take the steps the PDPA requires to make sure it is protected to a standard at least equivalent to Malaysian law, for example through contracts with those providers.
7. How long we keep it
- Account data: while your account is open, and up to [12 months] after it is closed, unless you ask us to delete it sooner.
- Booking and payment records: up to 7 years, because businesses need them for accounts and tax. If a customer's data is erased, the booking record is kept with the name changed to "Deleted customer" and the mobile number and notes removed.
- Contact form enquiries: up to [24 months].
- Security logs: up to [12 months].
8. How we protect it
Data is sent over encrypted connections (HTTPS), payment keys are encrypted at rest, access is limited by role, our admin panel requires two-step sign-in, and admin actions are recorded in an audit log. If a personal data breach happens that is likely to cause significant harm, we will notify the Personal Data Protection Commissioner and affected people as the PDPA requires.
9. Your rights
You can ask us to:
- give you access to your personal data and a copy of it;
- correct data that is wrong, incomplete or out of date;
- transmit your data to another service where the PDPA gives you this right;
- stop or limit processing that causes you damage or distress;
- withdraw consent, or stop sending you marketing.
We may charge a fee for access requests where the law allows, and will reply within the time the PDPA sets (21 days for access and correction requests). Customers: please contact the business first; you may also contact us and we will pass your request to them.
10. Contact us
FTech IT Consulting Sdn Bhd · [address] Email: [privacy@outletbooking.my] · WhatsApp: [+60 …] Data protection officer: [name, contact]
11. Changes
We may update this notice. We will show the new date at the top and tell account holders by email or in the app if the changes are significant.