Privacy notice (PDPA) · Maxxan Realty

Last updated: 4 November 2026. Notis ini juga boleh didapati dalam Bahasa Melayu. Sila hubungi kami di hello@maxxanproject.com.

1. Who we are

Maxxan Realty (1240851-D), Lot 8, Lorong Teknologi A, Taman Sains Selangor, Kota Damansara, 47810 Petaling Jaya, Selangor ("we", "us"). We market new and completed residential projects on behalf of property developers. We are the data user for the personal data described in this notice.

This notice covers personal data we collect through this website (maxxanproject.com), through lead forms on Facebook, Instagram, TikTok and Google, by phone, WhatsApp and email, and at our sales galleries.

2. The personal data we collect

Contact details: your name, mobile number and, if you give it, your email address.
Your enquiry: the project and unit type you are interested in, preferred visit day, best time to call, preferred language and any message you send us.
Buying and loan details you choose to share: budget, purchase purpose and timeline, household or monthly income, monthly commitments, an estimated debt service ratio (DSR) and your loan status. We use these only to check what you can afford and to match you with suitable units.
Our dealings with you: call outcomes and short call notes, WhatsApp messages and emails we exchange, gallery appointments, visits, bookings and their progress.
Consent records: what you agreed to, when and how (for example, the exact wording of the tick box on our website form), and your marketing preferences.
How you found us: the advert, campaign or link that brought you to us, the website that referred you and the page you first visited.
Technical data: your IP address and browser details, recorded in our security and server logs.

We do not ask for your identity card (IC) number, and we do not collect sensitive personal data such as health, religious or political information. Please do not send it to us in messages.

3. Where we get it

From you, when you fill in a form on this website, call or message us, or visit a sales gallery.
From advertising platforms (Facebook, Instagram, TikTok and Google), when you submit a lead form in one of our adverts.
From property developers and event organisers, and from people who refer you to us, where you agreed to be contacted.

4. Why we use it

To answer your enquiry, call you back and arrange gallery visits.
To check your loan eligibility with you, when you ask us to.
To pass your booking details to the developer, and to the developer's panel lawyers and banks, when you decide to buy.
To send you news about upcoming launches, only if you opt in.
To keep records of your consent and of your request not to be contacted, so that we honour them.
To measure which adverts and channels work, using statistics that do not identify you.
To train and coach our staff and check the quality of our service.
To keep our systems secure, prevent fraud and spam, and meet our legal and regulatory obligations.

Our system assigns your enquiry to an advisor and schedules follow-up calls automatically, using rules such as project, language and working hours. No automated decision is made about you that has legal or similarly significant effects.

5. What you must give us

Your name and mobile number are needed so we can respond to your enquiry. Everything else is optional. If you do not give us your name and mobile number, we cannot call you back or arrange a visit.

6. Consent, marketing and calls

Our website forms ask you to agree to us contacting you about your enquiry by phone, WhatsApp and email. News about other launches is a separate, optional tick box.
If we received your details without a record of your consent (for example, through a referral), we contact you once to ask whether you are happy to hear from us.
Stopping marketing is easy. Reply STOP, BERHENTI or UNSUBSCRIBE to any message, or tell any of our staff, and we stop marketing to you straight away.
If you ask us not to call you, your number goes on our do-not-contact list and our system blocks calls and messages to it.
We only call between 9am and 9pm Malaysian time, and we avoid calling on public holidays.
We do not record calls. If this changes, we will tell you at the start of the call.

7. Who we share it with

The developer of the project you enquire about or book, and, when you proceed with a purchase, the developer's panel lawyers and the banks or financial institutions you choose to apply to.
Service providers who run our systems for us under contract and only on our instructions:
- DigitalOcean (servers in Singapore, where our database is hosted);
- Cloudflare (website security and delivery);
- Mailgun (sending our emails);
- Meta (WhatsApp messages, and lead forms on Facebook and Instagram), TikTok and Google (lead forms in their adverts, and the maps on our project pages);
- Privyr (the app our advisors use to receive and follow up enquiries from our adverts);
- an error-monitoring service, set up so that it does not receive your personal data.
Professional advisers such as our auditors and lawyers, under a duty of confidentiality.
Authorities, courts and regulators, when the law requires it.
A buyer or successor of our business, under the same protections as this notice.

We never sell your personal data.

8. Transfers outside Malaysia

Some of these providers process data outside Malaysia: our servers are in Singapore, and our email, messaging and advertising providers operate in the United States, the European Union and elsewhere. We use providers that protect personal data to a standard at least comparable to the Personal Data Protection Act 2010, under contracts that require them to.

9. How long we keep it

While your enquiry, booking or purchase is active.
If your enquiry closes without a booking and there is no further contact for 2 years, our system removes your name, contact details, notes, messages and financial details automatically. What is left cannot identify you and is used only for statistics.
Call notes are cleared after 2 years.
Booking and sale records are kept for as long as tax and company laws require, normally 7 years.
Security logs of actions taken in our system are kept for 7 years. Server logs are kept for 14 days and backups for 14 days. Technical copies of the updates Privyr sends us are deleted after 90 days.
If you asked not to be contacted, we keep your mobile number on our do-not-contact list so that we can keep honouring your request.

10. How we protect it

Our website and system use encrypted connections (HTTPS), and secrets such as integration keys are encrypted at rest.
Staff can access only what their role needs, and every staff account is invited and can be switched off at once.
Exporting lists is restricted to authorised staff, exported files expire automatically, and sensitive actions are recorded in an audit log.
If a personal data breach is likely to cause significant harm, we notify the Personal Data Protection Commissioner and the people affected, as the law requires.

11. Your rights

Access and correction: ask for a copy of your personal data, or ask us to correct it.
Withdraw consent at any time, or ask us to stop marketing to you.
Erasure: ask us to delete your personal data. See Data deletion for how.
Data portability: ask us to send your personal data to another organisation, where the law gives you this right.
Object to processing that is likely to cause you substantial damage or distress.

Write to us using the details in section 15. We may need to confirm your identity first, usually by calling the mobile number you gave us. We reply within 21 days. If we need more time, we tell you why. We may charge the fee allowed by the Personal Data Protection Regulations for a copy of your data, and we tell you the amount before we start.

12. Cookies and similar technologies

A session cookie and a security token cookie keep our enquiry forms working and protect them against forgery.
Your browser's session storage remembers which advert or link brought you to us, so we can record it with your enquiry. It is deleted when you close the tab.
Cloudflare may set security cookies to protect the website against attacks.
The maps on our project pages are provided by Google, which may set its own cookies when a map loads.

We do not use advertising or analytics cookies on this website.

13. Children

Our services are for adults buying property. We do not knowingly collect personal data from anyone under 18.

14. Changes to this notice

We update this notice when our practices change, and the date at the top shows the latest version. We tell you about significant changes before they apply to your data.

15. Contact us

For questions, requests or complaints about your personal data, contact our Data Protection Officer:

Email: hello@maxxanproject.com (subject: "Personal data")
Phone: 012-345678
Post: Data Protection Officer, Maxxan Realty, Lot 8, Lorong Teknologi A, Taman Sains Selangor, Kota Damansara, 47810 Petaling Jaya, Selangor

If you are not satisfied with our reply, you may complain to the Personal Data Protection Commissioner (Jabatan Perlindungan Data Peribadi) at www.pdp.gov.my.

Privacy notice.