1. Who controls your personal data

PROP MEDIAN CONSULTANCY (Registration No. 202603041231 (MA0342570-T)) operates PropMedian and is the data controller for personal data described in this notice.

• Address: G10, Sunway Avila Avenue, No. 1, Jalan Seri Wangsa, Taman Sri Rampai, Wangsa Maju, 53300 Kuala Lumpur, Wilayah Persekutuan, Malaysia
• Privacy email: prop.median.my@gmail.com
• Website: https://www.propmedian.com/

2. Personal data we collect and its sources

• Account and sign-in data: name, email address, profile image URL, authentication provider, email-verification status, account identifiers and account timestamps. This is provided by you and Google when you choose Google sign-in.
• Search and report data: search text, road, state, district, mukim, scheme, segment, property type, selected scope, report type and report-generation or download activity.
• Purchase and credit data: billing or delivery email, Stripe checkout/session and payment references, amount, currency, product, payment and fulfilment status, credit balances, credit transactions, promotional-code use and timestamps. Stripe supplies payment confirmation and related metadata.
• Agent-verification data: submitted full legal name, REN number, verification job status, attempts, timestamps and selected public-record results including official name, estate agency firm, registration status and verification outcome. The Agent provides the submitted details; public result data comes from LPPEH's public negotiator search.
• Listing and contact data: Agent phone/WhatsApp number, property scope and reference, type, location, road or scheme, unit-size type and size, asking price, description, listing status, publication dates, median-data snapshots and listing-management history.
• Photos: uploaded image content and processed technical metadata such as file type, size, dimensions, order and storage object key. Images may themselves contain personal data visible in the scene.
• Safety and moderation data: report reason, details, duplicate-listing reference, reporter account, report status, admin review notes, suspension reason, moderator identity and audit timestamps.
• Listing-interaction data: listing views, shares and WhatsApp-button clicks, a pseudonymous session hash, signed-in user ID where available, referring-site origin, campaign parameters and timestamps.
• Technical and security data: IP address, browser and device information, cookies, request and response metadata, authentication and security events, rate-limit information, diagnostic logs and error details.
• Communications: emails, support requests, complaints, evidence and other information you send to us.

3. Data we do not request

PropMedian does not ask for or store your Google password, full payment-card number, online-banking password or NRIC number. Google handles Google credentials and Stripe handles payment credentials. Although the REN form asks for the name shown on an NRIC, it does not request a copy or number of that identity document. Do not upload these items through a description, photo or support message unless we specifically request a lawful and secure method.

4. Why we process personal data

We process personal data to:

• create and secure accounts, authenticate users and provide dashboards;
• perform searches, calculate results, generate Reports and provide authorised downloads;
• process payments, credits, promotions, fulfilment, reconciliation, accounting and refunds;
• compare submitted Agent details with an active public REN record and manage manual review;
• create, publish, organise, maintain and share property Listings and connect users with Agents;
• process, compress, store, display and remove Listing photos;
• measure Listing views, shares and WhatsApp interest and improve marketplace usefulness;
• receive reports, investigate misconduct, prevent spam or scams, moderate content and keep an audit trail;
• provide support, send service messages and enforce our Terms;
• detect security incidents, fraud, abuse and technical failures;
• understand use of the Service and improve performance and usability; and
• comply with legal, regulatory, accounting and dispute-resolution obligations.

Where Malaysian law requires consent, we rely on your consent. We may also process information where necessary to provide a service or transaction you request, comply with law, administer legal rights or protect security, subject to applicable law.

5. Required and optional information

Information marked required is needed for the stated feature. Without account and verified-email information, we cannot provide authenticated dashboards or reporting. Without a full name and REN number, we cannot perform Agent verification. Without required property, size, price, description and contact information, we cannot publish a Listing. Photos are currently optional. If you do not provide optional information, the remaining Service may still be available.

6. Public information

Publishing a Listing necessarily makes selected information available to the public and search engines. This may include the Agent's displayed name, REN number, estate agency firm and registration number, business contact/WhatsApp number, property information, asking price, description, photos, statistical comparisons and Listing URL.

Do not publish personal or confidential information that is unnecessary for advertising. Removing a Listing stops future display through PropMedian, but copies may remain temporarily in caches, search indexes, shared messages or third-party archives outside our direct control.

7. Automated REN-record checking

Our isolated browser worker submits REN digits to LPPEH's public search, selects the negotiator search, reads the returned public record and compares the normalised official name and active status with the submitted details. A clear match may automatically enable posting. A mismatch, inactive status, source failure, CAPTCHA or ambiguous result will not automatically verify the Agent and may be reviewed manually.

We retain selected result fields and outcomes, not raw page HTML, screenshots, browser storage or NRIC data. You may ask for human review of an outcome by contacting us.

8. Photos and object storage

Listing photos are resized, converted and compressed, and original metadata such as EXIF is removed during server processing. Processed images and thumbnails are stored in Cloudflare R2 object storage. PostgreSQL stores only related metadata and object references. Technical copies may exist briefly during upload, processing, caching, backup or deletion.

9. Who receives personal data

We disclose only what is reasonably necessary to:

• Render: application and PostgreSQL hosting, networking, logs and backups;
• Cloudflare: R2 photo storage, delivery and related infrastructure;
• Google: Google account authentication and Google Analytics measurement;
• Stripe: checkout, payment confirmation, fraud prevention, refunds and payment records;
• Email providers: report delivery, receipts, service notices and support;
• LPPEH public systems: REN digits are submitted to retrieve a public negotiator record;
• WhatsApp/Meta: when you choose a WhatsApp contact link, your browser opens WhatsApp and shares information according to WhatsApp's own terms;
• Professional or legal recipients: advisers, insurers, the relevant estate agency firm, LPPEH, regulators, law enforcement or courts where reasonably necessary and lawful; and
• Business-transfer recipients: a genuine purchaser, successor or adviser in a proposed restructuring or transfer, subject to confidentiality and applicable law.

We do not sell personal data. Reporter identity and private moderation material are not displayed publicly, although they may be disclosed where required for a lawful investigation, fairness or legal process.

10. Cookies, analytics and direct marketing

We use essential cookies or similar storage for sign-in, security and session operation. If configured, Google Analytics uses cookies and identifiers to measure visits, pages, device category and interactions. Browser settings and available Google opt-out tools can limit non-essential cookies, but blocking essential storage may prevent sign-in or other features.

We may send transactional messages about purchases, verification, Listings, security or support. We will obtain any consent required before sending electronic direct marketing, identify such messages and provide a practical opt-out. You may ask us to stop direct marketing at any time.

11. Cross-border processing

Some service providers or their support and backup systems may process personal data outside Malaysia. We take reasonable steps to use appropriate contractual, organisational and technical safeguards and to ensure that transfers are permitted under applicable Malaysian law.

12. Retention

We maintain an internal retention process and delete or permanently de-identify personal data when its purpose expires, unless retention is required or permitted by law. Residual copies may remain until ordinary backup cycles complete.

13. Security and data incidents

We use reasonable administrative and technical measures including HTTPS, authentication, access controls, secret separation, restricted administrative access, input validation, rate limits, private object storage or time-limited media URLs, backups and monitoring. No internet system is completely secure.

We assess suspected personal-data breaches and notify the Malaysian Personal Data Protection Commissioner and affected individuals where required by applicable law and official guidance.

14. Your rights and choices

Subject to the Personal Data Protection Act 2010, its amendments, exemptions and applicable procedures, you may request access to and correction of personal data, withdraw consent where processing relies on consent, object to direct marketing, ask us to prevent processing likely to cause damage or distress, request review of a significant automated outcome, and request deletion or data portability where applicable.

Some requests may be limited where retention or processing is required for a contract, completed transaction, law, security, fraud prevention, another person's rights or legal claims. We may need to verify your identity. Send requests to prop.median.my@gmail.com. You may also lodge a complaint with Malaysia's Personal Data Protection Commissioner.

15. Accuracy

Please keep your account, Agent, contact and Listing information accurate and current. You may correct editable fields through the Service or contact us. Public REN information should be corrected with the source authority as well as with PropMedian.

16. Children

The paid-report and Agent-listing features are intended for persons aged 18 or older. We do not knowingly invite children to create Agent profiles or purchase Reports. Contact us if you believe a child's personal data was provided improperly.

17. Changes to this notice

We may update this notice when our services, providers or legal duties change. We will publish the revised date and may provide additional notice for material changes. A new purpose materially different from the purpose originally notified will be handled in accordance with applicable law.

18. Contact

For access, correction, deletion, consent, marketing opt-out, automated-review, complaint or other privacy requests, email prop.median.my@gmail.com or write to the address in section 1.