Privacy Policy (PDPA) — Embun Homes

1. Introduction & Scope

Embun Homes Sdn. Bhd. ("Embun Homes", "we", "our", or "us") operates the website embunhomes.com.my and associated homestay reservation services. We are dedicated to safeguarding the personal data of our guests, hosts, and visitors in strict compliance with the Personal Data Protection Act 2010 of Malaysia (PDPA). This Privacy Policy explains what personal data we collect, how it is processed and secured, who it may be disclosed to, and your legal rights regarding your information.

2. Information We Collect

When you register, place a reservation, or communicate with us, we collect the necessary hospitality and booking information:

Contact Information: Full name, email address, telephone / WhatsApp contact number.
Booking Details: Selected homestay property, check-in and check-out dates, guest counts, and special requests.
Payment & Transaction Details: Payment transaction references, card authorization status, hold IDs, and refund receipts processed securely through our licensed payment gateway partner (CHIP Asia). Embun Homes does not store your complete credit/debit card numbers on our servers.
Account Credentials: Hashed and salted password representations stored using bcrypt, or linked Google OAuth profiles.

3. Purpose of Processing

Your personal data is collected and processed exclusively for lawful purposes:

Facilitating reservation requests, host approvals, and stay scheduling.
Processing pre-authorization card holds and booking payments via CHIP In Asia Sdn. Bhd.
Issuing automated email booking receipts, confirmation notifications, and check-in instructions.
Customer support and resolving inquiries regarding homestay accommodations in Kampung Bukit Larang, Melaka.
Complying with statutory, regulatory, and tax obligations under Malaysian law.

4. Third-Party Disclosures & Service Providers

We do not sell, rent, or trade your personal data. Personal data is disclosed only to verified service providers essential to fulfilling your reservation: CHIP In Asia Sdn. Bhd. (licensed payment gateway partner), Cloudflare R2 and AWS (cloud infrastructure), and verified Embun Homes host families.

5. Adherence to the 7 PDPA 2010 Principles (Act 709)

Our personal data governance framework strictly implements all seven statutory principles of the Malaysian Personal Data Protection Act 2010:

General Principle: Personal data is processed only with explicit, recorded guest consent (consent_records).
Notice & Choice Principle: Clear bilingual-ready disclosures and opt-in checkboxes are provided prior to checkout.
Disclosure Principle: Data is shared solely with essential hospitality partners (designated host family & BNM-regulated payment gateway CHIP Asia).
Security Principle: TLS 1.3 transport encryption, RSA-SHA256 webhook verification, and salted bcrypt credential hashing.
Retention Principle: Data is retained only for active reservations and statutory Malaysian accounting periods (7 years for financial ledgers).
Data Integrity Principle: Guests can update and verify their profile details at any time via their account dashboard.
Access Principle: Guests have the statutory right to access, export, correct, or request erasure of their personal data within 21 days.

6. Your PDPA Rights & Data Protection Officer Contact

Under the Malaysian PDPA 2010, you have the right to request access to, verify, correct, or withdraw consent for the processing of your personal data. You may submit a request directly using the form below or contact our Data Protection Officer at hello@embunhomes.com.my, Kampung Bukit Larang, 75460 Telok Mas, Melaka, Malaysia.