Privacy Policy
Personal Data Protection Notice
Effective date: 22 July 2026
This Personal Data Protection Notice explains how SPACE AND PLACE SDN. BHD. collects, uses, discloses, stores and protects personal data in connection with our interior design, design-and-build, renovation, consultation, website, booking and marketing activities. It is issued under the Personal Data Protection Act 2010 [Act 709], as amended from time to time (“PDPA”).
1. Who we are
SPACE AND PLACE SDN. BHD. (Company No. 202201040241 (1485938-V)) is the data controller responsible for the personal data described in this Notice.
Registered/business address: C-3-7, 280 Park Homes, Jalan Prima Utama 3, Taman Puchong Prima, 47150 Puchong, Selangor, Malaysia.
2. Scope of this Notice
This Notice applies to prospective clients, clients, website visitors, appointment holders, property owners or occupants, representatives, suppliers, subcontractors and other individuals whose personal data we process in commercial transactions. It covers information collected online and offline, including through our website, Meta lead forms, social media, Acuity Scheduling, WhatsApp, telephone, email, meetings, site visits, quotations, contracts and project records.
3. Personal data we may collect
We may collect:
Identity and contact information, such as name, telephone number, email address, correspondence address, company, job title and preferred contact method.
Project and property information, such as the property or project location, address, property type and size, ownership or occupancy status, key-collection status, intended use, existing condition, renovation scope, budget, timeline, design preferences, floor plans, drawings, photographs, videos and site information.
Enquiry and communication records, including form answers, appointment details, WhatsApp messages, emails, call notes, meeting notes, approvals, feedback and complaints.
Commercial and transaction information, such as proposals, quotations, contracts, variation orders, invoices, receipts, payment status and accounting records. Where payment is made through a third-party payment provider, we generally do not receive or retain the full payment-card number.
Website, device and advertising data, such as IP address, browser or device information, pages viewed, referring page, cookie or similar identifiers, advertisement interactions and form or booking events.
Access or security information reasonably required for a managed property, building or project site.
Information about another person that you provide for the project, such as a spouse, co-owner, tenant, representative or contractor contact.
We do not normally request sensitive personal data. If you voluntarily provide such data, we will process it only where necessary and permitted by the PDPA, including with express consent where required.
4. Sources of personal data
We may collect personal data:
Directly from you or your authorised representative.
Through our website forms, booking forms, Meta lead forms, social-media pages, WhatsApp, telephone, email, meetings and site visits.
From referrals, property agents, consultants, suppliers, subcontractors, building management or other project parties.
From publicly available sources.
Automatically through website technologies, analytics tools and advertising technologies, subject to your cookie choices.
5. Why we process personal data
We may process personal data:
To receive, verify, qualify, respond to and follow up on enquiries.
To arrange consultations, appointments, calls, meetings and site visits.
To understand the property, scope, budget, timeline, design needs and project feasibility.
To prepare proposals, quotations, designs, drawings, schedules, contracts and project documentation.
To perform and manage interior design, renovation, procurement, site coordination, defect rectification, handover and warranty-related services.
To communicate with clients and authorised project parties, obtain approvals and manage changes, payments, disputes and complaints.
To process bookings, invoices, payments, accounting, audit, tax, insurance and other business records.
To operate, secure, troubleshoot and improve our website, forms, booking system, services and internal processes.
To measure advertising and website performance, attribute leads, create audiences and improve campaigns, subject to applicable consent and cookie choices.
To send direct marketing where you have consented or where otherwise permitted, with a clear way to opt out.
To prevent fraud, misuse and security incidents, and to establish, exercise or defend legal claims.
To comply with applicable laws, lawful requests, court orders and regulatory requirements.
We process personal data on one or more grounds permitted by the PDPA, including consent where required, taking steps at your request before entering into a contract, performing a contract, complying with legal obligations and other circumstances permitted by law.
6. Whether providing personal data is obligatory
Providing personal data is generally voluntary. However, information marked as required, or reasonably necessary to assess an enquiry, prepare a quotation, enter into a contract, receive payment or deliver a project, is obligatory for that purpose. If you do not provide it, we may be unable to respond fully, assess or quote the project, accept a booking, enter into or perform a contract, or provide the requested service. Advertising cookies, direct-marketing consent and permission to publish project material are optional. Refusing them will not prevent you from using our core services, although some website or embedded features may work differently.
7. Who we may disclose personal data to
Where necessary, we may disclose personal data to:
Our directors, employees, authorised freelancers, project leads and designers on a need-to-know basis.
Suppliers, subcontractors, installers, consultants, professionals, photographers and other project parties.
Property owners, authorised client representatives, building management, joint management bodies, management corporations, landlords and relevant authorities where required for project access or approvals.
Service providers for website hosting, online forms, appointment scheduling, communications, email, cloud storage, document collaboration, accounting, customer or lead management, analytics, advertising, payment processing, IT support and cybersecurity, including Squarespace, Acuity Scheduling, Meta, WhatsApp, Google, Xero and payment providers where applicable.
Banks, insurers, accountants, auditors, tax advisers, lawyers and other professional advisers.
Courts, regulators, law-enforcement agencies and government authorities where required or permitted by law.
A prospective purchaser, investor or adviser in connection with a genuine business restructuring, merger, acquisition or sale, subject to appropriate confidentiality controls.
We do not sell personal data. We require service providers and project parties to handle personal data only for authorised purposes and with appropriate confidentiality and security controls, to the extent applicable to their role.
8. Cross-border transfers
Some service providers or their subprocessors may store or process personal data outside Malaysia in countries where they operate. Such transfers may occur for website hosting, scheduling, communications, cloud storage, accounting, analytics, advertising, payment processing and technical support.
Where personal data is transferred outside Malaysia, we will comply with Section 129 of the PDPA by relying on an applicable transfer condition, informing you of the relevant class of recipient and purpose, taking reasonable precautions and due diligence, using contractual or other safeguards where appropriate, and obtaining and recording consent where required.
9. Cookies and online tracking
Our website uses essential cookies needed for security and basic functions. Subject to your choice, it may also use analytics and advertising technologies, including Squarespace Analytics and the Meta Pixel, to understand website use, measure advertisements, attribute enquiries and improve campaigns.
Non-essential cookies and tracking technologies remain restricted until you accept them through our cookie banner. You may accept, decline or manage non-essential cookies through the website’s cookie controls and may also change your browser settings. Declining non-essential cookies may reduce personalisation or measurement but should not prevent access to the core website. Third-party services may also set cookies under their own privacy notices.
10. Direct marketing
Submitting an enquiry does not automatically subscribe you to general promotional broadcasts. Where you separately consent, or where otherwise permitted by law, we may send relevant updates or offers by email, telephone, WhatsApp or similar channels. You may stop direct marketing at any time by using an unsubscribe option or contacting us. We may still send non-marketing communications needed to respond to your enquiry or administer an appointment, contract, payment, project, warranty or legal matter.
11. Project photography and portfolio use
We may take photographs or videos for site records, progress reporting, quality control, defect management and project administration. We will not publish a client’s name, exact address or identifiable project photographs for portfolio, advertising or social-media purposes unless we have separate permission or other clear contractual authorisation.
Permission for publication may be withdrawn for future use, subject to material already lawfully published and any applicable contractual rights.
12. Security
We take practical technical and organisational measures appropriate to the nature of the data and the risk of harm. These may include access restrictions, authentication controls, confidentiality requirements, secure storage and transfer practices, backups, software updates, vendor checks and incident-response procedures.
No internet transmission or storage system is completely secure, but we will take reasonable steps required by the PDPA to protect personal data from loss, misuse, unauthorised or accidental access or disclosure, alteration and destruction.
13. Retention
We retain personal data only for as long as necessary for the purpose collected and for legal, tax, accounting, warranty, dispute and record-keeping requirements.
As a general operational guide:
Enquiries that do not proceed are normally retained for up to 24 months after the last meaningful interaction.
Client, project and transaction records are normally retained for up to seven years after completion, termination or the last relevant transaction, and longer where required by law or reasonably needed for claims, warranties or disputes.
Direct-marketing records are retained until you opt out, withdraw consent or the information is no longer useful.
Cookie and analytics data is retained according to our settings and the relevant provider’s retention controls.
When personal data is no longer required, we will take reasonable steps to delete, destroy or anonymise it.
14. Your rights and choices
Subject to the PDPA and applicable exceptions, you may:
Ask whether we process your personal data and request access to it.
Request correction of inaccurate, incomplete, misleading or outdated personal data.
Withdraw consent where processing is based on consent, subject to legal or contractual consequences.
Ask us to limit processing where a choice is available.
Object to or prevent processing for direct marketing, or processing likely to cause damage or distress in circumstances provided by law.
Request transfer of personal data to another data controller, subject to technical feasibility, compatible data formats and applicable requirements.
Ask us to delete personal data that is no longer required, subject to lawful retention obligations.
To exercise a right, contact us using the details below. We may request reasonable proof of identity and information needed to locate the relevant records. You may also lodge a complaint with the Personal Data Protection Commissioner of Malaysia if you believe your personal data has been processed contrary to the PDPA.
15. Personal data about other people and minors
If you provide personal data about another person, you confirm that you are authorised to do so and will make this Notice available to that person where appropriate.
Our services are intended for adults. We do not knowingly seek personal data directly from individuals under 18 without appropriate involvement or consent from a parent, guardian or person with parental responsibility.
16. Contact us
For access, correction, withdrawal, direct-marketing opt-out, privacy questions or complaints, contact:
Attention: Personal Data Matters
SPACE AND PLACE SDN. BHD.
Email: hello@spacenplace.co
Telephone/WhatsApp: +60 12-609 3395
Address: C-3-7, 280 Park Homes, Jalan Prima Utama 3, Taman Puchong Prima, 47150 Puchong, Selangor, Malaysia.
17. Acknowledgment and consent
By voluntarily providing personal data after this Notice has been made available, you acknowledge that you have read and understood it. Where consent is the applicable ground, you consent to the processing, disclosures and cross-border transfers described in this Notice, subject to your right to withdraw consent.
This acknowledgment does not constitute separate consent for general direct marketing or public portfolio use where separate permission is required.
18. Changes and language
We may update this Notice to reflect changes in our practices, service providers or legal requirements. The latest version and effective date will be published on our website.
This Notice is provided in English and Bahasa Malaysia. If there is any inconsistency, the English version will prevail to the extent permitted by law.