Privacy Notice (PDPA)

This Privacy Notice is issued by ZenZhiin Venture Sdn Bhd ("RentZhiin", "we", "us", or "our"), the data controller of your personal data as defined under the Personal Data Protection Act 2010 (PDPA) of Malaysia.

If you have questions about how we handle your personal data, please contact our data protection point of contact at support@zenzhiin.com.

This notice applies to all personal data collected through the RentZhiin web platform and mobile application ("the Platform"). It applies to all user categories: property owners, tenants, real estate agents, agency administrators, and contractors.

The categories of personal data we collect depend on your role:

All users: Full name, email address, Malaysian mobile number, hashed password, and account activity logs.

Property owners: Identity verification documents (MyKad front), property address(es), bank account details (for rent disbursement reference), billing information (subscription), and property-related documents and photos.

Tenants: MyKad number and front copy (Malaysian citizens), passport number and copy, visa or permit type and number (Employment Pass, Professional Visit Pass, PLKS, Student Pass, MM2H, or other), CTOS credit report data (only with explicit written consent), employment and income information (provided voluntarily during screening), and emergency contact details.

Real estate agents and agency administrators: MyKad or passport copy, BOVAEP REN tag number, agency name and BOVAEP licence number, and commission records.

Contractors: Business registration number (if a company), identity document, trade category, and service records.

All users: Device and browser information, IP address, and usage logs collected automatically when you access the Platform.

We use your personal data only for the following purposes, which correspond to the legal bases available under the PDPA:

(a) Performance of contract: Creating and managing your account; facilitating tenancy agreements, rent tracking, maintenance requests, and deposit workflows; generating payment references.

(b) Consent: Conducting tenant screening including CTOS credit checks, sharing screening results with the relevant property owner, and sending marketing communications. You may withdraw consent at any time.

(c) Legitimate interest: Detecting and preventing fraud, abuse, and illegal activity; improving the reliability and security of the Platform; and maintaining internal audit records.

(d) Legal obligation: Retaining records as required by Malaysian tax law (Income Tax Act 1967), the Companies Act 2016, and other applicable statutes.

RentZhiin is designed for Malaysian users and their data. All primary database storage and application servers are hosted in the Asia Pacific region. We do not store your personal data on servers located in Europe or North America.

This is a deliberate product decision made to align with the data residency expectations of the PDPA and to ensure that your data remains subject to Malaysian and regional legal protections. This data residency approach is part of our core platform commitment and is a key differentiator from many competing services.

RentZhiin uses a limited number of third-party service providers who process personal data on our behalf as data processors. We have data processing agreements in place with each of them and they are only permitted to process your data for the purposes we specify:

Cloudflare, Inc. (USA): Content delivery network and DDoS protection. Cloudflare processes request metadata (IP addresses, device headers) to route and protect traffic. Data is subject to Cloudflare's Standard Contractual Clauses.

Cloudflare R2 (USA): Object storage for user-uploaded documents and images (e.g., tenancy agreements, property photos, identity documents). Files are encrypted at rest.

Resend, Inc. (USA): Transactional email delivery (account verification, rent reminders, receipts). Email addresses and relevant message content are shared for delivery purposes.

CTOS Data Systems Sdn Bhd (Malaysia): Credit reporting agency used for tenant screening. Personal data is shared only with the explicit prior written consent of the tenant being screened.

We do not use Google Analytics, Meta Pixel, or any third-party advertising or behavioural tracking tools on the Platform.

We do not sell your personal data. We do not share your personal data with third parties except as described in Section 6, and in the following circumstances:

Between platform users: An owner's contact name and phone number are visible to their tenants and vice versa, as necessary for managing a tenancy. Tenant screening results are shared only with the owner who initiated the screening with the tenant's consent.

Legal requirements: We may disclose personal data where required to do so by Malaysian law, court order, or lawful authority, including the Personal Data Protection Department (JPDP), the Royal Malaysia Police, or the Malaysian Communications and Multimedia Commission (MCMC).

The Platform uses a minimal set of cookies strictly necessary to operate the service:

Session cookie: A single HTTP-only, Secure session cookie (prm_session) is used to maintain your login state. This cookie expires when your browser session ends or after 7 days of inactivity, whichever is sooner.

We do not use analytics cookies, marketing cookies, third-party tracking cookies, or fingerprinting technologies. You cannot opt out of the session cookie as it is strictly necessary for the Platform to function.

We retain your personal data for as long as your account is active and for a reasonable period thereafter to allow you to reactivate your account. Specific retention periods by category:

Tenancy records and financial transaction records: 7 years from the end of the tenancy, to meet the requirements of the Income Tax Act 1967 and the Limitation Act 1953.

Tenant screening reports: 2 years from the date of the screening, or until the tenancy ends, whichever is later. The report is then deleted.

Account information: Retained for the lifetime of the account, plus 90 days after account closure to allow recovery requests.

Error and system logs: 30 days, after which they are automatically deleted.

When you close your account, we will delete or anonymise all personal data that we are not required by law to retain within 90 days of your request.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, misuse, alteration, or destruction, in accordance with the Security Principle of the PDPA. These measures include:

All data in transit is encrypted using TLS 1.2 or higher. Passwords are hashed using bcrypt with an appropriate work factor and are never stored in plaintext. Authentication uses short-lived JSON Web Tokens (JWTs) transmitted via HTTP-only cookies. Sensitive files (identity documents, agreements) are stored in encrypted object storage with access controlled by pre-signed URLs that expire after a short period. Database backups are encrypted at rest.

Despite these measures, no system is completely secure. In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the Personal Data Protection Department (JPDP) within the timeframe required by applicable law.

The Platform is intended for users aged 18 and above. We do not knowingly collect personal data from individuals under the age of 18. If you are a parent or guardian and believe your child has provided personal data to us, please contact us at support@zenzhiin.com and we will delete that data promptly.

Some of our third-party processors (Cloudflare, Resend) are incorporated in the United States. Where personal data is transferred outside Malaysia, we ensure that such transfers comply with Section 129 of the PDPA by using Standard Contractual Clauses or other appropriate safeguards recognised under Malaysian law.

CTOS Data Systems Sdn Bhd, our credit reporting partner, is a Malaysian company and processes data entirely within Malaysia.

Under the Personal Data Protection Act 2010, you have the following rights:

Right of access (Section 30): You may request a copy of the personal data we hold about you. We will respond within 21 days of receiving a valid request.

Right to correct (Section 34): You may request that we correct any personal data that is inaccurate, incomplete, misleading, or not kept up to date.

Right to withdraw consent (Section 38): Where we rely on your consent to process personal data (for example, for tenant screening), you may withdraw that consent at any time by contacting us. Withdrawal of consent does not affect the lawfulness of processing that occurred before withdrawal.

Right to limit processing (Section 42): You may request that we cease processing your personal data if the processing is likely to cause you unwarranted damage or distress.

To exercise any of these rights, email support@zenzhiin.com with the subject line "PDPA Data Request". We may need to verify your identity before processing your request. We will not charge a fee for data access requests except in circumstances permitted by the PDPA.

If you believe we have not handled your personal data in accordance with the PDPA, you have the right to lodge a complaint with the Personal Data Protection Commissioner (Pesuruhjaya Perlindungan Data Peribadi) under the Department of Personal Data Protection (Jabatan Perlindungan Data Peribadi — JPDP):

Website: www.pdp.gov.my Email: pdp@kkmm.gov.my Phone: 03-8911 5000

We encourage you to contact us at support@zenzhiin.com first so we have an opportunity to address your concern directly.

We may update this Privacy Notice from time to time to reflect changes in law, our data practices, or the services we offer. We will notify you of material changes via email or an in-app notice at least 14 days before the changes take effect. The current version will always be available at this URL with the effective date noted below.

ZenZhiin Venture Sdn Bhd Email: support@zenzhiin.com

For privacy-related requests, please mark your email subject line: "PDPA Privacy Request".