Privacy Policy

1. Introduction & Scope

Embun Homes Sdn. Bhd. ("Embun Homes", "we", "our", or "us") operates the website embunhomes.com.my and associated homestay reservation services. We are dedicated to safeguarding the personal data of our guests, hosts, and visitors in strict compliance with the Personal Data Protection Act 2010 of Malaysia (PDPA).

This Privacy Policy explains what personal data we collect, how it is processed and secured, who it may be disclosed to, and your legal rights regarding your information.

2. Information We Collect

When you register, place a reservation, or communicate with us, we collect:

• Contact Information: Full name, email address, telephone / WhatsApp contact number.
• Booking Details: Selected homestay property, check-in and check-out dates, guest counts, and special requests.
• Payment & Transaction Details: Payment transaction references, card authorization status, hold IDs, and refund receipts processed securely through our licensed payment gateway partner (CHIP Asia). Embun Homes does not store your complete credit/debit card numbers on our servers.
• Account Credentials: Hashed and salted password representations stored using bcrypt.

3. Purpose of Processing

Your personal data is collected and processed exclusively for the following lawful purposes:

• Facilitating reservation requests, host approvals, and stay scheduling.
• Processing pre-authorization card holds and booking payments via CHIP In Asia Sdn. Bhd.
• Issuing automated email booking receipts, confirmation notifications, and check-in instructions.
• Customer support and resolving inquiries regarding homestay accommodations in Kampung Bukit Larang, Melaka.
• Complying with statutory, regulatory, and tax obligations under Malaysian law.

4. Third-Party Disclosures & Service Providers

We do not sell, rent, or trade your personal data. Personal data is disclosed only to verified service providers essential to fulfilling your reservation:

• Payment Gateway: CHIP In Asia Sdn. Bhd. (licensed under Bank Negara Malaysia payment guidelines) for secure card pre-authorization, capture, and refunds.
• Cloud & Media Infrastructure: Cloudflare R2 and Amazon Web Services for media hosting and system uptime.
• Email Delivery: Hostinger secure SMTP for transactional reservation emails.
• Designated Host Families: Verified Embun Homes host families receive your name and stay dates to prepare your accommodation.

5. Data Security & Retention

We implement industry-standard cryptographic practices including TLS encryption in transit, RSA-SHA256 signature verification for payment webhooks, and salted bcrypt hashing for passwords. Personal information is retained only as long as necessary to complete your booking, maintain accounting compliance, or as mandated by Malaysian law.

6. Adherence to the 7 PDPA 2010 Principles (Act 709)

Our personal data governance framework strictly implements all seven statutory principles of the Malaysian Personal Data Protection Act 2010:

• General Principle: Personal data is processed only with explicit, recorded guest consent (`consent_records`).
• Notice & Choice Principle: Clear bilingual-ready disclosures and opt-in checkboxes are provided prior to checkout.
• Disclosure Principle: Data is shared solely with essential hospitality partners (designated host family & BNM-regulated payment gateway CHIP Asia).
• Security Principle: TLS 1.3 transport encryption, RSA-SHA256 webhook verification, and salted bcrypt credential hashing.
• Retention Principle: Data is retained only for active reservations and statutory Malaysian accounting periods (7 years for financial ledgers).
• Data Integrity Principle: Guests can update and verify their profile details at any time via their account dashboard.
• Access Principle: Guests have the statutory right to access, export, correct, or request erasure of their personal data within 21 days.

7. Your PDPA Rights & Data Protection Officer Contact

Under the Malaysian PDPA 2010, you have the right to request access to, verify, correct, or withdraw consent for the processing of your personal data. You may submit a request directly using the form below or contact our Data Protection Officer: