Legal Document · PDPA 2010 Notice

PDPA Notice

Effective Date: 12 May 2026
Last Updated: 12 May 2026
SSM: NS0302036-W
This Notice is issued pursuant to Section 7 of the Personal Data Protection Act 2010 (Malaysia) — the "Notice and Choice Principle". It is provided in English as the governing version. A Bahasa Malaysia version is also available.

Contents

  1. Data Controller
  2. Categories of Personal Data
  3. Purposes of Collection
  4. Source of Data
  5. Obligation to Supply
  6. Disclosure to Third Parties
  7. Right of Access & Correction
  8. Right to Limit Processing
  9. Withdrawal of Consent
  10. Data Breach Notification
  11. Cross-Border Data Transfer
  12. Contact & Complaints

1. Data Controller

The Data Controller referred to in this Notice is:

  • Company Name: Boost Media Marketing
  • SSM Registration No.: NS0302036-W
  • Country of Registration: Malaysia
  • Contact: WhatsApp +60 11-1690 5463 / info@boostmediamarketing.com.my

2. Categories of Personal Data Collected

We may collect the following categories of your personal data:

(a) Contact Information

  • Name / Company name
  • WhatsApp / phone number
  • Email address

(b) Business Information

  • Industry sector / business type
  • Monthly advertising budget range
  • Business requirements description

(c) Technical Information

  • IP address, browser and device data
  • Cookies and access logs

We do not collect sensitive personal data (health, religious belief, political affiliation, criminal records, etc.) unless you proactively provide such data with prior consent.

3. Purposes of Collection and Processing

Your personal data will only be processed for the following purposes:

  • (a) Responding to inquiries and providing quotations
  • (b) Performing service contracts (ad campaigns, design, consultation)
  • (c) Maintaining business relationships and customer service
  • (d) Sending service-related reports and notifications
  • (e) Improving the quality of our services
  • (f) Sending marketing communications with your prior explicit consent
  • (g) Compliance with legal, tax, and accounting requirements

Explicit Consent Mechanism

For data collected via website forms, we use a mandatory opt-in checkbox at the point of submission. Your active ticking of this checkbox constitutes your explicit consent, in compliance with the Notice and Choice Principle (Section 7) and Consent Principle (Section 6) of PDPA 2010.

4. Source of Personal Data

Our data is sourced primarily from:

  • Direct Sources: Information you proactively provide via forms, WhatsApp, email, or meetings
  • Indirect Sources:
    • Third-party referrers (with your consent)
    • Public sources (corporate registries, public social media)
    • Advertising platform analytics tools (aggregated data only)

5. Obligation to Supply Data

Please note:

  • Mandatory Information (name, WhatsApp or email) — must be provided, otherwise we are unable to respond to your inquiry or provide services
  • Optional Information (industry, budget, requirements) — you may choose not to provide, though this may affect the precision of our recommendations

6. Categories of Third Parties to Whom Data May Be Disclosed

We may disclose your data to the following classes of third parties, only as necessary for service execution:

  • (a) Advertising Platforms: Meta, Google, TikTok, Xiaohongshu, etc., when you authorize us to run ads on your behalf
  • (b) Technical Service Providers: Website hosting (Shinjiru), form submission services (Web3Forms), CRM tools
  • (c) Professional Advisers: Accountants, lawyers (if necessary)
  • (d) Government Authorities: As required by law

We do not sell, rent, or transfer your data to unrelated third parties for profit.

7. Right of Access and Correction

Pursuant to Sections 30 and 34 of PDPA 2010, you have the right to:

  • Request access to personal data we hold about you
  • Request correction of data that is inaccurate, incomplete, or out of date

To submit a request: Contact us via the methods in Section 12. We will respond within 21 days.

A reasonable processing fee may apply pursuant to PDPA Section 35.

Data Portability

In line with evolving PDPA guidelines and best practices, you may also request a copy of your personal data in a structured, commonly used, and machine-readable format (e.g. CSV, JSON), where technically feasible.

8. Right to Limit Processing & Object to Marketing

Pursuant to Sections 38 and 43 of PDPA 2010, you have the right to:

  • Request limitation of data processing
  • Object to direct marketing (including email, WhatsApp promotions)

Methods to opt out:

  • Reply "STOP" or "UNSUBSCRIBE" via WhatsApp
  • Email with subject line "Unsubscribe"
  • Contact us directly

9. Withdrawal of Consent

You may withdraw consent previously given to us at any time, via:

  • WhatsApp notification
  • Email notification

Withdrawal does not affect the lawfulness of processing carried out based on your consent prior to withdrawal.

Please note: Withdrawal of consent may result in our inability to continue providing services to you.

10. Data Breach Notification

Pursuant to evolving Malaysian PDPA guidelines (including 2024/2025 amendments) and international best practices, in the event of a material personal data breach that poses significant risk to your rights and interests, we commit to:

  • Notifying the Department of Personal Data Protection (JPDP) within 72 hours of becoming aware of the breach;
  • Notifying affected data subjects without undue delay, with information on the nature of the breach, likely consequences, and mitigation steps;
  • Maintaining internal records of all breaches (regardless of severity) for accountability and audit purposes.

11. Cross-Border Data Transfer

Your personal data may be transferred to, processed by, or stored on servers located outside Malaysia. This occurs when we use third-party service providers, including:

  • Web3Forms (form submission backend) — United States
  • jsDelivr CDN (JavaScript library delivery) — United States / Global
  • Google Fonts (web font delivery) — United States
  • Shinjiru (web hosting provider) — Kuala Lumpur, Malaysia · Data center within Malaysia; not subject to cross-border transfer

We may add additional services such as Google Analytics or Meta Pixel in the future for marketing analytics purposes. If we do, this Notice will be updated before activation.

All cross-border transfers are made in compliance with PDPA 2010 Section 129, and only to jurisdictions with adequate data protection laws or under appropriate contractual safeguards (e.g. Standard Contractual Clauses).

12. Contact & Complaints

For matters relating to this Notice or to exercise your PDPA rights, please contact:

If you are dissatisfied with how we handle your personal data, you may also lodge a complaint with:

  • Department of Personal Data Protection (JPDP), Malaysia
  • Website: www.pdp.gov.my

Please also refer to our Privacy Policy.