How we handle transaction data

Definitions

To help interpret this policy in real estate contexts, we define several recurring terms with practical scenarios. For example, when an agent uploads a signed sale agreement into DealMFlow, the uploaded file and related names and contact details are 'Personal Data'; the act of storing and transmitting that agreement is 'Processing'.

Personal Data: any information that identifies or can reasonably identify an individual in a transaction scenario—for instance buyer and seller names, contact numbers, email addresses, company registration numbers, identity document numbers, and signed documents attached to a transaction record.

Processing: any operation performed on Personal Data including collection, recording, organization, structuring, storage, retrieval, consultation, use, disclosure by transmission, erasure or destruction. Example: extracting purchaser bank account details to initiate a deposit to an escrow provider.

User: a registered or unregistered individual or entity who uses DealMFlow to list properties, manage offers, coordinate conveyancing, or otherwise interact with the transaction management platform. Example roles include buyer, seller, agent, lawyer, and escrow provider.

Service: the DealMFlow platform and any related functionality hosted at DealMFlow.club used for listing management, offer negotiation, legal document sharing, escrow coordination and closing workflows.

Cookies: small text files set by our website or third parties to remember preferences, enable core functionality, and collect analytics. Practical example: a session cookie maintaining an agent's authenticated session while they review offers.

How We Use Your Data

We use data to operate the DealMFlow platform and to support real estate transactions. Below are common purposes described with practical use cases such as closing a sale, coordinating legal documents, and responding to a post-completion query.

• To facilitate property transactions: routing offers, managing acceptance workflows, generating checklists for conveyancing, and coordinating settlement steps with partners.
• Identity verification and compliance: validating identities and documentation to meet KYC, AML and other relevant legal obligations for particular transaction types.
• Payments and escrow coordination: sending payment instructions and receiving confirmations from payment partners to reflect transaction milestones in the platform.
• Communication and support: sending notifications about transaction status, responding to user inquiries, and maintaining records for dispute resolution.
• Security and fraud prevention: detecting suspicious behavior, protecting accounts, and maintaining audit logs to contribute incidents.
• Service improvement and analytics: analyzing anonymized usage patterns to refine workflows, reduce friction in common scenarios, and prioritize product fixes.
• Legal obligations and requests: responding to regulatory enquiries, court orders, or lawful requests by authorities related to a specific transaction.
• Marketing and communications where you have consented: sending product updates, training invitations, or relevant market insights with clear opt-out options.

Legal Basis for Processing

When applicable, we rely on appropriate legal bases to process personal data. The basis used depends on the specific processing activity and the role you have in a transaction.

• Performance of a contract: processing necessary to create, negotiate, execute, or enforce a transaction agreement between parties.
• Consent: where users voluntarily agree to processing for specific purposes, such as receiving marketing communications.
• Legal obligation: processing required to comply with laws or regulations, such as AML checks or tax records retention.
• Legitimate interests: processing that supports platform security, fraud prevention, and product improvements where such interests are balanced against individual rights.

International Data Protection and GDPR

DealMFlow is based in Malaysia but recognizes international privacy concepts such as individual access and correction rights. When EU personal data is processed, we may apply additional safeguards and respect rights consistent with international standards.

• Access: users can request a copy of the personal data we hold about them related to a transaction scenario, such as a history of offers and documents.
• Rectification: users may ask to correct inaccurate personal information like a misspelled name or incorrect bank details used for settlement.
• Erasure: where lawful, users can request deletion of personal data that is no longer necessary for the transaction or legal retention.
• Restriction: users may request restriction of processing while a dispute about accuracy is resolved.
• Portability: where feasible, users may request their data in a commonly used machine-readable format to transfer to another provider.
• Objection: users may object to processing based on legitimate interests, subject to our need to retain data for legal compliance or contract performance in transaction workflows.

Cookies and Similar Technologies

We use cookies, local storage and similar technologies to provide essential functionality, remember preferences and gather usage analytics to improve transaction flows. Cookies can be managed at browser level or via our cookie settings.

Common types include session cookies that expire when you close the browser, persistent cookies that remember settings across visits, and third-party cookies used by analytics or embedded services.

We categorize cookies as essential (required for core platform functions), functional (preferences and settings), analytics (usage measurement), and advertising (used only with explicit consent for targeted promotions).

You can manage cookie preferences via the cookie banner, update settings in your account, or disable cookies using your browser. Disabling certain cookies may limit functionality such as maintaining an authenticated session.

Full Cookie Policy available at DealMFlow.club/cookies

Data Sharing

DealMFlow shares data with third parties only as necessary to complete transactions or comply with law. Examples below show typical partners and the reasons for shared data in real scenarios.

• Payment and escrow providers: to initiate deposits and confirm settlements as part of closing procedures.
• Conveyancing and legal partners: to provide necessary documents and contact details for title transfers and completion steps.
• Regulatory and governmental agencies: to comply with lawful requests or reporting obligations related to property transactions.
• Analytics and hosting providers: for platform operation, maintenance, and anonymized usage analysis to improve workflows.
• Affiliates and service partners: where you elect integrated services or where a partner is directly involved in a specific transaction.
• Law enforcement and dispute resolution parties: to respond to legal processes, contribute requests or to defend legal claims.

International Transfers

Some processing partners and servers may be located outside Malaysia. Transfers occur only where necessary for service delivery and are governed by contractual and technical safeguards.

We apply safeguards such as contractual data processing terms, limited data transfer scopes, encryption in transit and at rest, and minimum necessary data transfers to protect data when it crosses borders.

Data Retention

Retention periods vary depending on the type of data and legal requirements. We retain personal data for the duration needed to fulfill transaction purposes, meet regulatory obligations, and resolve disputes.

Account and profile information is retained while the account is active and thereafter only to meet legal, tax, or compliance obligations or until deletion requests are completed.

Communication records and transaction messages are retained as part of the transaction audit trail for a reasonable period to support dispute resolution and compliance needs.

Security and access logs are retained for a period necessary to contribute incidents and improve security, typically aligned to operational best practices for incident response.

When retention periods expire or upon verified deletion requests, we remove or anonymize personal data where feasible, except where retention is required by law or for legitimate resolution of disputes.

Security Measures

DealMFlow implements a combination of technical and organizational measures to protect personal data. Measures are chosen based on the sensitivity of the data and include encryption, access controls, personnel training, and regular security reviews.

• Encryption in transit and at rest for sensitive transaction and identity documents.
• Role-based access controls and least-privilege principles for staff and partner integrations.
• Regular security assessments, logging, monitoring and incident response procedures to address and learn from security events.

Your Rights

You have rights regarding your personal data in our systems. Below each right is described with an example real estate scenario of how you might use it — for instance, correcting an incorrect bank account before settlement.

• Access: request a copy of personal data we hold about you such as uploaded agreements and transaction logs.
• Rectification: ask us to correct inaccurate information, for example an incorrect buyer contact number before closing.
• Erasure: request deletion of data no longer necessary for contractual or legal reasons, such as obsolete marketing preferences.
• Restriction: request suspension of processing while accuracy disputes are resolved for specific records relating to a transaction.
• Portability: obtain a machine-readable copy of your personal data to transfer to another platform where technically feasible.
• Objection: object to processing based on legitimate interests, for example profiling for certain automated decisions, subject to our need to preserve records required for legal compliance.
• Withdraw consent: where processing is based on consent, you can withdraw it; withdrawal does not affect processing already completed while consent was in effect.
• Complaint: lodge a complaint with supervisory authorities if you consider our processing to be unlawful, after contacting our team to try to resolve the issue directly.

How to Make a Rights Request

To exercise rights, contact our Data Protection Officer at [email protected] or send a written request to our office address. Include sufficient information to locate your records and a description of the request. We may request identity verification before responding to help protect privacy.

[email protected]

We review requests promptly and aim to respond as soon as possible and typically within 30 calendar days, subject to any legal extensions required to verify identity or complex requests.