Privacy Policy

1. Who we are

This policy is issued by CarrotProperty Sdn Bhd (Company No. 202201011541), a company incorporated in Malaysia (“CarrotProperty”, “we”, “us”).

Ketchup is our enquiry management system for property agents. Agents use it to keep track of WhatsApp enquiries about properties for sale and rent: who they need to reply to, appointments and viewings, bookings, loans and follow-ups.

• We use Ketchup ourselves, for enquiries made to CarrotProperty's own agents.
• We also provide Ketchup to other property agents and agencies. They connect their own WhatsApp Business numbers and use it for their own customers.

If you message an agent on WhatsApp, you don't use Ketchup yourself. The agent does.

2. Our role: controller or processor

Under Malaysia's Personal Data Protection Act 2010 (“PDPA”), our role depends on whose customer you are.

If you contacted CarrotProperty

We are the data controller (a “data user” under the PDPA). We decide how your data is used, as described in this policy.

If you contacted another agent or agency that uses Ketchup

That agent or agency is the data controller for your data. CarrotProperty is their data processor: we process your data on their behalf, only on their instructions, and only to provide Ketchup to them. In particular:

• We do not use their contacts for CarrotProperty's own business. We do not contact their customers, and we do not pass them to our own agents or to any other agent.
• We do not combine one agent's data with another's, or use it to build profiles or for advertising.
• Our staff access an agent's data only to operate, support or secure the service, or where the law requires it.
• As a data processor we remain directly bound by the PDPA's security requirements.

That agent is responsible for their own use of your data, including telling you how they use it. This policy explains how Ketchup handles it on their behalf.

If you are an agent using Ketchup

We are the data controller for your account details (see 3.5).

3. What we collect

This section covers:

• people who contact an agent using Ketchup on WhatsApp, including buyers, tenants, owners and people enquiring after seeing an advert or property listing;
• people an agent works with on a transaction, such as co-broking agents, bankers, referrers and representatives acting for a buyer;
• the agents and agencies who use Ketchup.

3.1 Contact details

Ketchup receives these through the WhatsApp Business Platform (operated by Meta). They include:

• your WhatsApp phone number and country code;
• your WhatsApp profile name, and any WhatsApp account identifier used instead of a number when you have not shared one.

An agent may also save a different name for you, for example your real name in place of a nickname. Ketchup keeps the WhatsApp profile name alongside it.

3.2 Message metadata, but not message content

For each WhatsApp message between you and the agent, Ketchup stores only:

• whether it was sent or received;
• the date and time;
• the number of characters;
• the message ID that WhatsApp assigns to it.

Ketchup's database has no field for message text, and it does not store photos, voice notes, documents or other attachments. Your conversation itself stays in WhatsApp.

3.3 How you found the agent

If you contacted the agent by tapping a Facebook or Instagram “click to WhatsApp” advert, WhatsApp attaches details of that advert to your first message. Ketchup stores:

• the advert's ID, headline, description and link, and the click ID. These describe the agent's advert, not anything you wrote.

If your first message came from a property portal listing, Ketchup stores that listing's reference number. This tells the agent which adverts and listings bring in enquiries.

3.4 What the agent records about your enquiry

As your enquiry progresses, the agent may record:

• the property or project you are interested in;
• where the enquiry stands, and a follow-up date;
• viewing appointments and whether they took place;
• short notes;
• if you proceed: booking details (unit, price, dates);
• the progress of loan applications with the banks you choose;
• who else is involved, such as a co-broking agent or someone acting on your behalf.

3.5 Agents using Ketchup

For agents and agencies who use Ketchup, we hold:

• name, sign-in email address, phone number and agency name;
• the details of the WhatsApp Business account and number they connect, which Ketchup needs to receive that number's message metadata;
• their working hours and reminder settings;
• records of when Ketchup last synced their messages.

What we do not collect

• Ketchup does not use advertising cookies, analytics or tracking tools.
• We do not buy personal data or combine your data with data from data brokers.
• Ketchup does not ask for, or knowingly store, identity card numbers, bank account details or other sensitive personal data.

4. How message content is handled

To keep its records up to date, Ketchup processes new WhatsApp messages. The message text is only ever held in memory, for the few seconds that processing takes. It is used for three narrow checks, and then discarded:

• Advert details: reading the details WhatsApp attaches to a message sent from a click-to-WhatsApp advert (see 3.3).
• Listing reference: recognising a property portal listing reference in a first message (see 3.3).
• Agent markers: spotting short codes that the agent types in their own outgoing messages, for example _Appointment_ when confirming a viewing.
  • What is kept is only the type of event, a date or time, and the message ID.
  • A detected event is never acted on until the agent confirms it in Ketchup.
  • Your own messages are not scanned for markers.

Message text is never written to Ketchup's database, its logs or its backups.

5. Why the data is used

Ketchup uses this data only to help the agent you contacted:

• respond to your enquiry and help you buy, sell or rent a property, including arranging viewings, bookings, loan applications and handover;
• notice when you are waiting for a reply, or when a follow-up is due, so no enquiry is forgotten;
• understand which of their adverts and listings generate enquiries;
• track their commissions and meet their legal, tax and regulatory obligations.

For CarrotProperty's own customers, we process your data with your consent, given when you contact us. Where it is necessary, we also rely on it being needed to take steps you ask for before entering into a transaction, or to perform one (PDPA section 6(2)).

For another agent's customers, that agent is responsible for having a lawful basis. We process the data only on their instructions.

Ketchup does not send WhatsApp messages on its own. Every message you receive is written and sent by an agent, and Ketchup is not used to send automated marketing messages.

Ketchup does not make automated decisions about you that have legal or similarly significant effects. Its reminders are suggestions to the agent, who decides what to do.

6. Who we share it with

We do not sell, rent or trade personal data. We use these service providers to run Ketchup. Each processes data only on our instructions and for these purposes:

If you go ahead with a transaction, the agent may share the necessary details with parties involved in it, such as the developer, the owner or landlord, the banks you apply to, solicitors, or a co-broking agent. That is the agent's decision, made outside Ketchup, and those parties should only receive what that step of your transaction needs.

We may also disclose data where required by law or by a court or regulator.

7. Transfers outside Malaysia

Ketchup's database is hosted in Singapore, and some providers above operate globally. Where personal data is transferred outside Malaysia, we do so in accordance with section 129 of the PDPA. We choose providers that protect personal data to a standard comparable to the PDPA.

8. How we keep it secure

• Each agent sees only their own contacts, including agents at different agencies.
  • This is enforced inside the database itself, using row-level security on every table, not only by the app's screens.
  • A request from one agent's account cannot read or change another agent's records.
• Encryption and sign-in: data is encrypted in transit (HTTPS/TLS), and access requires an individual sign-in.
• Credentials: service passwords and access tokens, including those for an agent's connected WhatsApp account, are kept on the server and never sent to the browser.
• Backups: a weekly backup is kept on storage controlled by CarrotProperty and deleted after 8 weeks. Because messages are never stored, backups contain no message content.

If a personal data breach occurs that is likely to cause significant harm, we will notify the Personal Data Protection Commissioner and, where required, the people affected, as the PDPA requires. If the breach affects another agent's data, we will also notify that agent without delay.

9. How long it is kept

CarrotProperty's own enquiries

• Enquiry records: kept while the enquiry is active and for up to 2 years after the last contact, so we can recognise a returning enquiry and its history.
• Completed transactions: records of bookings, sales, tenancies and commissions are kept for up to 7 years, to meet tax and accounting obligations.

When the period ends, the data is deleted or anonymised.

Other agents' data

• Kept for as long as that agent uses Ketchup, and deleted when they instruct us to delete it.
• When an agent closes their account, their data is deleted within 30 days. Copies in backups expire within the following 8 weeks.
• Agent account details are kept while the account is active.

10. Your rights

Under the PDPA you may:

• ask whether your personal data is held, and request a copy of it;
• ask for data that is inaccurate, incomplete or out of date to be corrected;
• withdraw your consent, or ask for processing to stop or be limited, including for direct marketing;
• ask for your data to be transmitted to another data controller, where technically feasible;
• ask for your data to be deleted, unless it must be kept to meet a legal obligation, for example records of a completed transaction.

If you contacted CarrotProperty, contact us using the details in section 15. We will respond within 21 days, and there is no charge.

If you contacted another agent, they control your data, so please ask them first. If you contact us instead, we will pass your request to that agent and help them respond.

If you withdraw consent while an enquiry or transaction is in progress, the agent may be unable to continue helping you with it.

11. Deleting your data

To have your data deleted from Ketchup, email ask@carrotproperty.com or call or WhatsApp +60 16-339 3168. Tell us:

• the WhatsApp number you used;
• which agent or agency you contacted.

What happens next:

• CarrotProperty's own customers: we delete your records and confirm once it is done.
• Another agent's customers: we forward your request to that agent the same working day. We carry out the deletion on their instruction, or on our own if the law requires it, and tell you the outcome.
• Agents: agents can ask us the same way to delete their account and all of their data.

You can also block or delete the chat in WhatsApp at any time. This stops further messages reaching the agent, but it does not delete records already held, so please contact us if you want those deleted too.

12. Data from Meta

We use data received through Meta's WhatsApp Business Platform only to provide Ketchup as described in this policy. We do not sell it, use it for advertising profiles, or share it except as described in section 6. We comply with Meta's Platform Terms.

When an agent connects their WhatsApp Business account to Ketchup:

• Ketchup accesses it only through the permissions that agent grants, and only to provide Ketchup to that agent;
• the agent can remove Ketchup's access at any time from their Meta Business settings.

13. Children

Ketchup is for adults involved in property transactions. We do not knowingly collect personal data from anyone under 18.

14. Changes to this policy

If we change how we handle personal data, we will update this page and the “last updated” date above. We will tell agents using Ketchup about any material change before it takes effect.

15. Contact us

For any question, request or complaint about personal data, contact our Data Protection Officer:

CarrotProperty Sdn Bhd (202201011541) — Data Protection Officer
Email: ask@carrotproperty.com
Phone / WhatsApp: +60 16-339 3168

If you are not satisfied with our response, you may complain to the Personal Data Protection Department (Jabatan Perlindungan Data Peribadi), Malaysia.