Privacy Policy

The True Malaysia ("TTM", "this website") is an independent information gateway about Malaysia. It is powered by Erawan, a product of Petrol Solution Co., Limited. Erawan is the underlying platform, not a separate registered company, and this website is not operated by, affiliated with, or endorsed by any Malaysian government body or authority.

Three facts that a privacy notice normally states are genuinely not settled yet, and this draft says so rather than inventing them:

• The data controller and contracting entity. Product ownership alone does not establish who controls the data or who you would be contracting with. That has to be decided and recorded by the owner.
• The registered address and the privacy contact channel. No postal address, privacy mailbox or data protection officer is published here, because none has been confirmed. Where this Policy needs to point somewhere, it points to the contact page.
• Where the website is hosted. This matters legally, not just technically: see Section 2.

It would be easy to assume that a website about Malaysia is governed by Malaysian data-protection law. That is not how the law decides the question.

Malaysia's Personal Data Protection Act 2010 (Act 709), as amended by the Personal Data Protection (Amendment) Act 2024, applies under section 2(2) to a person who is established in Malaysia and processes personal data in the context of that establishment, or to a person who is not established in Malaysia but uses equipment in Malaysia to process personal data other than for transit through Malaysia. Section 2(3) requires a person caught by the second limb to nominate a representative established in Malaysia.

• First limb — established in Malaysia: on the information recorded in this repository, the operating company is registered in Thailand, not Malaysia.
• Second limb — equipment in Malaysia: this turns on where the production server sits, and that decision has not been made.

So the honest position today is that the Act may or may not apply, and the answer depends on a hosting decision that has not been taken. If it does apply, two further consequences follow immediately: a representative established in Malaysia must be nominated, and section 7(3) requires this notice to be given in both the national language and English rather than in English alone.

Separately, because the operating company is Thailand-registered, Thailand's Personal Data Protection Act B.E. 2562 (2019) may also be engaged. Whether one, the other, or both frameworks govern this website is a question for qualified counsel in the relevant jurisdictions.

Four forms on this website send what you type to a server and store it. Everything else on the site is read-only browsing.

Each of those forms also carries a hidden field that a human never sees. If it is filled in, the submission is discarded as automated spam and nothing is stored. Submissions are rate limited.

The newsletter fields in the footer and on the Knowledge page store nothing and send nothing. They are not connected to anything yet, and they say so when you use them.

Asking the Malaysia Concierge a question sends nothing anywhere. It searches a list of this website's own pages inside your browser. Your question is not transmitted, not logged and not stored.

This website does not ask for, and does not knowingly collect, sensitive personal data — anything about health, religious or political beliefs, or the commission of an offence. Please do not put such information into a free-text message field.

Two items, both set by this website itself, and neither used to track you:

• Your cookie-preference record, kept in your browser's local storage so you are not asked again on every visit.
• Your trip-planner selections, kept only for the current browser session so a half-finished plan survives a page change.

A session cookie also exists, but only for administrators signing in to the private admin area. There is no public account system on this website, so an ordinary visitor never receives one. The full inventory, with the technology, purpose, duration and evidence path for each item, is on the Cookies Policy.

• To read and answer what you sent. That is the whole purpose of the four forms.
• To keep the website working and secure — validating input, discarding automated spam, and limiting the rate of submissions.
• To remember a preference you set, which is the only purpose of the storage described in Section 4.

Your data is not used for advertising, is not profiled, is not used for automated decision-making, and is not sold, rented or traded. No marketing is sent, because no marketing system exists.

No analytics provider, advertising network, tag manager, tracking pixel, CAPTCHA service, map, video embed or third-party chat widget is present on this website. The audit behind this Policy found none, and none is planned in this version.

The typefaces are downloaded once when the site is built and are then served from this website's own address, so your browser does not request anything from a font provider while you read.

The parties who can see a form submission are the people operating the website, the hosting provider that runs the server, and the database it is stored in. Who those providers are, and in which country they sit, follows from the hosting decision described in Section 2 and will be named here once it is made.

Because the hosting location has not been settled, this Policy cannot yet tell you which country your submission is stored in. That is unsatisfactory in a finished notice, and it is the reason this one is marked as a draft.

A transfer out of Malaysia, if Malaysian law applies, is governed by section 129 of Act 709 as amended. The appropriate basis will be identified and stated here once the hosting location is known.

There is no documented retention schedule for form submissions yet, and this Policy will not invent one. Stating “twelve months” or “three years” here would be a guess presented as a commitment.

What can be said honestly is the criterion: an enquiry is kept while it is being handled and while there is a genuine reason to keep it, and deleted when there is not. A schedule with actual periods is an owner decision recorded for legal review, and it will replace this paragraph.

Your cookie-preference record is re-asked after 365 days. That period is a choice made in building this website, not a legal requirement.

• Form input is validated on the server, not only in your browser.
• The administrator session cookie is httpOnly, so page scripts cannot read it, is marked secure in production, and is restricted with SameSite=Lax.
• Automated submissions are discarded and submission rates are limited.
• The private admin area is separated from the public website.

Which rights you have depends on which law applies — the open question in Section 2. If Malaysia's Act 709 governs this website, it provides a right of access to your personal data (section 30), a right to correct it (section 34), a right to withdraw consent to processing (section 38), a right to prevent processing likely to cause damage or distress (section 42), a right to prevent processing for direct marketing (section 43), and, since 1 June 2025, a right to data portability.

Whatever the legal position, you can ask through the contact page what was submitted under your name and ask for it to be corrected or removed, and that request will be honoured. You may be asked to confirm your identity first, so that someone else cannot obtain or delete your data by claiming to be you.

A dedicated privacy mailbox will be published here once one exists. Until then the contact page is the route.

This website is written for adults researching business, investment, travel and practical matters in Malaysia. It has no feature designed for children, asks for no age, and operates no account system.

No minimum age is stated here, because stating one would imply an age check that this website does not perform. If you believe a child has sent personal data through one of the forms, use the contact page and it will be removed.

This website links out frequently and deliberately — to Malaysian ministries, agencies, statutory authorities, chambers and associations — so that you can read a requirement at its source rather than take this website's word for it.

Those websites are not operated by this one and have their own privacy practices. Following a link means leaving this Policy behind.

This Policy carries a version and a revision date at the top. The revision date is when this draft was written. It is not an effective date: this document takes effect when the owner approves it, and that approval has not happened yet.

It will be rewritten when the open questions in Section 1 and Section 2 are answered, and whenever a form, a storage item or a third-party service is added or removed.

If something here is wrong, or you want to exercise a right described in Section 10, use the contact page. If Malaysian law is found to apply, a complaint may also be made to the Personal Data Protection Commissioner.