Privacy Notice

KEY COLIVING PLT (LLP Registration No. LLP0045277-LGN; Company Registration No. 202604000066)

Effective date: 5 October 2026. Last reviewed: 5 October 2026.

This notice tells you what personal data we collect, why we use it, who we share it with, how long we keep it and what your rights are under the Personal Data Protection Act 2010, as amended by the Personal Data Protection (Amendment) Act 2024 (the "Act").

It applies when you visit our website, contact us by WhatsApp, phone or email, view a room, apply for a room, fill in our onboarding form, sign a tenancy agreement, live in one of our rooms, or use the tenant portal at tenant.keycoliving.com.

This notice is in English. If a translation differs, the English version prevails.

1. Who we are and how to contact us

Key Coliving PLT ("we", "us", "our") is a limited liability partnership registered in Malaysia. We rent out furnished rooms in shared condominiums and one terrace house in Bandar Sungai Long and Kajang, Bangsar South, Bukit Jalil, Cheras, Seri Kembangan and Kuala Lumpur city. We decide how and why your personal data is used, so we are the data controller.

For any question, request or complaint about your personal data, please contact:

• Contact person: Partner in charge of personal data protection, Key Coliving PLT
• Address: [registered address: to be added]
• WhatsApp / phone: +60 11-1645 3186
• Email: admin@keycoliving.com (please write "Personal Data" in the subject line)

2. Personal data we collect

What we collect depends on how you deal with us.

2.1 Website visitors

• Technical data that your browser sends: IP address, device and browser type, pages visited, and the date and time of your visit. This is kept in our hosting provider's server logs.
• Cookies that are strictly needed for the website and the tenant portal to work. See section 12.

2.2 People who enquire or view a room

• Your name, WhatsApp or phone number, and email if you use it.
• Your messages, including the building and room you are interested in, move-in month, length of stay, budget, number of occupants, and your school or workplace.
• Viewing appointments.

2.3 Applicants and tenants

• Identity: full name, MyKad or passport number, photos of the front and back of your MyKad or passport, immigration pass details (for non-Malaysians), date of birth, gender and nationality.
• Contact: phone number, email, permanent address, and your emergency contact's name, relationship and phone number.
• Background: your school or employer.
• Tenancy: room, term, rent, the house rules you accept, the signed tenancy agreement, your electronic signature, and stamp duty records.
• Payments: deposits, rent, air-conditioner electricity, parking and other charges; payment dates and references; transfer slips you send us; FPX/Billplz transaction details for rent paid online; the name of the person who paid; and the bank account details you give us for refunds. We never receive your online banking password, OTP or card number.
• Electricity: meter readings and meter photos, and your room's electricity usage recorded by smart meters, which we use to bill air-conditioner electricity.
• Access and parking: access card numbers, your room door passcode, and your vehicle number and parking bay if you rent parking.
• CCTV: recordings from cameras in the common areas of some units. We never place cameras in bedrooms or bathrooms.
• Maintenance and move-out: repair reports and the photos or videos you send; move-in and move-out inspection photos and videos; your move-out confirmation.
• Communications: WhatsApp messages, emails and portal messages between you and us.
• Tenant portal: your login details (your phone number, and either the last 4 digits of your MyKad or passport number or the PIN you set) and login records such as time, device and IP address.

2.4 Sensitive personal data

The Act gives extra protection to sensitive personal data. We may process the following:

• Religious belief: the MyKad of a Muslim holder shows the word "ISLAM", so a photo of a MyKad may reveal religion. We do not use this information for any purpose.
• Health: only if you choose to tell us, for example about a medical condition for emergencies or a special need in your room.
• Offences: any declaration about criminal offences that the tenancy agreement asks you to make.

We process sensitive personal data only with your explicit consent, which we ask for separately in the onboarding form, or where the Act otherwise allows it. We do not collect biometric data such as fingerprints or face scans.

2.5 Persons under 18

Our rooms are meant for adults. If an applicant is under 18, we process their personal data only with the consent of a parent or legal guardian, as the tenancy agreement requires.

2.6 Data about other people

If you give us personal data about someone else, such as your emergency contact, a parent who pays your rent, or a co-tenant, please show them this notice and make sure they agree before you give us their details.

3. Where we get your personal data

• From you: through WhatsApp, phone, email, our website, the onboarding form, the tenant portal and in person.
• From other people: a person who referred you, a property agent, your parent, guardian or employer, a person who pays on your behalf, and your housemates (for example when they report a problem).
• From building management (the JMB or management corporation), for example access card and visitor records.
• From our equipment: smart electricity meters and CCTV cameras.
• From our payment gateway, Billplz, and from banks, when they confirm a payment.

4. Why we use your personal data

• To reply to your enquiries, send room details and arrange viewings.
• To check your identity and assess your application.
• To hold a room for you once your first deposit payment reaches us, and to send you the onboarding link.
• To prepare the tenancy agreement, have it e-signed, and have it stamped with the Inland Revenue Board (LHDN).
• To bill and collect rent, deposits, access card deposits, parking and air-conditioner electricity; to issue invoices, receipts and reminders; and to refund deposits.
• To issue access cards and door passcodes, and to register you with building management.
• To arrange repairs, cleaning and maintenance.
• To keep our units, tenants and property safe and secure, including through CCTV in common areas.
• To contact your emergency contact or the authorities in an emergency.
• To inspect the room at move-out and settle your deposit.
• To keep accounting and tax records, and for audits.
• To comply with the law and with requests from the police, the Immigration Department, LHDN, the Energy Commission, the courts and other authorities.
• To handle complaints and disputes and to protect our legal rights.
• To tell you about new rooms and offers, only if you agree (see section 14).

We use your personal data with your consent, or where it is needed to enter into or perform the tenancy agreement with you, to comply with the law, to protect your vital interests, or for legal claims, as the Act allows.

5. What you must give us, and what is optional

• To reply to an enquiry, we need your name and a phone or WhatsApp number. Other details are optional, but they help us suggest the right room.
• To issue a tenancy agreement, you must give your full name, MyKad or passport number and photos, date of birth, nationality, phone number, permanent address, an emergency contact and your signature. Non-Malaysians must also give immigration pass details. Without these, we cannot sign a tenancy agreement with you.
• To refund your deposit by bank transfer, you must give your bank account details.
• Health information is optional.
• Marketing is optional. Saying no does not affect your tenancy.

6. Who we share your personal data with

We share only the data each party needs, for the purposes in section 4.

6.1 Service providers that process data for us

• Supabase: database for tenancy, payment and portal records.
• Vercel: hosting of our website and tenant portal.
• Google (Google Drive and Gmail): storage of documents and records, and email.
• Billplz: FPX online payments.
• Meta (WhatsApp): messages with you.
• Telegram: internal notices to our team, which may show your name, room and address.
• Anthropic: automatic reading of the numbers on meter photos.
• Tuya: the platform that runs our smart electricity meters.

These providers may use the data only to provide their services to us.

6.2 Other parties

• Building management (JMB or management corporation): for access cards, registration and building rules.
• The owner of the unit: only where our lease with the owner requires it.
• Contractors and cleaners: only your name, room and phone number, to do a job.
• Your housemates in the same unit: your name and room, for example in the unit's group chat.
• The person who pays for you (such as a parent or employer): payment status and amounts.
• Your emergency contact: in an emergency.
• Our accountants, auditors, lawyers and other professional advisers.
• LHDN for stamp duty, and the police, the Immigration Department, the courts and other authorities when the law requires or allows it.
• A buyer or successor of our business, who must protect your data in the same way.

We do not sell your personal data. We do not rent it out or give it to others for their own marketing.

7. Transfers outside Malaysia

Some of our service providers store or process data outside Malaysia:

Billplz processes payments in Malaysia.

We transfer data abroad only where the Act allows it, mainly because the transfer is needed to perform our contract with you, or with your consent, which we ask for in the onboarding form. We also take reasonable steps so that your data is protected abroad to a standard similar to Malaysian law:

• we use established providers that publish their security standards and include data protection terms in their contracts;
• data is encrypted when it travels over the internet;
• we send each provider only the data it needs; for example, meter photos sent for reading should show only the meter;
• access to our accounts with these providers is limited to authorised team members.

8. How we protect your personal data

• Only authorised team members can see your data, and only the parts their role needs.
• MyKad and passport photos are kept in private storage that is not open to the public. They can be viewed only through links that expire after a short time.
• Our website and portal use encrypted connections (HTTPS).
• Admin accounts use strong passwords and two-factor authentication where the service offers it.
• We keep backups so that records are not lost.
• Our team and contractors must keep your data confidential.
• We choose service providers with good security, and we expect them to tell us promptly about any data breach.

What you can do: keep your portal login details private, and set your own PIN if you still log in with the last 4 digits of your MyKad or passport number. We will never ask for your online banking password or OTP. Pay deposits only by bank transfer to Key Coliving PLT's company account (Maybank); we never collect deposits through FPX. Pay rent only through the FPX link in your tenant portal or by bank transfer to the account named on your bill. If anyone asks you to pay into another account, check with us first.

9. How long we keep your personal data

We may keep data longer if the law requires it or if it is needed for a dispute or legal claim. When we no longer need data, we delete it from our systems, let backups expire or be overwritten, and shred paper copies.

10. Keeping your data accurate

Please keep your details up to date. You can update some details yourself in the tenant portal. For other details, such as your name or MyKad or passport number, contact us and we will update them after checking.

11. Your rights

• Access (section 30): ask for a copy of the personal data we hold about you. Many tenancy and payment records are also shown in your portal.
• Correction (section 34): ask us to correct data that is inaccurate, incomplete, misleading or out of date.
• Withdraw consent (section 38): withdraw your consent or ask us to limit how we use your data. If the data is needed for your tenancy, we may then be unable to continue the tenancy; we will explain the consequence before we act. Withdrawal does not affect records we must keep by law.
• Prevent processing likely to cause damage or distress (section 42).
• Stop direct marketing (section 43).
• Data portability (section 43A): ask us to send your data to you or to another data controller in electronic form, where this is technically feasible.

How to make a request: contact us by email or WhatsApp using the details in section 1. Access and portability requests must be in writing. We will check your identity before we act. We will reply within 21 days. If we need more time, we will tell you why and reply within a further 14 days, as the Act allows. If we refuse a request, we will tell you why.

Fees: for an access request, we may charge the fee allowed by the Personal Data Protection (Fees) Regulations 2013: up to RM10 with a copy or RM2 without a copy, or RM30 and RM5 for sensitive personal data. We do not charge for correction, withdrawal of consent or stopping marketing.

Complaints: if you are not satisfied with our reply, you may complain to the Personal Data Protection Department (Jabatan Perlindungan Data Peribadi, JPDP) at www.pdp.gov.my.

12. Cookies

Our website uses only cookies that are strictly needed, such as a session cookie that keeps you logged in to the tenant portal. These do not track you across other websites.

We do not use advertising, retargeting or social media tracking cookies or pixels. If a page shows an embedded Google Map or video, that provider may set its own cookies under its own privacy policy. If we start using analytics or other cookies, we will update this section and ask for your consent where needed.

13. Data breaches

If a personal data breach happens, we will act quickly to contain it. Where the breach causes or is likely to cause significant harm, we will notify the Personal Data Protection Commissioner within 72 hours, and tell the affected persons without unnecessary delay and no later than 7 days after notifying the Commissioner. We keep a record of all data breaches.

14. Marketing

We send marketing, such as news about new rooms and offers, only if you opt in, for example by ticking the marketing box in the onboarding form or telling us on WhatsApp. You can stop at any time by replying "STOP" or by telling us.

Messages about your tenancy, bills, renewal and building notices are not marketing. We will keep sending them during your tenancy.

15. How we ask for your consent

When you message us, we use your details to reply to you. In the onboarding form, we ask you to tick separate boxes, which are not ticked in advance, to give explicit consent for:

• the processing of sensitive personal data, such as your MyKad photo;
• the transfer of your data outside Malaysia, as described in section 7; and
• marketing (optional).

We record the date and time you tick each box.

16. Changes to this notice

We may update this notice from time to time. The effective date at the top shows the current version. We will tell tenants about important changes through the tenant portal or WhatsApp before the changes apply.