Privacy Policy

Scope — agents only. This Policy covers proplisting.my, our SaaS for registered agents. The public calculators on this site (including /dsr) are covered by this Policy; the former dsrcalculator.com.my now redirects here.

This Policy explains how we collect, use, disclose, transfer, and protect personal data on proplisting.my, in accordance with the Personal Data Protection Act 2010 of Malaysia, as amended (including by the Personal Data Protection (Amendment) Act 2024) ("PDPA").

1. Who we are (data user) and how to contact us

The data user is the operator of proplisting.my, based in Malaysia.

Privacy contact: private@proplisting.my

2. Whose data, and what we collect

This Platform involves two kinds of personal data, with different responsibilities:

2.1 Your data, as an agent (we are the data user)

Identity & professional details: name, BOVAEP registration number (REN / REA / PEA), firm/agency name, email, phone, and the REN/credential licence image you upload for verification.
Account & authentication data: login identifiers and session data (authentication via our auth provider — see clause 8).
Technical & audit data: IP address and date/time stamps of significant actions, kept for security and abuse investigation.
Property Reel activity data: the videos and comments you post, together with moderation and safety records — including reports you make and reports made about you.
The content of your own public page: your photograph, gallery images, specialities, areas, and anything else you choose to put on it. 🔴 That page is public — see clause 2.5.

2.2 Customer/lead data that you input (you are responsible — see clause 10)

When you use a calculator with a customer, or when an enquiry reaches your message box — from one of your listings, from your own page, from the marketplace, or distributed to you from the platform pool — the Platform holds personal data about those customers — for example a customer's nickname/name, contact number, the state/area, and the financial inputs used for a DSR calculation, plus the calculation results. We process this data on the Platform so we can provide the service to you, but as between you and us, you are the responsible party for that customer data (you collect it and decide how it is used). See clause 10.

2.3 Data minimisation

We collect only what we need. The REN / credential image you upload for verification may contain your IC (NRIC) number; where it does, we use it only to verify your registration and for no other purpose.
We generally do not seek to collect sensitive personal data (health, political opinions, religious beliefs, commission of offences, or biometric data). Please do not submit it unless we specifically request it.

2.4 Members of the public who contact an agent through us

If you are not an agent and you submit an enquiry, we collect the name and phone number you type, the area you are interested in where asked, and your BOVAEP registration number if you tell us you are an agent. We also record the date and time, and the version of this Policy and the Terms in force when you submitted.

For this data we are the data user. We collect it for one purpose: to pass it to the agent who posted that listing.

2.5 Your own page is public

The page you build on the Platform is open to anyone, with no account and no login. Search engines can index it, and the photograph, gallery, and details you put there can be found, viewed, saved, and copied by anyone — including people you did not intend to reach.

Put on it only what you are content to publish. You can take the page offline at any time; that stops us serving it, but it does not remove copies already made by search engines or visitors.

2.6 Property Reel videos

A video you post may show people, their voices, and the inside of someone's home. Before you post, you are responsible for having their permission — see clause 15 of the Terms of Use. We hold and display the video as posted.

3. How we use personal data, and our legal basis

We use personal data to: provide the service (run the agent tools, create accounts, authenticate); attribute and route leads (link an enquiry to the correct agent, or place an unattributed enquiry in the platform pool); operate the co-broke feature (record the Contact Terms, the agreed split, the no-bypass commitment, and the signing identity/time stamp/IP as evidence in a dispute); communicate with you (service messages, notifications, and — with consent where required — updates); secure the Platform (fraud/abuse prevention, audit logging, access control); operate and moderate the Community (display your posts, comments, and follows to other agents, screen content automatically for prohibited details such as contact numbers and links, handle reports, and where necessary restrict a user's community access); and comply with law and enforce our Terms of Use.

Our legal bases under the PDPA include your consent, performance of our contract with you, and compliance with legal obligations.

4. Who we share personal data with

The attributed agent. A customer lead is made available to the agent it is attributed to, or held in the platform pool for assignment. Once attributed, a lead is isolated to that agent — one agent cannot access another agent's leads.
Co-broke counterparties. When you connect with another agent over a listing, we pass each of you the other's name, firm, and contact details so you can work together, and we keep a record that the connection was made.
Other agents (Community). Content you post to the Community — your name, profile photo, posts, and comments — is visible to other signed-in agents. When you report content, your report and your identity are provided to our moderation administrators.
Service providers / data processors acting on our instructions (hosting, database, authentication, and — when implemented — payment, messaging/notification).
Authorities, where required by law, regulation, or valid legal process.

4.1 The agent who posted the listing

When you submit an enquiry, we disclose your name and contact number to that agent, and to no one else.

Once it reaches that agent, they become the data user for that copy. How they store it, how long they keep it, and how they contact you are matters between you and them. If you want them to stop contacting you or to delete your details, contact them directly; you may also contact us and we will pass the request on, but we cannot compel them.

We do not sell personal data.

5. Where your data is stored and processed — cross-border transfer

We use third-party cloud hosting and infrastructure providers to run the Platform, and some of them are located outside Malaysia. Your personal data may therefore be transferred to and processed outside Malaysia.

By using the Platform and providing your data, you consent to this cross-border transfer and processing. We rely, as applicable, on your consent, the transfer being necessary to perform our contract with you, and appropriate safeguards / contractual protections with our processors, and we assess transfers against the PDPA cross-border standard (2024 amendment + 2025 cross-border transfer guidelines).

6. How long we keep data (retention)

We keep personal data only as long as necessary for the purposes above, or as required by law.

Leads (the customer details and DSR calculation data within them) are kept for as long as needed to provide the service and for you to follow up, and are deleted or anonymised when no longer needed.
Other data is retained for the life of your account plus a reasonable period, then deleted or anonymised.

6.1 Enquiries from members of the public

We keep an enquiry record — name, contact number, the listing it relates to, and the consent record — for as long as the receiving agent's account remains active, and for up to twelve (12) months after that account closes, so we can answer questions about who received your details and when. We then delete or anonymise it.

The copy held by the agent is not covered by this period.

7. Your rights

Under the PDPA you have the right to access the personal data we hold about you and to request correction of inaccurate, incomplete, misleading, or out-of-date data. You may also withdraw consent to certain processing (which may mean we can no longer provide parts of the service) and ask us to stop processing for direct marketing. To exercise any right, contact private@proplisting.my. We will respond within the period required by the PDPA and may need to verify your identity first.

8. Security

We take reasonable technical and organisational measures, including access control and isolation (so one agent's leads/records are not accessible to others), authentication via our auth provider, encryption in transit, audit logging, and restricting access to authorised personnel. No system is perfectly secure, and transmission of information over the internet is never completely secure — any transmission is at your own risk — but we work to protect your data and to meet the PDPA Security Principle.

9. Personal data breach notification

If a personal data breach occurs, we will assess it and, in line with the PDPA (section 12B) and the 2025 breach-notification guidelines: notify the Personal Data Protection Commissioner within 72 hours where required; and, where the breach is likely to cause significant harm, notify affected individuals (broadly within 7 days, as required by the guidelines).

10. Customer data you handle — your responsibility and consent

A core part of using the Platform is that you handle your own customers' personal data. In respect of that data:

You are the responsible party. As between you and us, you are responsible for the customer/lead personal data you collect, input, or handle through the Platform, and for handling it lawfully.
Consent for customers' data. If you input or share the personal data of a customer or any other person, you represent and warrant that you have obtained that person's consent for their personal data to be collected, used, and disclosed for the relevant purposes. Where you create a lead on a customer's behalf, you are responsible for having obtained the customer's consent; the Platform records that you confirmed consent.
No leakage or misuse. You must not disclose, sell, or pass a customer's contact details or data to any third party or other agent outside the Platform's intended mechanisms (see Terms of Use clause 6). Any such disclosure or misuse is your responsibility, not ours.

Your own consent — including to the cross-border processing in clause 5 — is obtained at the point of collection (for example when you register, or when you turn co-broking on for a listing). You may withdraw consent as described in clause 7.

10.1 Which data this clause covers

Clause 10 applies to customer data you as an agent bring into the Platform — leads you enter yourself, contacts you upload, details you type into a calculation.

It does not apply to enquiries submitted directly to us by a member of the public: for those, we are the data user at the point of collection, and you become the data user for your copy when we pass it to you. You must still handle that copy lawfully and only for the purpose it was given.

11. Cookies and similar technologies

We use cookies and similar technologies for two things, and nothing else. We do not use advertising cookies, and we do not sell or share cookie data with advertising networks.

Essential. Keeping you logged in and maintaining your session. Without these the Platform does not work.

One first-party analytics cookie — dsr_sid.


What it holds	A random identifier. No name, phone number, email, or anything else that identifies you.
What it is for	Linking the calculations made in one visit to an enquiry submitted in that same visit, so that an enquiry arrives with the figures it relates to instead of on its own.
How long	Up to one year.
Who can read it	Only us. It is a first-party cookie and is not shared with any third party.
Refusing it	Block or delete cookies for this site in your browser. Calculators and enquiry forms still work; the enquiry simply arrives without the calculation attached.

You can control cookies through your browser settings at any time.

12. Children

The Platform is for registered professionals and is not directed to children. We do not knowingly collect children's data.

13. Changes to this Policy

We may update this Policy from time to time, posting the updated version with a new "Last updated" date and, for material changes, giving reasonable notice.

14. Contact

Questions, requests, or complaints about your personal data: private@proplisting.my — proplisting.my, Malaysia.