Sabah Business Hub · First Step Creatives
Privacy Policy
Dasar Privasi
Last updated / Kemaskini terakhir: 20 August 2026
1. Who we are1. Siapa kami
Sabah Business Hub is operated by First Step Creatives (SSM Registration No. 003519412-V). For any enquiries regarding your personal data, contact us at support@firststepcreatives.com.
Sabah Business Hub dikendalikan oleh First Step Creatives (No. Pendaftaran SSM 003519412-V). Untuk sebarang pertanyaan mengenai data peribadi anda, hubungi kami di support@firststepcreatives.com.
2. What personal data we collect and its source2. Data peribadi yang kami kumpul dan sumbernya
We collect the following categories of personal data:
| Category | Data collected | Source | Required? |
|---|---|---|---|
| Account | Email address, full name, phone number, preferred language, account type | Directly from you | Email: required. Others: optional |
| Business listing | Business name, address, category, description, phone, hours, photos | OpenStreetMap (seeded listings); directly from you (claimed listings) | Required for listing |
| Verification documents | SSM registration certificate, utility bill | Directly from you | Required for Verified status |
| Payment | Payment card details, billing information | Stripe (payment processor) | Required for paid subscriptions |
| Usage | Pages viewed, features used, IP address, device type, browser | Automatically via analytics | Automatic (opt-out available) |
Kami mengumpul kategori data peribadi berikut: data akaun (emel, nama, telefon, bahasa pilihan, jenis akaun), data penyenaraian perniagaan, dokumen pengesahan (sijil SSM, bil utiliti), data pembayaran (melalui Stripe), dan data penggunaan (halaman dilawati, ciri digunakan, alamat IP, jenis peranti). Sila rujuk jadual di atas untuk butiran penuh.
We do not collect copies of your identity card (IC), passport, or any government-issued personal identification document.
Kami tidak mengumpul salinan kad pengenalan (IC), pasport, atau sebarang dokumen pengenalan diri yang dikeluarkan kerajaan.
3. Why we collect your data3. Mengapa kami mengumpul data anda
We process your personal data for the following purposes:
- Providing the directory service — displaying business listings, enabling search, and connecting users with businesses in Sabah.
- Account management — creating and managing your account, authenticating your identity via magic-link sign-in.
- Business verification — reviewing your submitted documents to verify your association with a listed business before awarding the Verified badge.
- Payment processing — processing Verified Badge subscription payments through Stripe. We do not store your full payment card details on our servers.
- Analytics and improvement — understanding how the platform is used so we can improve it, and providing business owners with aggregated visitor statistics for their listings.
- Service communications — sending you important notices about your account, verification status, subscription, or changes to our terms.
We will not use your personal data for purposes other than those listed above without your prior consent.
Kami memproses data peribadi anda untuk tujuan berikut: menyediakan perkhidmatan direktori, pengurusan akaun, pengesahan perniagaan, pemprosesan pembayaran melalui Stripe, analitik dan penambahbaikan, dan komunikasi perkhidmatan. Kami tidak akan menggunakan data peribadi anda untuk tujuan lain tanpa persetujuan anda terlebih dahulu.
4. Who we share your data with4. Dengan siapa kami berkongsi data anda
We share your personal data with the following categories of third-party service providers, solely to operate the platform:
| Provider | Purpose | Data location |
|---|---|---|
| Supabase | Database hosting, file storage, authentication | Singapore |
| Vercel | Website hosting and delivery | Global (edge network) |
| Stripe | Payment processing | United States |
| PostHog | Analytics | European Union |
We do not sell, rent, or trade your personal data to any third party. We do not share your verification documents with anyone other than our internal verification team.
Kami berkongsi data peribadi anda dengan penyedia perkhidmatan pihak ketiga berikut semata-mata untuk mengendalikan platform: Supabase (pangkalan data, Singapura), Vercel (pengehosan laman web, global), Stripe (pembayaran, Amerika Syarikat), dan PostHog (analitik, Kesatuan Eropah). Kami tidak menjual, menyewa, atau memperdagangkan data peribadi anda kepada mana-mana pihak ketiga.
5. Cross-border data transfer5. Pemindahan data merentas sempadan
Your personal data is stored on servers located in Singapore (Supabase) and may be processed in the European Union (PostHog) and United States (Stripe, Vercel).
By using Sabah Business Hub and providing your personal data, you consent to the transfer of your personal data to these locations under Section 129(3) of the Personal Data Protection Act 2010 (as amended). Each of these service providers maintains data protection standards that are at least equivalent to the protection afforded under the PDPA.
Data peribadi anda disimpan di pelayan yang terletak di Singapura (Supabase) dan mungkin diproses di Kesatuan Eropah (PostHog) dan Amerika Syarikat (Stripe, Vercel). Dengan menggunakan Sabah Business Hub dan memberikan data peribadi anda, anda bersetuju dengan pemindahan data peribadi anda ke lokasi-lokasi ini di bawah Seksyen 129(3) Akta Perlindungan Data Peribadi 2010 (seperti yang dipinda).
6. How long we keep your data6. Berapa lama kami menyimpan data anda
| Data type | Retention period |
|---|---|
| Account data | While your account is active, plus 12 months after deletion |
| Business listing data | While the listing is active on the platform |
| Verification documents | Up to 2 years after verification approval, then permanently deleted |
| Rejected verification documents | Deleted within 30 days of rejection |
| Payment records | Retained by Stripe per their retention policy; we store only transaction references |
| Analytics / usage data | Anonymised after 24 months |
When data is no longer needed for the purpose it was collected, we delete or anonymise it. We do not retain personal data indefinitely.
Apabila data tidak lagi diperlukan untuk tujuan ia dikumpulkan, kami akan memadamkan atau menjadikannya tanpa nama. Dokumen pengesahan yang diluluskan dipadamkan secara kekal selepas 2 tahun. Dokumen yang ditolak dipadamkan dalam masa 30 hari. Kami tidak menyimpan data peribadi selama-lamanya.
7. Your rights7. Hak anda
Under the Personal Data Protection Act 2010 (as amended), you have the following rights:
- Right of access — You may request a copy of the personal data we hold about you.
- Right of correction — You may request that we correct any inaccurate or incomplete personal data.
- Right to withdraw consent — You may withdraw your consent to our processing of your personal data at any time. If you withdraw consent for verification document processing, your Verified badge will be revoked. If you withdraw consent for analytics, we will stop collecting usage data from your sessions.
- Right to complain — You may lodge a complaint with the Personal Data Protection Commissioner of Malaysia if you believe your data has been mishandled.
To exercise any of these rights, email us at support@firststepcreatives.com. We will respond within 21 days of receiving your request.
Personal Data Protection Commissioner / Pesuruhjaya Perlindungan Data Peribadi: www.pdp.gov.my
Di bawah Akta Perlindungan Data Peribadi 2010 (seperti yang dipinda), anda mempunyai hak berikut: hak akses, hak pembetulan, hak menarik balik persetujuan, dan hak untuk membuat aduan kepada Pesuruhjaya Perlindungan Data Peribadi Malaysia. Untuk melaksanakan mana-mana hak ini, emelkan kami di support@firststepcreatives.com. Kami akan membalas dalam masa 21 hari dari penerimaan permintaan anda.
8. How we protect your data8. Bagaimana kami melindungi data anda
We implement appropriate technical and organisational measures to protect your personal data, including:
- All data transmitted between your browser and our servers is encrypted using HTTPS/TLS.
- Data stored in our database is encrypted at rest.
- Verification documents are stored in private, access-controlled storage — accessible only to you and our verification team.
- Database access is controlled through row-level security policies that prevent unauthorised access to other users' data.
- We do not store your full payment card details — these are handled entirely by Stripe, a PCI DSS-compliant payment processor.
Kami melaksanakan langkah teknikal dan organisasi yang sesuai untuk melindungi data peribadi anda, termasuk penyulitan HTTPS/TLS, penyulitan data semasa rehat, kawalan akses peringkat baris dalam pangkalan data, dan penyimpanan dokumen pengesahan yang dikawal akses secara peribadi.
9. Data breach notification9. Pemberitahuan pelanggaran data
In the event of a personal data breach that is likely to cause you significant harm, we will notify you and the Personal Data Protection Commissioner as soon as practicable, in accordance with the Personal Data Protection Act 2010 (as amended).
Sekiranya berlaku pelanggaran data peribadi yang berkemungkinan menyebabkan kemudaratan besar kepada anda, kami akan memaklumkan anda dan Pesuruhjaya Perlindungan Data Peribadi secepat yang boleh dilaksanakan, selaras dengan Akta Perlindungan Data Peribadi 2010 (seperti yang dipinda).
10. AI-generated content10. Kandungan yang dijana oleh AI
Some business descriptions on Sabah Business Hub are generated by artificial intelligence based on publicly available data (including OpenStreetMap). These descriptions are clearly machine-generated drafts and may contain inaccuracies. Business owners can review, edit, or replace AI-generated content after claiming their listing.
Sesetengah penerangan perniagaan di Sabah Business Hub dijana oleh kecerdasan buatan berdasarkan data yang tersedia secara umum. Penerangan ini adalah draf yang dijana mesin dan mungkin mengandungi ketidaktepatan. Pemilik perniagaan boleh menyemak, mengedit, atau menggantikan kandungan yang dijana AI selepas menuntut penyenaraian mereka.
11. Cookies and analytics11. Kuki dan analitik
We use the following cookies and tracking technologies:
- Essential cookies — Required for authentication (keeping you signed in). These cannot be declined as they are necessary for the service to function.
- Analytics cookies — Used by PostHog to understand how the platform is used. You may opt out of analytics tracking at any time using the cookie banner or by contacting us.
We do not use advertising cookies or tracking pixels from third-party advertising networks.
Kami menggunakan kuki penting (untuk pengesahan) dan kuki analitik (PostHog, untuk memahami penggunaan platform). Anda boleh menolak kuki analitik pada bila-bila masa. Kami tidak menggunakan kuki pengiklanan.
12. Children's data12. Data kanak-kanak
Sabah Business Hub is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a minor, please contact us and we will delete it promptly.
Sabah Business Hub tidak bertujuan untuk digunakan oleh individu di bawah umur 18 tahun. Kami tidak mengumpul data peribadi daripada kanak-kanak secara sedar.
13. Changes to this policy13. Perubahan kepada dasar ini
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we make material changes, we will notify you by email (to the address associated with your account) and by posting a notice on the platform at least 14 days before the changes take effect. The “Last updated” date at the top of this page will be revised accordingly.
Kami mungkin mengemaskini Dasar Privasi ini dari semasa ke semasa. Apabila kami membuat perubahan penting, kami akan memaklumkan anda melalui emel dan dengan memaparkan notis di platform sekurang-kurangnya 14 hari sebelum perubahan berkuat kuasa.
14. Governing law14. Undang-undang yang mentadbir
This Privacy Policy is governed by the laws of Malaysia, including the Personal Data Protection Act 2010 (Act 709) as amended by the Personal Data Protection (Amendment) Act 2024.
Dasar Privasi ini ditadbir oleh undang-undang Malaysia, termasuk Akta Perlindungan Data Peribadi 2010 (Akta 709) seperti yang dipinda oleh Akta Perlindungan Data Peribadi (Pindaan) 2024.