PDPA & Your Rights
Version: 2026-10-19-draft.2 · Prepared: 2026-10-19 · Effective date: Awaiting confirmation
Platform and responsible parties
- Data controller / contracting organisation
- Parti Tindakan Demokratik (Democratic Action Party, DAP)
- Responsible service centre
- Pusat Komuniti Harapan Yong Peng
- Service centre postal address
- 4, Jalan Kota 6, Taman Kota, 83700 Yong Peng, Johor Darul Ta'zim
- Developer / technical service provider
- Tootaio Studio
- Privacy telephone
- +60177667959
- Primary hosting and backups
- Malaysia
- Minimum user age
- 18
Registration and contact details
- Platform
- Harapan Kita
- Provisional website
- https://dapyp.tootaio.com
- Developer location
- Yong Peng, Johor, Malaysia
- Developer registration number
- Awaiting confirmation
- Privacy contact / DPO
- Awaiting confirmation
- Privacy email
- Awaiting confirmation
1. Malaysian PDPA framework
This notice explains how to exercise personal-data choices for Harapan Kita. It supplements the Privacy Policy and is available in Bahasa Malaysia, English and Chinese. The Personal Data Protection Act 2010 (Act 709), as amended, applies within its legal scope; whether a particular party or activity is covered must be assessed, including the commercial-transaction requirement. Do not assume that a political organisation is a government department or automatically exempt. The seven principles concern lawful general processing, notice and choice, disclosure, security, retention, integrity and access. Publishing this notice is only one part of compliance.
2. Access and correction
You may ask whether personal data about you is held, request access to eligible records and ask for inaccurate, incomplete, misleading or outdated information to be corrected. Identify the service, intake point and approximate dates so records can be found. Staff may need to protect other people’s identities, privileged material or information subject to statutory exceptions. A refusal or partial response must explain the applicable reason rather than simply cite internal policy. Where required and practicable, corrections should be communicated to relevant recipients.
3. Withdrawal, objection and direct marketing
You may withdraw consent by written notice and state which activity must stop. You may also ask to stop direct marketing and, under the statutory conditions, processing likely to cause unwarranted substantial damage or distress. Service updates concerning an existing request must be distinguished from optional political promotion or fundraising. Withdrawal may prevent a service that genuinely needs the data; it must not be treated as withdrawal of all unrelated services. Previous lawful processing is not retrospectively undone, and independently required legal records may remain. Explain any continuing basis, category and retention need.
4. Portability, deletion and human assistance
Where section 43A applies, you may request direct transmission of eligible personal data to another controller, subject to technical feasibility and compatibility and applicable requirements. Identify the receiving controller and a safe destination; do not request an export to a public link. You may ask for deletion, anonymisation or a retention review when data is no longer needed, acknowledging lawful exceptions and backup limitations. Ask a person to review AI-generated guidance or a disputed case decision. These procedures are not a promise of an unconditional erasure right or automated approval of every request.
5. How to submit a request
Use the WhatsApp privacy number listed on this page. Start with: “Harapan Kita privacy request”, your preferred reply channel, the intake point, the type of request and relevant reference/date. Do not send a full IC image, password or another person’s file in the first message. The contact should confirm a proportionate verification method and safe means of returning information. WhatsApp is operated by Meta and is not an anonymous channel. Ask the intake point for an alternative written or in-person channel if the request is sensitive. A representative must show their authority without collecting excessive identity documents.
6. Timing, fees and outcomes
Where the statutory access and correction provisions apply, their usual response period is 21 days, with a further 14 days only under the applicable conditions, including written explanation and partial compliance where required. Other requests follow their own statutory rules; these periods are not a universal deadline for every right. Any prescribed fee must be explained before it is charged; do not invent an administrative fee or use excessive verification to obstruct a request. Record receipt, identity checks, decision, delivery and any extension or refusal. The rights process is handled by the responsible organisation, not by publishing the request on a community page.
7. Escalation and breach concerns
If the response is inadequate, request review by the responsible controller through the privacy contact. You may also raise a personal-data complaint with Malaysia’s Personal Data Protection Commissioner through the official JPDP website, subject to its jurisdiction; using internal review is not a waiver of that right. For a suspected exposure, provide the relevant page/reference, approximate time and a brief description, avoiding further circulation of exposed records. The controller must assess notification duties and coordinate with technical providers. No appointed DPO or regulator registration is claimed until verified.