Privacy Policy

1. Scope and responsibility

This policy covers Harapan Kita’s public website and installed web app, resident services, intake-point case management and staff interfaces. Features depend on the selected intake point and enabled modules. The intended user organisation is Parti Tindakan Demokratik (Democratic Action Party, DAP). The responsible service centre and its postal address are identified above. Its authority to act for DAP must be documented before this draft takes effect.

The organisation deciding why and how resident information is used is the data controller. Tootaio Studio develops the platform and currently holds the actual data as temporary technical custodian. Custody alone does not determine controller status; processing instructions, administrator access, confidentiality, supplier obligations and handover or deletion must be documented. This draft does not establish national party endorsement or a completed controller–processor agreement.

2. Information processed

Depending on the service, records may include name, MyKad/IC or other identification, telephone, email, residential and complaint addresses, birth date or age, gender, nationality, ethnicity, religion, occupation, household members and emergency contacts. Case and welfare records may contain income, aid eligibility, goods or cash assistance, family circumstances, health or disability information, allegations, supporting documents, photographs and staff notes. Collect only information relevant to the particular request.

We also process consultation and WhatsApp messages, attachments, contact cards, profile images, message delivery/read information, poll responses, community topics and public posts. Staff records include account and role information, password hashes, sessions, activity/access logs, feedback and attributable screenshot watermarks. Technical records may include network addresses or derived anti-abuse hashes, user agent, timestamps, device/browser information and analytics events. Free text and files can contain personal data even where no dedicated field requests it.

3. Sources of information

Information comes from you through forms, consultations, calls, visits, WhatsApp and uploads; from authorised representatives, family members or case-referral organisations; and from staff recording service activity. Where enabled, a local MyKad reader supplies card details to the staff workflow. Linked WhatsApp accounts can import contacts, recent conversations, requested historical messages and media. Public electoral boundary data is used to help select an intake point; it is not proof of your voter registration or political preference. Representatives must have authority to disclose another person’s information and provide them with this notice where appropriate.

4. Purposes of processing

Identity and contact details support matching residents, reducing duplicate records, retrieving submissions and contacting you. Case content, location and attachments support assessing, assigning, referring, investigating and following up requests. Household and welfare details support assistance assessment and distribution records. Consultation history supports continuity and staff handover. Poll identifiers support eligibility and duplicate-vote controls. Staff accounts and logs support authorisation, service accountability, security and investigation. Aggregated service statistics support reporting; public statistics should not reveal identifiable case details.

5. Permission and sensitive information

Where the PDPA applies, processing must have consent or a specific permitted statutory basis and be necessary, proportionate and related to the stated purpose. Health, religious beliefs, political opinions, alleged offences and biometric data may require explicit consent or a statutory exception. An ordinary photograph or IC number is not automatically biometric identification, but remains personal data requiring protection. Do not upload unnecessary identity-card copies, financial credentials or medical records. Staff must obtain appropriate authority before recording sensitive information or sending it to an external recipient.

Reading this policy, visiting the site or saving browser preferences does not itself give consent to every use. A form’s specific consent relates to its stated service. Permission for optional political communications or fundraising must be separate and may be withdrawn without treating your service request as political endorsement. Where another lawful basis requires retention or disclosure, withdrawal does not automatically erase those obligations.

6. Required fields and choices

Required fields are indicated in the relevant form. Public complaint submission normally needs identity/contact details and a description; real-name polls and consultation retrieval may require IC and phone details. Without required information or necessary consent, the relevant online function may be unavailable. Staff can advise whether an alternative channel or anonymous case intake is suitable; anonymous intake does not support every welfare process. Browsing public information does not require a staff account. Optional location, browser notifications and analytics choices are independent of the merits of your request.

7. Access and permitted disclosures

Access is intended for authorised DAP service-centre personnel and technical administrators according to role, intake-point responsibility and operational need. Tootaio Studio may access data for hosting, support, troubleshooting and authorised administration. Being in the same party does not create unrestricted access to all resident files. Necessary case information may be referred to government departments, local authorities, utilities, responsible service providers or aid partners for the particular matter. The recipient may become independently responsible for its own handling; explain a material referral and obtain any required permission before sending sensitive information.

Disclosure may also be required by valid legal process, protection of lawful rights or an applicable emergency exception. It must remain limited to what is lawfully necessary. Service data must not be sold, supplied to unrelated political parties or reused for unrelated political campaigning, fundraising or commercial marketing under a general service consent. A new purpose requires a separate lawful assessment, notice and consent where required.

8. Public content and sharing

Community topics, Support Station posts/comments, published images, poll results, articles and service statistics can be public. A public post may show the chosen name or other displayed attribution and can be copied, indexed, photographed or shared by others. Do not publish IC numbers, phone numbers, private addresses, children’s details, health records or other people’s personal data. Case files and private consultations are not intended as public posts. Public poll totals do not mean individual ballot records are irreversibly anonymous. Ask staff to remove harmful personal information; removal from this platform cannot guarantee removal of outside copies.

9. Technical services and external links

The source code identifies these integrations: Cloudflare tunnel/CDN-related delivery; WhatsApp/Meta messaging and group invitations through a linked account and Baileys bridge; self-hosted Umami at umami.tootaio.com; configurable OpenAI-compatible text, web-search and image endpoints; unpkg for some frontend libraries; and Iconify icon APIs. Maps/directions and sharing can open Google Maps, OpenStreetMap, Bing, Facebook, X, Telegram or WhatsApp. Some staff map views load OpenStreetMap tiles and public boundary files from GitHub. A browser contacting an external service exposes network and request information to that service.

An OpenAI-compatible interface does not prove OpenAI is the actual supplier. Exact AI operators, subprocessors, account terms, storage regions and training/retention settings remain to be verified against deployment configuration and contracts. Baileys is bridge software, not evidence that messaging is an official WhatsApp Business API service. Optional links do not give those platforms access to the whole case database. External recipients operate under their own notices; linking them does not guarantee their practices.

10. Malaysia hosting and cross-border processing

The project owner states that the primary application server and backups are in Malaysia. This does not establish that all processing stays in Malaysia: messaging, CDN delivery, external libraries, analytics infrastructure or AI requests can involve other countries and remote support. The controller must identify actual destinations and recipients, assess the applicable section 129 transfer condition and safeguards, and provide any required notice or obtain consent before a transfer. A transfer register, processor terms and provider-specific retention evidence are still required. This draft does not claim a completed transfer-impact assessment or that all suppliers provide identical protection.

11. AI assistance and human review

Where enabled, consultation text and relevant conversation context can be sent to a configured AI provider, using FAQ material and optionally web search. Staff can also use AI to organise case content, translate or prepare publications and images. The consultation workflow attempts to remove recognised identity values and IC/phone patterns, but automated redaction cannot reliably remove every identifier, name, address, image or contextual clue. Avoid unnecessary sensitive information in AI prompts. Provider training and retention restrictions cannot be guaranteed until the actual account terms are verified. Ask for staff assistance for sensitive matters; AI output may be inaccurate and is not a binding service, legal, medical or financial decision.

12. Location, images and notifications

With browser permission, approximate or precise location can help choose the nearest intake point or identify a complaint location. Complaint-photo GPS metadata may be extracted and stored as case location even if you did not type coordinates; removing image metadata before uploading can avoid that disclosure. Image sanitisation does not necessarily erase location already extracted into the record. Public location selection uses local boundary files. Opening directions can send origin/destination information to a map provider. Optional browser notifications can reveal case updates on a shared device’s screen; manage permission in browser settings.

13. Retention and deletion

The current operational instruction is indefinite/permanent retention of resident, case, welfare, consultation and WhatsApp records and backups; no fixed expiry has been approved for these categories. Disabling a feature, disconnecting WhatsApp, signing out or removing browser data does not delete server records. This is a disclosure of current instructions, not a conclusion that permanent retention is lawful. Where the PDPA applies, personal data must not be kept longer than necessary; consent or political usefulness does not override that requirement. A purpose-based retention schedule and deletion/anonymisation process must be approved before this draft can be treated as audit-ready.

Analytics has a separately documented operational cleanup plan: Umami replay segments older than 30 days and heatmap events older than 90 days, processed daily, while basic events and sessions are retained indefinitely. Its live operation and backup coverage must be reverified. Valid legal holds may delay deletion of particular records. A deletion request must be assessed individually, with any lawful refusal, retained categories, reasons and review period explained. Deleted live data may remain in isolated backups until their approved rotation; no backup rotation period is currently confirmed.

14. Security and confidentiality

The implementation includes role/intake-point access controls, protected staff sessions, password hashing, request validation, anti-abuse controls, activity records and attribution watermarks. WhatsApp bridge credentials use encryption when configured; this does not mean every message, attachment, database or backup is encrypted end to end or at rest. HTTPS, storage/backup encryption, access reviews, patching, restoration tests and staff confidentiality require deployment and operational evidence. Files exported, printed or sent to an authorised external recipient require separate handling controls. No network or storage system can be guaranteed completely secure; report suspected exposure promptly through the privacy contact.

15. Your rights and requests

Subject to applicable law, you may request information about processing, access and correction; withdraw consent; object to qualifying processing causing damage or distress; stop direct marketing; request eligible data portability; and ask for deletion or reduced retention where information is no longer needed. These rights have statutory conditions and exceptions; a universal unconditional right to erase every case or backup is not promised. The PDPA & Your Rights document explains verification, timing, fees, representatives and escalation. A request need not be posted publicly or sent to every intake point.

16. Adults and information about children

Platform users must be at least 18. This is the project’s eligibility rule and does not represent official electoral registration or proof of party membership. Do not create a child’s account or use the platform to target children with political communications. A service request submitted by an authorised adult may incidentally mention a child or dependant; staff must minimise that information, verify authority and apply any required guardian permission and legal protections. Report suspected unauthorised collection involving a minor so the responsible organisation can assess restriction, correction or deletion. Publishing an age rule alone is not age verification.

17. Incidents, updates and applicability

Suspected breaches must be contained, assessed and documented, with notices to the Malaysian Commissioner and affected individuals where the statutory triggers and timelines apply. Tootaio Studio must escalate incidents to the responsible controller; this draft does not establish that a DPO has been appointed or a response exercise completed. Malaysian PDPA applicability depends on the entity and processing context, including its commercial-transaction scope; political activity is not a blanket finding of exemption or coverage. Other applicable confidentiality and legal duties continue to apply.

Revisions must identify the version and effective date and explain material new purposes or disclosures before they take effect, obtaining fresh consent when required. Malay and English notices must remain aligned; Chinese is provided for accessibility. No language version limits statutory rights, and material inconsistencies must be corrected. The current draft has no effective date and must not be presented as certified or audit-approved.