Effective date: 18 October 2026

Last updated: 18 October 2026

Ditrapoint (“Ditra Point”, “we”, “us”, “our”) is a website design and digital marketing agency in Johor Bahru, Johor, Malaysia. We respect your privacy and want you to understand what personal data we collect, why we collect it, who we share it with and what rights you have over it.

This Privacy Policy is our notice under section 7 of the Personal Data Protection Act 2010 (“PDPA”), as amended in 2024. It applies when you visit ditrapoint.com (the “Site”), contact us through the Site, WhatsApp, email or social media, or engage us for any service. A summary in Bahasa Melayu is at the end of this page.

By using the Site or sending us your details, you agree to this Policy and to our Terms & Conditions. If you do not agree, please do not submit your personal data to us.

What Personal Data We Collect

Data You Give Us

We collect the personal data you provide when you:

Fill in a form on the Site. The enquiry form on our service, contact and pricing pages asks for your name, email address, phone number, the service you are interested in, the type of enquiry and your message, and records the language of the page you sent it from (English, Bahasa Malaysia or Chinese). The Café Offer form also asks for your business name and your website or social media page. The contact form asks for your first and last name, email address, phone number, business name, current website, the services you are interested in, your message and your agreement to these policies.
Message us on WhatsApp, email, Telegram or social media: your name, your number or handle and the content of the conversation.
Engage us for a service: your billing details, business registration details where needed for invoicing, payment details (processed by your bank or payment provider; we do not store card numbers), the services you have bought, your website and advertising account access, and the content, images and information you give us to build or market your business.
Book a call or a meeting with us.
Give us a review, testimonial or feedback.

We do not ask for sensitive personal data (such as health, religious or political information) and ask you not to send it to us. If a project requires it (for example a clinic website), we will agree in writing how it is handled.

Data Collected Automatically

When you send a form, it also records the page you sent it from, the page that referred you, and any campaign tags (UTM parameters) or ad click identifiers (such as gclid or fbclid) in the link you arrived on. The campaign tags and click identifiers from your first visit are kept in your browser’s local storage for up to 30 days, so that an enquiry can be credited to the advertisement or link that brought you.

From launch, the Site uses Google Analytics 4. It collects your approximate location, device and browser type, the pages you view, how long you spend on them, the links you click, how you arrived at the Site and whether you sent an enquiry. We do not currently use Google Ads or Meta advertising cookies or pixels on the Site; if we add them, we will update this Policy first. Our hosting provider also keeps standard server logs (IP address, time, pages requested) for security.

Data About Other People

If you send us personal data about other people (your staff, your customers, your testimonials), you confirm that you have the right to share it with us and that you have told them about this Policy.

Data We Process For Our Clients

When we build, host or maintain a website, funnel or app for a client, that client’s own customers may submit personal data through it (for example enquiries, bookings or orders). We process that data on the client’s behalf and under the client’s instructions, and only to deliver, support, back up and secure the service. The client is responsible for its own privacy notice to its customers.

Why We Collect It

We use your personal data to:

Reply to your enquiry, in your language where we can, and send you a quotation.
Deliver the services you have engaged us for, including building, hosting, maintaining and marketing your website.
Invoice you, process payments and keep accounting records as required by Malaysian law.
Send you technical notices, security alerts and project updates.
Understand how the Site is used and improve it, and measure which of our own advertising brings enquiries.
Send you updates about your project, our services or offers, which you can opt out of at any time.
Protect the Site and our systems against abuse, spam and fraud.
Comply with the law and with lawful requests from authorities.

We only collect what we need for these purposes. Providing your name and a way to reach you is necessary for us to reply to an enquiry; the rest is optional unless a service needs it.

We never sell your personal data. We share it only with the people and providers we need to run our business and deliver your project:

Our team: the Ditrapoint team members, contractors and freelancers who need it to deliver your project. They are bound by confidentiality obligations.
Hosting and infrastructure: the Site is hosted on Vercel, with DNS and security through Cloudflare. Client websites we host are on the hosting provider named in your agreement.
Form notifications: forms on the Site are sent to our notifications service, which is hosted outside Malaysia and passes each submission to our team by Telegram and by email, delivered through Resend.
Email and messaging: our email provider, WhatsApp and Telegram.
Analytics and advertising platforms: Google (Analytics, Ads, Business Profile, Search Console) and Meta (Facebook and Instagram), when enabled on the Site or when you engage us to run advertising for you.
Business tools: invoicing, accounting, payment, project management and file storage services.
Professional advisers and authorities: our accountants, lawyers and any authority with a lawful request, or where disclosure is needed to protect the rights, safety or property of Ditrapoint, our clients or others.
Business transfers: if Ditrapoint is merged, restructured or sold, in whole or in part, your data may be transferred as part of that transaction, subject to the same protections as this Policy.

Anything you choose to make public, such as a review on Google, can be seen by others.

Where Your Data Is Stored

Many of these providers store or process data outside Malaysia. Vercel, Resend, Google and Meta are based in the United States and run servers in several countries, Telegram and Cloudflare operate worldwide, and our notifications service runs outside Malaysia. Altogether, your data may be stored or processed by our team, contractors and providers in countries including Malaysia, Singapore, the United States, Australia, Canada, the United Kingdom, India, Pakistan, Bangladesh, the Philippines, Indonesia and New Zealand, or other locations where needed to deliver our services.

Under section 129 of the PDPA, as amended in 2024, we transfer personal data outside Malaysia only where the destination has a law substantially similar to the PDPA or ensures an adequate level of protection, where the provider is bound to protect it to that standard, or where another ground the PDPA allows applies (for example, the transfer is needed to reply to you or to carry out a contract with you).

How Long We Keep It

Enquiries that do not become projects: up to 24 months, so we can follow up and answer if you come back.
Form notifications in Telegram and email: deleted or archived with the enquiry, on the same 24-month period.
Client project records, contracts and correspondence: for the duration of the engagement and 7 years after, to meet Malaysian tax and accounting record requirements.
Website backups and project files held for a hosting, maintenance or subscription plan: deleted within 90 days after the plan ends, unless you ask for them earlier or the law requires otherwise.
Analytics data: according to the retention settings of the tool, which we keep at the shortest practical period (currently 14 months in Google Analytics 4).
Marketing lists: until you unsubscribe or 24 months after your last interaction.

When data is no longer needed we delete it or make it anonymous. You can ask us to delete your data sooner, unless we have to keep it by law.

Keeping It Secure

We protect your personal data with access controls, encrypted connections (HTTPS), two-factor authentication on our accounts and by limiting access to the people on our team who need it. Where you give us access to your own accounts for a project, we use it only for the agreed work, and we recommend you revoke it or change the credentials once the work is done. No system is perfectly secure, so we also keep what we collect to a minimum.

Breach notification. If a personal data breach occurs, we will notify the Personal Data Protection Commissioner as soon as practicable and within 72 hours of becoming aware of it, as the PDPA (as amended in 2024) requires. If the breach is likely to cause you significant harm, we will also tell you without unnecessary delay what happened, what data was involved, what we are doing about it and what you can do to protect yourself.

Your Rights

Under the PDPA you have the right to:

Access the personal data we hold about you.
Correct data that is inaccurate, incomplete, misleading or out of date.
Withdraw consent to our processing of your data, where processing is based on consent.
Stop direct marketing at any time: reply “unsubscribe”, use the unsubscribe link in any email, or tell us on any channel.
Limit processing that is likely to cause you damage or distress.
Data portability: ask for the personal data you gave us in a commonly used, machine-readable format, or ask us to send it directly to another organisation, as provided by the 2024 amendments.

You may also ask us to delete your data. To exercise any of these rights, contact us as described below. We will respond within 21 days as the PDPA requires, and we may need to verify your identity first. We may charge a small fee for access requests where the law permits. We will still send you service messages, such as invoices, project updates and security notices, while you are a client.

If you are not satisfied with our response, you may complain to the Personal Data Protection Department of Malaysia (Jabatan Perlindungan Data Peribadi).

Cookies And Local Storage

The Site works without cookies. Once Google Analytics 4 is switched on, it sets cookies that help us understand how visitors use the Site and which of our advertising brings enquiries. Our forms use your browser’s local storage for the 30-day campaign record described above.

You can block or delete cookies and clear local storage through your browser settings at any time, and opt out of Google Analytics with Google’s browser add-on. Blocking them does not stop any part of the Site from working. More about managing cookies is at allaboutcookies.org. If your browser sends a “Do Not Track” signal, we will not use your activity on the Site for behavioural advertising.

Third-Party Sites

The Site links to other websites, such as WhatsApp, Google Business Profile, social media and the websites of clients in our case studies. Their privacy practices are their own and this Policy does not cover them. Data those platforms collect is governed by their own privacy policies.

Children

Our services are for businesses and we do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, contact us and we will delete it promptly.

Changes To This Policy

We may update this Policy as the law or our services change. The “last updated” date at the top shows the current version. Significant changes will be announced on the Site. Continued use of the Site after a change means you accept the updated Policy.

How To Contact Us

Our data protection contact is the Founder of Ditrapoint, who is responsible for how we handle personal data. Email support@ditrapoint.com, message us on WhatsApp or use the contact page. Please write “Personal data request” in the subject so we can handle it quickly.

Ditrapoint, Johor Bahru, Johor, Malaysia.

Ringkasan Dalam Bahasa Melayu

Ditrapoint ialah agensi reka bentuk laman web dan pemasaran digital di Johor Bahru, dan notis ini dibuat di bawah Akta Perlindungan Data Peribadi 2010 (termasuk pindaan 2024). Kami mengumpul data peribadi yang anda berikan melalui borang di laman web ini, WhatsApp, e-mel atau media sosial, seperti nama, e-mel, nombor telefon, nama perniagaan, laman web, perkhidmatan yang diminati, mesej anda dan bahasa halaman yang anda gunakan. Borang juga merekod halaman asal, pautan rujukan dan tag kempen, dan tag kempen disimpan dalam pelayar anda sehingga 30 hari. Selepas pelancaran, kami menggunakan Google Analytics 4 dan kukinya; kami tidak menggunakan piksel Google Ads atau Meta di laman web ini buat masa ini. Data ini digunakan untuk membalas pertanyaan anda, menyediakan sebut harga, melaksanakan perkhidmatan yang anda tempah, mengeluarkan invois, memperbaiki laman web dan mengukur pengiklanan kami sendiri, serta mematuhi undang-undang. Kami tidak menjual data anda. Ia hanya dikongsi dengan pasukan kami dan pembekal yang kami perlukan, iaitu Vercel (pengehosan), Cloudflare, perkhidmatan notifikasi kami yang menghantar setiap borang kepada pasukan kami melalui Telegram dan e-mel (Resend), Google, Meta, alat perniagaan dan penasihat profesional kami. Kebanyakan pembekal ini menyimpan data di luar Malaysia, dan kami memindahkan data ke luar negara hanya mengikut seksyen 129 Akta tersebut. Data pertanyaan disimpan sehingga 24 bulan, sandaran laman web dipadam dalam 90 hari selepas pelan tamat, dan rekod projek disimpan 7 tahun selepas tamat perkhidmatan seperti yang dikehendaki undang-undang. Anda berhak mengakses dan membetulkan data anda, menarik balik persetujuan, menghentikan pemasaran langsung, mengehadkan pemprosesan, meminta data anda dipadam dan meminta salinan data anda dalam format mudah alih, dan kami akan membalas dalam masa 21 hari. Sekiranya berlaku pelanggaran data, kami akan memaklumkan Pesuruhjaya Perlindungan Data Peribadi dalam masa 72 jam, dan memaklumkan anda tanpa kelewatan jika ia mungkin mendatangkan kemudaratan ketara. Untuk sebarang permintaan, hubungi pegawai perlindungan data kami, iaitu Pengasas Ditrapoint, di support@ditrapoint.com, melalui WhatsApp atau halaman hubungi kami. Versi Bahasa Inggeris di atas ialah versi yang mengikat.

Privacy Policy