Privacy policy

This policy explains how BookSpace (bookspace.my) handles personal data for everyone who uses the platform — customers who book, hosts who list spaces, and providers who list services. It applies to the website and to the transactional emails we send.

We handle personal data in line with Malaysia’s Personal Data Protection Act 2010 (PDPA). For that data, BookSpace is the data user; the service providers named below process it on our instructions.

Account details — Your name, email address, password (stored only as a bcrypt hash, never in readable form), and optionally your phone number. We record when your email was verified and when your password last changed, so that a password change can sign out other sessions.

Listing content — For hosts and providers: business name, listing descriptions, addresses, capacity and pricing, and the photographs you upload.

Verification and payout details — For hosts and providers being verified: a contact name, phone, email and address, plus the bank name, account holder name, and account number we need in order to pay you. These are visible only to you and to our administrators, and are never shown on a public listing.

Booking records — The bookings you make or receive, their dates, times, guest counts, prices, deposits, add-ons, statuses, payouts, reviews, and any dispute you open.

Messages — Messages exchanged between customers, hosts, and providers through the platform’s inbox. Our administrators can access these where needed to investigate a dispute or a safety report.

Technical data — Standard server logs, and aggregate page-view analytics, which does not use cookies and does not build a cross-site profile of you.

We use personal data only to run the platform:

• to create and secure your account, and to verify your email address;
• to show listings, calculate availability and pricing, and record bookings;
• to take payment, calculate our processing fee, and pay hosts and providers;
• to send transactional email — booking confirmations, approvals, cancellations, verification and password-reset codes;
• to let the two sides of a booking message each other;
• to review verifications and listing applications, and to investigate disputes, fraud, and abuse;
• to keep the records we are required by law to keep.

We do not sell personal data, and we do not use it for advertising or profiling.

We rely on a small number of service providers, each handling only what their function requires:

• Our payment provider — a licensed Malaysian payment gateway. You enter your card or online banking details on their own secure page; we receive only the amount and their transaction reference.
• Our database and storage provider — the database and photo storage behind the platform.
• Our hosting provider — the servers the platform runs on, and aggregate analytics.
• Our email provider — delivery of transactional email.

We will name any of these providers on request.

Beyond these, we disclose personal data only where the law requires it, or where it is necessary to establish or defend a legal claim. A booking necessarily shares the details needed to honour it — your name and booking details reach the host or provider, and theirs reach you.

The providers above operate infrastructure outside Malaysia, so your personal data may be stored or processed abroad. We only use providers that offer contractual protections consistent with the standard the PDPA requires, and we transfer no more than the service needs.

Account, listing, and message data is kept while your account is open. Booking, payment, and payout records are kept for seven years after the booking, which is the period Malaysian tax and accounting rules require.

When you close your account we delete or anonymise what we are not required to retain. Records tied to a completed booking, an unresolved dispute, or a legal obligation are kept for the periods above, even after closure.

Passwords are hashed with bcrypt and are never stored or logged in readable form. Traffic is encrypted in transit. Changing your password immediately invalidates every other signed-in session. Access to verification and payout details is limited to administrators who need it. No system is perfectly secure, so if a breach ever affects your personal data we will tell you and the relevant authority promptly.

Under the PDPA you may:

• ask for a copy of the personal data we hold about you;
• correct anything inaccurate or out of date — most of it you can edit yourself in your account;
• ask us to delete data we no longer have a lawful reason to keep;
• limit how we process it, or withdraw a consent you previously gave;
• object to receiving non-transactional email.

Email support@bookspace.my and we will respond within 21 days. We may need to confirm your identity before acting on a request.

We use cookies only to keep you signed in and to remember interface preferences such as your theme and language. There are no advertising or third-party tracking cookies on BookSpace. Blocking the sign-in cookie will prevent you from staying logged in.

BookSpace is not intended for anyone under 18 and we do not knowingly collect their personal data. If you believe a child has given us data, contact us and we will delete it.

We will update this policy as the platform changes. The effective date at the top always reflects the current version, and we will notify account holders by email before a material change takes effect.

For any question about this policy, or to exercise any of the rights above, email support@bookspace.my. If you are not satisfied with our response, you may complain to the Personal Data Protection Commissioner of Malaysia.