Who we are
R3L ("we", "us"). We build and host websites in Kuala Lumpur and Selangor, Malaysia. For the personal data described here, we are the data user (controller).
What this website collects
- No forms, no accounts, no cookies. This site has no contact form or login and sets no cookies.
- Visit statistics. We use Vercel Web Analytics to count visits. It does not use cookies and does not identify you personally; it records things like the page, the referring site, the device type and the country.
- Hosting logs. The site is hosted on Vercel. Like any web host, Vercel processes your IP address and browser details to deliver the page and protect the site from attacks.
- Project status lights. Each time you open the Projects page, your browser sends one small request to each project's own website to show whether it is online. Those sites see that request like any visit (your IP address and browser type). No cookies, referrer or other details about you are sent with it.
- Fonts and images are served from this site itself, not from third parties.
Personal data we collect when you contact us or hire us
If you WhatsApp or email us, we receive what you send: usually your name, phone number or email address, business name and details of your project. We may also receive text, photos and logos for your website. Please do not send identity card numbers, bank logins or other sensitive data; we do not need them.
Where it comes from
Directly from you (messages, files, calls), from the payment record of a DuitNow QR payment you make to us, and from public business records such as SSM when we check a company name.
Why we use it (purposes)
- To reply to your enquiry, quote, build, host and support your website.
- To bill you and keep payment records for accounting and tax. Payment records show the amount, date and reference; we never see your bank login.
- To keep records of what was agreed, in case of a dispute.
- To meet our legal duties.
We do not sell your data, we do not use it for marketing to other people, and we do not send marketing messages.
Who we share it with
Only the providers needed to do the work, and only the data they need:
- WhatsApp (Meta) carries WhatsApp messages.
- Our email is handled by ImprovMX (forwarding) and Google Gmail.
- Vercel Inc. hosts this website and provides the visit statistics. Client websites are hosted on Vercel or another provider agreed with each client.
- Domain registrars, for domains we register on a client's behalf.
- Our bank, for payments received, and our accountant or tax authority where the law requires.
- Courts, regulators or the police where the law requires it.
Transfers outside Malaysia
Some of these providers are outside Malaysia. Vercel Inc. is in the United States and serves pages from servers around the world; WhatsApp (Meta) and some email providers also process data abroad. This site itself stores no personal data. For the technical data Vercel handles, we rely on Vercel's data processing agreement as the safeguard, and we only choose providers that publish security commitments. When you message us, you know the message travels through your chosen app. If you do not want data processed outside Malaysia, tell us before you send it and we will agree another way.
How long we keep it
- Enquiries that do not become a project: deleted within 12 months.
- Project files: while we host your site, plus 90 days after you leave, then deleted.
- Payment records: 7 years, for accounting and tax.
- Messages about a project: until the project ends, unless needed for a dispute.
Your rights
You can ask us to:
- show you the personal data we hold about you (access);
- correct it if it is wrong or out of date;
- stop using it for a purpose, or withdraw a consent you gave us;
- send it to you, or to another provider you name, in a common format where that is technically possible (data portability);
- delete it, where the law does not require us to keep it.
We reply within 21 days. If we cannot do what you ask, we tell you why. There is no charge for a reasonable request, and we may need to confirm who you are first.
Requests and contact
Data requests, questions and complaints go tostudio@r3l.appor WhatsApp +60 12-255 6914. Write "Data request" in the first line. If you are not satisfied, you may complain to thePersonal Data Protection Commissioner of Malaysia.
Your customers' data
When a website we host collects data from your customers (bookings, logins, forms), you are the data user and we act as your data processor. We only process that data to run and secure your site, and we delete it or hand it over when you leave. You are responsible for your own privacy notice; we can help write one.
If something goes wrong
We keep access to client and enquiry data limited to the people working on it. If a personal data breach affects you, we will tell the Personal Data Protection Commissioner as soon as practicable and within the time the Commissioner's breach notification guideline sets (currently 72 hours), and we will tell you without unnecessary delay where the breach is likely to cause you significant harm.
Children
This site is for businesses and organisations and does not knowingly collect data from children. We do not show pupils' faces or names in our portfolio.
Language and changes
This notice is published in English and Bahasa Melayu, as the PDPA requires. If the two differ, tell us. We may update the notice; the date at the top shows the latest version.