Privacy Policy

1. Personal data we collect

We collect personal data only when you actively provide it. The categories and sources are:

• Enquiry and RFQ forms — name, email address, company name, phone number, project description, and any other information you include in your message.
• Supplier submission forms — company name, contact person, email, phone, website, product category, and supporting materials you upload.
• Tender pilot applications — role/title, company size, active-tender details, and preferred contact channel.
• AgentMail intake — when you email ttkbm@agentmail.to or any @ttkbuildingmaterials.com address, your email address, message body, and any attachments are received and processed by AgentMail (see §4).
• Analytics (PostHog) — page URLs visited, referrer, session duration, browser type, and custom events such as rfq_submitted, calculator_used, and enterprise_inquiry. We do not record IP addresses in PostHog event properties. No personally identifiable information is embedded in analytics events.
• Cloudflare edge logs — IP address, request path, and timestamp retained at the CDN edge for up to 24 hours for security and traffic management. We do not have direct access to these logs; they are managed by Cloudflare under their data processing agreement.

We do not collect sensitive personal data (health, financial, political, or religious data) and we do not knowingly collect data from individuals under 18.

2. Lawful basis for processing

• Consent — We process your contact details for marketing communications (supplier digest, product updates) only when you have opted in. You may withdraw consent at any time by emailing privacy@ttkbuildingmaterials.com.
• Contractual necessity — We process data necessary to fulfil the service you requested: routing your RFQ to the matching supplier, processing a tender pilot onboarding, or responding to a supplier claim.
• Legitimate interest — We use anonymised analytics data (PostHog) to understand how the site is used and improve the service. This analytics does not identify you as an individual. We have assessed that our legitimate interest is not overridden by your rights.

3. How we use your personal data

• Responding to your enquiry, RFQ, or supplier submission.
• Routing your RFQ to the specific supplier(s) you have selected or that match your stated requirements.
• Onboarding you to the Tender & Quotation pilot programme.
• Sending you service communications (confirmation emails, follow-up on open RFQs).
• Sending you marketing communications where you have given explicit consent.
• Improving and maintaining the website and directory using aggregated, anonymised analytics.
• Complying with legal obligations.

4. Disclosure to third parties

We share personal data only in the following circumstances:

• Supplier recipients of RFQs — When you submit an RFQ, your name, company, email, phone, and project details are forwarded to the supplier(s) you have identified or approved. You are informed of this at the point of submission.
• AgentMail — Our email intake inbox is operated by AgentMail (agentmail.to). Messages sent to our email addresses are received and stored by AgentMail on our behalf. AgentMail processes data under contract with us.
• PostHog — We use PostHog for product analytics. PostHog receives page-visit and interaction data as described in §1. PostHog operates under a data processing agreement.
• Cloudflare — The website is served via Cloudflare's global CDN and Workers platform. Cloudflare processes network-level data (IP address, request metadata) as a data processor under Cloudflare's standard DPA.
• Legal disclosure — We will disclose personal data to authorities where required by Malaysian law or valid court order.

We do not sell, rent, or trade personal data with any third party for their own marketing purposes.

5. Cross-border data transfers

Some of our service providers process data outside Malaysia. Under PDPA §129, we ensure adequate protection through contractual safeguards:

• PostHog — Servers in the United States. Safeguard: PostHog's Data Processing Agreement incorporating standard contractual clauses.
• AgentMail — Servers in the United States. Safeguard: AgentMail's standard data processing terms.
• Cloudflare — Global edge network. Safeguard: Cloudflare's Data Processing Addendum (DPA) incorporating EU Standard Contractual Clauses as a baseline, applied globally.

6. Data retention

• RFQ and enquiry records — Retained for 24 months from the date of the last interaction, then deleted from our deal pipeline and inbox archives.
• Supplier submission records — Retained for the duration of the listing plus 12 months after removal, then deleted.
• Marketing consent records — Retained until you withdraw consent, then deleted within 30 days of withdrawal.
• Analytics data (PostHog) — Session and event data retained for 12 months in PostHog, then auto-purged per our PostHog project settings.
• Cloudflare edge logs — Retained for up to 24 hours at the edge; not accessible to us beyond that.

7. Your rights under PDPA 2010

Under the Personal Data Protection Act 2010 (Akta 709), you have the following rights:

• Right of access (§30) — You may request a copy of the personal data we hold about you.
• Right of correction (§34) — You may request correction of inaccurate, incomplete, misleading, or outdated personal data.
• Right to withdraw consent (§38) — You may withdraw consent for marketing communications at any time. Withdrawal does not affect processing carried out before withdrawal.
• Right to prevent processing for direct marketing (§43) — You may instruct us to stop using your data for direct marketing.
• Right to complain to JPDP — If you believe we have breached the PDPA, you may lodge a complaint with the Department of Personal Data Protection (Jabatan Perlindungan Data Peribadi, JPDP) at www.jpdp.gov.my.

To exercise any of these rights, email privacy@ttkbuildingmaterials.com. We will respond within 21 days.

8. Cookies and analytics

This website uses a single first-party analytics session cookie set by PostHog (ph_*). This cookie:

• Identifies a browser session for the purpose of counting page views and user journeys.
• Does not contain your name, email, or any directly identifying information.
• Is not shared with advertising networks.
• Expires at the end of the session or after 365 days, whichever is sooner.

We do not use third-party advertising cookies, social media tracking pixels, or any other tracking technology beyond PostHog. You can block this cookie via your browser settings; this will not affect your ability to use the website.

9. Security

All data in transit is encrypted via TLS. Form submissions are transmitted directly to our AgentMail inbox over HTTPS. We do not store personal data in the static site's source code or git repository. Deal pipeline records held locally are treated as sensitive data and are not committed to public repositories.

10. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be notified via a notice on the homepage for 30 days. The "Last reviewed" date above will always reflect the most recent update.

11. Contact

For all privacy queries, data access requests, correction requests, or consent withdrawals:
Email: privacy@ttkbuildingmaterials.com
Response time: within 21 days.
Operator: Teh Kim Guan, Malaysia.