Privacy Notice

Definitions

This section explains key terms used throughout the privacy policy. Each definition is paired with short practical cases so private buyers can quickly understand how each term applies to common property transaction scenarios with VelanVEstate.

Personal data means any information relating to an identifiable individual. Example case: a buyer submits their full name, email and identity document scans to request a valuation and these items are personal data collected to verify identity and proceed with a property search.

Processing covers any operation performed on personal data such as collection, storage, retrieval, disclosure and deletion. Practical scenario: when VelanVEstate compiles a shortlist of properties for a buyer, that compilation is processing of the buyer's search preferences and contact details.

User refers to an individual who interacts with VelanVEstate services, such as private buyers, property owners providing listing information, or external advisors. Case: a private buyer using the website to schedule a consultation is a user whose preferences are recorded to tailor the meeting.

Service refers to the property transaction consulting and related tools provided by VelanVEstate, including market analysis, negotiation support, and coordination with local professionals. Example case: the service includes preparing a negotiation strategy document based on buyer priorities.

Cookies are small files stored on a device to remember preferences or measure site use. Case: a cookie remembers a buyer's selected search radius between visits so they do not need to re-enter it each time they use VelanVEstate.

Why we use your data

This section explains the purposes for processing personal data with practical examples and typical buyer scenarios such as property sourcing, negotiation support, due diligence coordination, and ongoing client communications.

• Provide consulting services: using your preferences and documentation to prepare tailored property recommendations and negotiation plans for each buyer case.
• Communicate with you: schedule viewings, answer queries, and share reports relevant to the transaction scenario you are managing with VelanVEstate.
• Perform due diligence: verify property title, liabilities and compliance as part of the transaction workflow with legal partners during a real purchase case.
• Facilitate transactions: share necessary details with solicitors, banks and inspection providers to support contract platform and settlement tasks in an actual buying process.
• Improve our services: analyze anonymized usage patterns to refine search tools and case materials based on how buyers interact with VelanVEstate resources.
• Security and fraud prevention: detect and respond to attempts to misuse the service, illustrated by scenario-based checks when documents are uploaded or funds are requested.
• Legal and regulatory compliance: process and retain records necessary to meet statutory requirements in specific transaction cases, such as anti-funds-laundering checks.
• Record keeping and disputes: maintain transaction records to resolve queries or disputes that arise after a closing, using the documented case timeline.

Legal basis for processing

Where applicable, VelanVEstate relies on appropriate legal bases to process personal data. The following list explains these bases with examples of common transaction scenarios where each applies.

• Contract performance: processing necessary to fulfill a consulting contract with a buyer, such as coordinating conveyancing steps during a property purchase.
• Legitimate interests: processing for fraud prevention, platform improvement and communications about similar services, balanced against buyer privacy in documented cases.
• Legal obligations: processing required to comply with statutory duties, such as maintaining records under regulatory frameworks during a completed transaction.
• Consent: where specific processing falls outside the bases above (for example, direct marketing by email), we will request consent and record the case-specific choice.

If GDPR applies

When processing relates to individuals protected by the EU General Data Protection Regulation, VelanVEstate takes additional measures. The points below describe rights and procedures with scenario-based guidance for buyers who may be covered.

• Right of access: buyers can request a copy of personal data we hold. Case: a buyer requests all documents and notes created during a six-month sourcing engagement.
• Right to rectification: inaccurate data can be corrected. Case: changing a misspelled name or an incorrect bank account before completion.
• Right to erasure: where legal bases allow, data can be removed. Scenario: a buyer withdraws from services and requests deletion of non-essential marketing records.
• Right to restrict processing: a buyer can request use of data be limited while a dispute is resolved, as in a case where transaction status is contested.
• Right to data portability: where applicable, structured personal data can be provided for transfer to another provider in a common case where a buyer changes advisors.
• Right to object: buyers may object to processing based on legitimate interests, for instance objecting to marketing communications from VelanVEstate.

Cookies and similar technologies

VelanVEstate uses cookies and similar technologies to support site functionality, remember user preferences and measure how services are used. Examples explain how cookies enhance practical buyer journeys on the site.

We use session cookies for temporary functions such as keeping you logged in during a booking flow, persistent cookies to remember search filters, analytics cookies to understand aggregate behavior, and third-party cookies for embedded maps and payment widgets used in inspection scheduling scenarios.

Categories include strictly necessary cookies (for security and core functionality), performance and analytics cookies (to improve pages and tools), functional cookies (to remember preferences), and advertising cookies (for tailored offers where consent is given).

You can manage cookie preferences through your browser settings and any cookie controls presented on VelanVEstate.vip. For example, a buyer may block tracking cookies but allow functional cookies required to save a shortlist between sessions.

Full cookie policy and choice controls are available at VelanVEstate.vip/cookie-policy for detailed examples and step-by-step management guidance.

When we share data

VelanVEstate shares personal data only as required to deliver services and comply with legal obligations. Below are categories of recipients with practical case descriptions of why sharing is necessary.

• Legal and conveyancing professionals: title searches, contract preparation and settlement coordination require sharing documents and contact details during a purchase transaction.
• Business institutions: lenders and banks receive necessary business data and proof of funds when buyers apply for funding as part of a real purchase case.
• Inspection and survey providers: property inspection reports and access arrangements are shared to schedule site visits and compile condition reports used for negotiation strategies.
• Regulators and law enforcement: personal data may be disclosed if required by law, for example during anti-funds-laundering checks in a transaction review.
• Service providers: hosting, email delivery and analytics vendors may process data under contract and only to the extent needed to support VelanVEstate operations and case management.
• Prospective buyers and sellers: limited contact details may be shared between parties to complete a sale once both sides have agreed, under instructions specific to the transaction scenario.

International transfers

Some processing partners may be located outside Malaysia. When personal data is transferred internationally, VelanVEstate implements contractual and technical measures proportionate to the transfer risk. Example case: hosting backups stored in another jurisdiction are encrypted and governed by data protection clauses.

Safeguards include standard contractual clauses, data processing agreements and encryption. A practical scenario: when sharing documents with an overseas legal advisor, we ensure a signed data processing agreement and limit the shared data to what is necessary for the task.

How long we keep data

Retention periods are determined by the nature of the data and the reason it was collected, with examples tied to common buyer journeys so users understand retention in context.

Account and profile information is retained while your account is active and subsequently for a period that allows us to address queries and legal obligations related to transactions concluded or abandoned in the relevant 2026 case files.

Messages and consultation notes are kept for a defined period to support ongoing advisory work or to resolve disputes arising from a transaction; for instance, notes from a negotiation in 2026 may be retained to clarify agreed terms.

System and access logs may be stored for security and fraud detection purposes for a reasonable period aligned with incident contribute needs, illustrated by an example where logs helped reconstruct an upload error during a contract platform.

When retention periods expire or when you request deletion where lawful, we securely remove or anonymize personal data. Example: after a buyer has completed a purchase and the statutory retention period lapses, non-essential marketing records are anonymized.

Security of your data

VelanVEstate applies technical and organizational measures to protect personal data against unauthorized access, loss or misuse. The measures below are described with practical cases showing how they reduce risks in real transaction workflows.

• Access controls and role-based permissions ensuring only authorized staff can view sensitive documents during conveyancing scenarios, minimizing exposure during negotiation and closing.
• Encryption of data in transit and at rest for documents platform with partners, demonstrated in cases where contract drafts and identity documents are transmitted between parties.
• Regular audits, logging and incident response procedures to identify and remediate security events promptly, as illustrated by a past scenario where a suspected unauthorized access attempt was contained and contribute.

Your rights

You have rights regarding your personal data. This section explains each right with a practical example so private buyers understand how to exercise them in common property transaction situations.

• Right to access: request a copy of personal data we process about you. Example: request all documents and notes from a 2026 sourcing assignment.
• Right to rectification: ask us to correct incorrect or incomplete data such as a misspelled name before contract platform.
• Right to erasure: request deletion of data where there is no longer a lawful basis to retain it, for example removing marketing consents after concluding services and subject to legal retention obligations.
• Right to restrict processing: ask for limitation of processing while a dispute or verification is in progress, such as pausing marketing while identity is being verified.
• Right to data portability: request a structured copy of data to transfer to another advisor when changing consulting providers mid-transaction.
• Right to object: object to processing based on legitimate interests, for instance stopping profiling for promotional materials if you no longer wish to receive them.
• Right to withdraw consent: when processing is based on consent, you can withdraw it at any time; an example is revoking permission for targeted emails while preserving transactional communications.
• Right to lodge a complaint with a supervisory authority if you consider our processing does not comply with applicable data protection laws; practical guidance on initial steps is provided in the contact section.

How to exercise your rights

To exercise any rights, contact VelanVEstate using the details below and include sufficient information to identify yourself and the request context (for example: case reference, dates of engagement). We will respond within the applicable statutory timeframe and may ask for additional information to verify identity before acting on requests. Practical example: to obtain all files related to a 2026 purchase consultation, provide the project reference or email used during the engagement.

contact@velanvestate.vip

We aim to respond to privacy rights requests within 30 calendar days of receipt. For complex requests requiring verification or third-party coordination, we may extend the response period by up to an additional 30 days and will notify you of the reason for the extension. Example scenario: when a buyer requests transaction records that involve multiple service providers, we will confirm identity and provide a consolidated response within the stated timeframe.