1. Introduction

ST Comp Holdings Sdn. Bhd. ("ST Comp Holdings", "we", "us", "our", or "Company") is committed to protecting your privacy and ensuring you have a positive experience on our website and when using our services. This Privacy Policy explains how we collect, use, disclose, and safeguard your information in accordance with the Personal Data Protection Act 2010 (PDPA) and other applicable Malaysian laws.

2. Information We Collect

3. How We Use Your Information

We use collected personal data for the following purposes:

• •To respond to your inquiries and provide requested services
• •To process project proposals, contracts, and invoices
• •To send service updates, newsletters, and marketing communications (with your consent)
• •To improve our website, services, and user experience
• •To comply with legal obligations and protect our rights
• •To conduct analytics and monitor website performance
• •To answer guest enquiries on behalf of businesses using our messaging services, and to pass those enquiries to their staff when a person is needed

4. Legal Basis for Processing

We process your personal data based on: (a) your explicit consent; (b) the necessity to fulfill a contract with you; (c) compliance with legal obligations; (d) protection of your vital interests; or (e) our legitimate interests in conducting business, improving services, and ensuring security.

5. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These include encryption, secure servers, access controls, and regular security audits. However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.

6. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by Malaysian law. Project files and communications are retained for a minimum of 7 years for business and regulatory purposes. You may request deletion of your data at any time, subject to legal and contractual obligations.

7. Sharing Your Information

We do not sell, trade, or rent your personal information. We may share your data with:

• •Amazon Web Services (Malaysia) — managed database hosting, where conversations and records are stored
• •Google Cloud — compute hosting for the software that processes messages
• •OpenRouter (United States) — receives the text of a guest message and returns a suggested reply
• •Google (United States) — provides the language model that generates that reply, accessed through OpenRouter
• •Twilio (United States) — delivers SMS and WhatsApp messages, including alerts to on-duty staff that may quote a guest message
• •Softinn (Malaysia) — property management and booking system, which receives a phone number and booking reference when a guest asks us to look up their reservation
• •Meta Platforms — operates WhatsApp, Messenger and Instagram, through which messages reach us and replies are delivered
• •The business a guest messaged, who are the party answering them
• •Legal authorities when required by law

All third parties are contractually obligated to protect your data in accordance with this Privacy Policy and applicable laws.

8. International Data Transfers

Conversation records are stored in Malaysia. Some of the providers listed above process data outside Malaysia, principally in the United States, as indicated in that list. Where the law requires a safeguard for such a transfer, we rely on the European Commission's Standard Contractual Clauses or an equivalent mechanism offered by that provider.

9. Automated Replies and AI Processing

Replies in our messaging services are drafted by an automated system. The text of a guest message is sent to a language-model provider, as listed in section 7, to produce that draft. Staff can take over any conversation at any time, and topics such as complaints, urgent situations and payment matters are routed to a person by design rather than answered automatically.

We do not use automated processing to make decisions that produce legal effects or similarly significant effects. A guest can ask to speak to a person at any point by saying so in the conversation.

10. Data Received Through Meta Platforms

Where we receive data through WhatsApp, Facebook Messenger or Instagram, we use it only to operate the messaging service described in this policy. We do not sell it, transfer it to a data broker, or use it to build profiles for advertising or to enrich other datasets. Our handling of that data is subject to Meta's Platform Terms and Developer Policies in addition to this policy.

11. Your Rights

Under the PDPA, you have the right to:

• •Access your personal data held by us
• •Request correction of inaccurate or incomplete data
• •Request deletion of your data (where permitted)
• •Opt-out of marketing communications
• •Lodge a complaint with the Personal Data Protection Commissioner

To exercise these rights, please contact us at contact@stcompholdings.com.

12. Cookies and Tracking

Our website may use cookies and similar tracking technologies to enhance your experience, analyze usage patterns, and serve personalized content. You may disable cookies through your browser settings, though this may affect functionality.

13. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for their privacy practices. We recommend reviewing their privacy policies before providing any personal information.

14. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be posted on this page with an updated effective date. Your continued use of our website constitutes acceptance of the revised policy.

15. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us at: