This policy explains what personal data TukangMan handles, why, who sees it and what rights you have. Short version: we do not store homeowner requests, we store contractor applications to review them, and we do not track visitors.
1. Who We Are and What This Policy Covers
1.1This Privacy Policy explains how the owner and operator of the website tukangman.com and the TukangMan app ("TukangMan", "we", "us" or "our") collects, uses, discloses and protects personal data when you use the website tukangman.com, the TukangMan request app at tukangman.com/app (including any copy installed on your device), the contractor application form, and any communication with us on WhatsApp or email (together, the "Service").
1.2We process personal data in accordance with the Personal Data Protection Act 2010 of Malaysia, as amended (the "PDPA"). For the purposes of the PDPA, TukangMan is the "data user" of the personal data described in this Policy.
1.3This Policy is also the notice required by section 7 of the PDPA. A Bahasa Malaysia version is available at Notis Privasi. If the two versions differ, the English version prevails to the extent permitted by law.
1.4By using the Service, or by submitting a contractor application and ticking the consent box, you confirm that you have read this Policy. If you do not agree with it, please do not use the parts of the Service that collect personal data.
2. Personal Data We Process
2.1The personal data we process depends on how you use the Service:
- Homeowners and visitors: when you request a quotation, the details you type (such as your area, property type, work area, whether a lift is available, and your notes) are written in your browser and sent from your device to the contractor through WhatsApp. They are not transmitted to or stored on TukangMan servers.
- Everyone: our web host automatically records technical data when a page is requested, such as your IP address, browser and device type, the page requested and the date and time. We use it for security, troubleshooting and abuse prevention.
- Contractor applicants: business or trading name, contact person name, WhatsApp number, email address, region, services offered, years of experience, optional CIDB registration number, optional description of your business, the date and time you gave consent, a salted one-way hash derived from your connection (used only to limit abuse; we do not store your IP address in the application record), and our own review notes and decision.
- Listed contractors: the business name, WhatsApp number, region and services shown in the contractor list, and an approximate map location of the business that our team sets.
- People who contact us: if you message us on WhatsApp or email, we receive your phone number or email address, your name if shown, and the content of your message.
2.2We do not intentionally collect sensitive personal data (such as health, political opinions, religious beliefs or biometric data). Please do not include it in notes or messages.
2.3The Service is not directed at persons under 18 years of age. Please do not submit a contractor application or send us personal data if you are under 18.
3. How We Obtain Personal Data
3.1We obtain personal data directly from you (for example when you submit the contractor form or message us), automatically through our web host's logs, and, for contractor listings, from the application you submitted and from information our team adds when approving it.
4. Purposes of Processing
4.1We process personal data for these purposes:
- to operate the Service, including showing contractors to homeowners and opening WhatsApp so a homeowner can contact a contractor;
- to receive, review, approve, reject and manage contractor applications and listings, and to contact applicants and listed contractors;
- to respond to enquiries, complaints, data requests and feedback;
- to secure the Service, detect and prevent spam, fraud, scraping and other misuse, and to enforce our Terms and Conditions;
- to keep records, comply with law, respond to lawful requests and establish, exercise or defend legal claims; and
- to maintain and improve the Service, using aggregated or de-identified information where possible.
4.2We do not use personal data for direct marketing, we do not sell personal data, and we do not use it for automated decisions that significantly affect you.
5. Consent and Whether Supplying Data Is Obligatory
5.1Where we rely on consent, you give it by ticking the consent box on the contractor form or by contacting us. You may withdraw consent at any time as explained in clause 11, but withdrawal does not affect processing already carried out and may mean we can no longer keep your listing or application.
5.2The fields marked as required on the contractor form are obligatory: without them we cannot assess or list your business. The optional fields (such as CIDB number and description) are voluntary and failing to provide them will not affect your application. Using the homeowner request flow does not require you to give us any personal data.
5.3Where the PDPA permits, we may also process personal data without consent, for example where it is necessary to carry out steps you asked us to take, to comply with a legal obligation, or to establish or defend legal rights.
6. Disclosure to Third Parties
6.1We may disclose personal data to the following classes of persons, only as needed for the purposes in clause 4:
- Visitors to the Service and homeowners: the business name, WhatsApp number, region and services of an approved contractor are published in the contractor list. By applying and consenting, you agree to this.
- Contractors: when a homeowner chooses to send a request, the message goes from the homeowner to the contractor via WhatsApp. TukangMan is not a party to that message.
- Service providers: our web hosting and infrastructure provider; Google (email delivery and administration tools used by our team); Meta Platforms (WhatsApp); Cloudflare (delivery of an icon library to the app); and HERE Technologies (map tools used by our administrators). These providers process data under their own terms and privacy policies.
- Professional advisers such as lawyers, auditors and insurers, who are bound by duties of confidentiality.
- Regulators, courts, law-enforcement and other authorities where we are required or permitted by law, or to protect our rights, users or the public.
- A successor to our business if the Service or its operator is merged, sold or reorganised, who will be bound to protect personal data under this Policy.
6.2Contractors who receive a homeowner's message become responsible for how they handle the information in it. TukangMan does not control, and is not responsible for, what contractors or other third parties do with personal data after receiving it.
7. Transfers Outside Malaysia
7.1Some of the providers named in clause 6, including Meta Platforms, Google and Cloudflare, operate servers outside Malaysia, so personal data may be processed or stored outside Malaysia. WhatsApp messages you choose to send are handled by Meta under its own terms.
7.2Where we transfer personal data outside Malaysia ourselves, we do so only where the PDPA permits, for example with your consent, where it is necessary for a contract with you or at your request, or where we have taken reasonable steps to ensure the recipient protects the data to a standard comparable to the PDPA. By submitting the contractor form you consent to such transfers.
8. Cookies, Local Storage and Tracking
8.1The public pages of tukangman.com and the request app do not set cookies, do not use browser local storage for tracking, and do not use advertising, analytics or fingerprinting tools.
8.2The administrator area, which only our team can use, sets one strictly necessary session cookie (named tm_admin, HttpOnly and secure) to keep an administrator signed in.
8.3Fonts and the application are served from our own site. The request app loads an icon library from Cloudflare (cdnjs.cloudflare.com), which can see your IP address and browser details when it serves that file.
9. Security
9.1We take practical steps to protect personal data against loss, misuse, unauthorised access, modification or disclosure. These include encrypted connections (HTTPS with HSTS), a restrictive content security policy, access controls and hashed passwords for administrators, protection against cross-site request forgery, parameterised database queries, rate limiting and bot checks on the contractor form, restricted server permissions and backups.
9.2No system is completely secure. If a personal data breach occurs that is likely to cause significant harm, we will notify the Personal Data Protection Commissioner and affected individuals as and when the PDPA requires.
10. Retention
10.1We keep personal data only for as long as needed for the purposes in clause 4 or as required by law.
- Contractor applications that are rejected or withdrawn: we aim to delete them within twelve (12) months of the decision.
- Approved contractor listings: while the listing is active, and afterwards for up to six (6) years so that we can deal with complaints, disputes and legal claims, unless you ask us to delete earlier and we have no legal reason to keep it.
- Server logs: for a limited period set by our hosting provider, normally a few weeks.
- Messages to us: for as long as needed to resolve your enquiry and to keep a reasonable record of it.
10.2When personal data is no longer needed we delete or anonymise it.
11. Your Rights and How to Exercise Them
11.1Subject to the PDPA, you have the right to:
- request access to the personal data we hold about you (section 30);
- request correction of personal data that is inaccurate, incomplete, misleading or out of date (section 34);
- withdraw your consent to our processing of your personal data (section 38);
- ask us to stop, or not begin, processing that is causing or likely to cause you substantial damage or distress (section 42);
- ask us not to use your personal data for direct marketing (section 43); and
- where the PDPA provides for it, ask us to transmit your personal data to another data user of your choice (data portability).
11.2To exercise a right, contact us using the details in clause 15. We may ask you to prove your identity before we act, so that we do not disclose or change data for the wrong person. We will respond within the period the PDPA requires, which is 21 days for a data access request, and may charge the fee the PDPA allows. We may refuse a request in the circumstances the PDPA permits and will tell you why.
11.3If you are a listed contractor and want your listing changed or removed, message us on WhatsApp with your business name and application reference.
12. Links and Third-Party Services
12.1The Service links to other websites and opens WhatsApp. We do not control those services and are not responsible for their privacy practices. Please read their policies.
13. Contractors' Own Responsibilities
13.1Contractors who receive homeowner personal data through the Service must handle it lawfully, use it only to respond to the homeowner's request, keep it secure, and comply with the PDPA as an independent data user. See also the contractor terms in our Terms and Conditions.
14. Changes to This Policy
14.1We may update this Policy from time to time. The "Last updated" date and version appear at the top of this page. If a change is significant we will highlight it on this page. Your continued use of the Service after a change means you accept the updated Policy, except where the law requires fresh consent.
15. Contact and Complaints
15.1For questions, requests or complaints about personal data, contact our personal data contact person through WhatsApp or the Contact page. Please include enough detail for us to identify you and your request.
15.2If you are not satisfied with our response, you may complain to the Personal Data Protection Commissioner of Malaysia (Jabatan Perlindungan Data Peribadi).
16. Related Documents
16.1Please also read our Terms and Conditions, End User License Agreement and Disclaimer, which form part of the agreement between you and TukangMan.