Legal

Privacy Policy

Last updated 19 September 2026

This policy explains what personal data Lanthorn Properties Sdn Bhd (“we”) collects through Lanthorn Properties CRM, why we hold it, how long we keep it, and how you can ask us to change or delete it. It is written to meet the Malaysian Personal Data Protection Act 2010 (PDPA) and Meta Platform Terms.

Who this covers

Two different groups of people, with different data and different rights:

• Enquirers — people who submit a Facebook or Instagram lead form, a website enquiry, or who give their details to one of our negotiators. We hold your enquiry so a negotiator can respond to it.
• Negotiators and staff — people with a login to the CRM. We hold an account record so the system knows who did what.

What we collect about enquirers

Only what the enquiry itself carries, plus what a negotiator records afterwards:

• Name, phone number and, where given, email address.
• What you are looking for: buying, renting, selling or investing; budget range; preferred areas.
• Where the enquiry came from — the ad campaign, ad set and form name, so we know which advertising works. This is campaign metadata, not tracking of your browsing.
• Notes, call outcomes and appointment records a negotiator adds while following up with you.
• Documents you provide during a transaction, such as identification or loan paperwork, where a sale proceeds.

We do not buy contact lists, and we do not place advertising cookies on this CRM. The CRM is an internal tool; it has no public sign-up and no visitor tracking.

Facebook and Instagram lead forms

When one of our negotiators connects their Facebook account, they choose which Pages send leads to the CRM. We then receive, for each lead form submission, the answers that person gave on the form. We request only the permissions needed to do that: to list the Pages the person manages, to read those Pages’ lead forms, and to retrieve the leads those forms produce.

A negotiator may also switch on an automatic reply for comments on their own Page’s posts. Where it is on, and someone comments on one of those posts, the CRM reads that comment and replies once with a link to the property details — as a Messenger message from the Page to the person who commented, or, if that message cannot be delivered, as a public reply under the comment itself. We store the comment’s identifier and the commenter’s public name so the same person is not replied to twice. We do not read a Page’s existing message threads, and we send nothing to anyone who has not commented first.

We store an encrypted access token for each connected Page so leads can arrive automatically. We do not access a negotiator’s personal Facebook profile, friends or photos. A negotiator can disconnect at any time from the CRM, or by removing the app in their Facebook settings — either action deletes the stored tokens and stops all automatic replies.

Why we hold it, and on what basis

To respond to your enquiry, arrange viewings or appointments, carry a transaction through to completion, and meet our record-keeping obligations as a registered estate agency. For enquirers, consent is recorded at the point of capture — Meta lead forms include a consent question, and our own forms carry a PDPA notice.

Who we share it with

We do not sell personal data. It is shared only where a transaction requires it, and only to the extent required:

• The negotiator handling your enquiry, their team leader, and the agency administrator.
• A property developer, where you have asked us to book or register interest in one of their units, because the booking cannot be made without your details.
• Professional parties in a transaction you are part of — solicitors, bankers, valuers.
• Service providers who run the systems we use, under contract: our cloud hosting and database provider, our authentication provider, and Meta for lead delivery.

How long we keep it

Enquiries that do not lead anywhere are retained for as long as they remain commercially relevant and then removed. Records connected to a completed transaction are kept for seven years, which is the retention period Malaysian tax and estate agency record-keeping requires. Deleted records are removed from all views in the CRM immediately and purged from backups on the backup rotation.

Your rights

Under the PDPA you may ask us to:

• Tell you what personal data we hold about you.
• Correct anything that is wrong or out of date.
• Stop contacting you — we will mark the record so no negotiator calls again.
• Delete your data, where we are not required to keep it for the reasons above.

Write to lanthornrealty@gmail.com and we will respond within 21 days. Please tell us the phone number you gave us, so we can find the right record.

Deleting Facebook data

If you are a negotiator and want the Facebook connection removed, disconnect it in the CRM, or remove Lanthorn Properties CRM from Settings → Apps and Websites in your Facebook account. Facebook then notifies us and we delete the stored account, its Pages and its access tokens.

Removing that connection does not delete enquiries already received. Those are the agency’s own records about other people, held under the retention rules above; an enquirer who wants their own data erased should contact us at the address above.

Security

Access to the CRM requires an individual account, and each negotiator sees only their own leads unless they are a team leader or administrator. Data is encrypted in transit and at rest, Facebook access tokens are encrypted separately, and administrative actions are logged.

Where your data is stored

Lanthorn Properties CRM runs on cloud infrastructure located outside Malaysia. The CRM database is hosted in Singapore, login and account authentication is handled by a provider hosted in the United States, and the application itself and its uploaded documents are served from a global content network. This means personal data described in this policy is transferred outside Malaysia and stored there.

We make those transfers on the basis permitted by the PDPA: each provider is engaged under a written contract that requires it to process the data only on our instructions, to keep it secure, and to apply protection substantially similar to that required in Malaysia. We remain responsible for your data wherever it is held, and the rights set out above apply to it in full. By giving us your details you are notified of, and consent to, this transfer.

Changes

If this policy changes we will update the date at the top of this page. Material changes affecting how we use existing data will be notified directly where we hold a contact address for you.

Contact

Lanthorn Properties Sdn Bhd — lanthornrealty@gmail.com