← Back

Privacy Policy

Last updated: 27 September 2026

This Privacy Policy explains how MSD Holdings Sdn Bhd (“we”, “us”, “our”), the owner and operator of the PropXpert platform (propxpert.my), collects, uses, discloses, and protects personal data in connection with this website and our WhatsApp service, in accordance with the Personal Data Protection Act 2010 (“PDPA”) of Malaysia.

1. Who We Are

MSD Holdings Sdn Bhd (Registration No. 202601009873 (1671971-M)) owns and operates the PropXpert platform, including this website and the WhatsApp AI assistant (“Siti Sarah”). Real estate services referenced on this platform are provided by Mohd Shah Dolah, a registered real estate agent (E3225) under Landsworth Properties Sdn Bhd (E(1)1959).

2. What Personal Data We Collect

We collect personal data directly from you, primarily through WhatsApp conversations with our AI assistant, Siti Sarah, and through this website. Depending on how you interact with us, this may include:

• Basic contact details: your name, phone number, and email address (email is only requested with your explicit permission).
• Property preferences: budget, area of interest, timeline, and the type of property you’re looking for.
• Viewing pre-qualification details (for prospective buyers or tenants), collected only after you agree to share it: age, marital status, citizenship, employment/income information, existing financial commitments, and (for buyers) EPF Account 2 balances relevant to a property purchase. Any figures we calculate from this information, such as estimated loan eligibility, are estimates only and subject to approval by the relevant financial institution.
• Property listing details (for owners/landlords), collected only after you agree to share it: property address, specifications, title documents, and photographs.
• Conversation history with Siti Sarah, kept so she can maintain context across your conversation and so Mohd Shah can follow up personally.
• Website usage data: standard technical information such as IP address and browser type, collected automatically as part of normal website operation.

3. How We Use Your Personal Data

We use your personal data to:

• Respond to your enquiries and arrange property viewings;
• Assess indicative loan or rental eligibility (estimates only – final decisions rest with the relevant financial institution or, for tax matters, the Inland Revenue Board of Malaysia);
• Prepare price recommendations based on transacted market data;
• Follow up on your enquiry and keep you informed;
• Maintain accurate records of our dealings with you; and
• Comply with our legal and regulatory obligations as a licensed real estate practice.

4. Who We Share Your Data With

We do not sell your personal data. We share personal data only as necessary with:

• Service providers who process data on our behalf to operate this platform, including Anthropic (which powers Siti Sarah’s WhatsApp conversations), OpenAI (voice message transcription), Meta Platforms (WhatsApp messaging infrastructure, and advertising measurement where your enquiry began from one of our advertisements — see section 5), Resend (email delivery for internal notifications), and Elfsight (displaying Google Reviews on this website). These providers are based outside Malaysia and process data as part of delivering their service to us.
• Co-operating real estate agents, where relevant to a transaction – in such cases we share property information only, never an owner’s personal or contact details, consistent with standard co-agency practice.
• Authorities or regulators, where required by law.

5. Advertising on Facebook and Instagram

We advertise on Facebook and Instagram to reach property owners in specific areas of Kuala Lumpur. Some of those advertisements open a WhatsApp conversation directly (“Click to WhatsApp”). If you reached us that way, two things follow:

• We are told which advertisement you clicked. Meta attaches this to the first message of the conversation and to no later message: the advertisement’s identifier and headline, and a click identifier generated by Meta. We keep it so that an enquiry can be traced back to the advertisement that produced it.
• We tell Meta that the click led somewhere. Using that click identifier, we report back to Meta when an enquiry turns out to be a genuine property enquiry, and again if it results in a property being listed with us. This is how we judge which advertisements are worth paying for, and how Meta decides who to show them to.

What those reports do not contain: they carry Meta’s own click identifier, the type of event, the date and time, and — for a completed listing — an indicative commission value. They do not carry your name, your phone number, anything you wrote to us, your property address, or any document or photograph you sent us.

If you would rather we did not keep the link between your enquiry and the advertisement, tell us and we will remove it. You can also control how Meta itself uses advertising data in your own Facebook or Instagram settings.

6. Cookies and Third-Party Content

This website uses Google Fonts, which loads font files directly from Google’s servers. It also displays a Google Reviews widget via Elfsight, a third-party service that may set its own cookies as part of displaying that content. We do not control the cookie practices of these third-party services; please refer to their own privacy policies for details.

7. Data Retention

We retain personal data for as long as necessary to fulfil the purposes described in this policy, or as required by applicable law. If you would like your data reviewed or removed, please contact us using the details below.

8. Your Rights Under the PDPA

Under the Personal Data Protection Act 2010, you have the right to:

• Access the personal data we hold about you;
• Correct personal data that is inaccurate, incomplete, or outdated;
• Withdraw consent to our processing of your personal data;
• Object to your data being used for direct marketing.

We will respond to access requests within 21 days, as required by the PDPA. If you believe your personal data has been misused, you may also lodge a complaint with Malaysia’s Department of Personal Data Protection (Jabatan Perlindungan Data Peribadi).

9. Security

We apply reasonable technical and organisational measures to protect the personal data we hold, including restricted access and secure hosting. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Contact Us

For any questions about this Privacy Policy or to exercise your rights under the PDPA, please contact us via WhatsApp at +6012-2410366.

11. Changes to This Policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top of this page reflects the most recent revision.