Privacy Policy – Marigig

1. Who We Are and Scope

This Privacy Policy applies to all users of the Marigig Platform, including:

• Members / Buyers who browse services, contact sellers, or save posts.
• Sellers (freelancers, self-employed, businesses) who create profiles, subscribe to plans, and publish posts.
• Visitors who access our websites or interact with our marketing pages.

By using the Platform, you agree to the practices described in this Privacy Policy, in addition to our Terms of Use.

2. Information We Collect

We collect the following categories of information:

3. How We Use Your Information

We use your data to:

1. Verify your identity and secure your account (Email OTP for all users, SMS OTP + IC verification for sellers).
2. Create, operate and personalise your account and seller profile.
3. Publish and display seller information (such as services, ads, photos, videos and reviews) to potential buyers.
4. Facilitate communication between buyers and sellers, including phone-reveal and "Call/WhatsApp" interactions.
5. Administer subscriptions, trials, renewals and billing; generate invoices and payment records; and detect chargeback abuse.
6. Apply viewing and contact limits (for example, tiered phone-reveal rules) to prevent abuse and protect sellers.
7. Improve Platform performance, user experience, relevance of listings and search quality.
8. Monitor for fraud, scams, bots and misuse of the Platform, and enforce our Terms of Use.
9. Send important service messages (e.g. security alerts, changes to Terms or Privacy Policy) and, where permitted, marketing messages.
10. Comply with legal obligations and cooperate with regulators or law enforcement where required.

4. Legal Basis and Consent

Where required by applicable law (including the Personal Data Protection Act), we rely on one or more of the following legal bases to process your personal data:

• Consent – for example, when you agree to create an account, upgrade to a seller plan, accept cookies, or opt in to marketing communications.
• Contractual necessity – to provide the services you request, such as managing your account, subscription, and access to seller features.
• Legitimate interests – such as improving the Platform, protecting users from fraud and abuse, enforcing our Terms, analysing usage, and developing new features, in a way that does not unfairly impact your rights.
• Legal obligations – to comply with applicable laws, regulations or lawful requests (for example, keeping certain records for audit, tax, or law-enforcement purposes).

5. What Information is Public

6. Data Sharing and Third Parties

We do not sell your personal information. We may share your information only with:

• Service providers who help us operate the Platform, such as:
  • Cloud hosting and infrastructure providers
  • Email and SMS OTP providers
  • Payment processors and payment gateways
  • Analytics, anti-fraud, and security vendors
  • Moderation and AI-based content analysis services, where used
• Business partners where we integrate or co-offer products or services (for example, payment or verification partners), in which case we will clearly describe the arrangement where required.
• Legal and regulatory authorities when required by law, court order, or to protect our users, our rights, or the rights of others.
• Corporate transactions, such as a merger, acquisition, financing or sale of all or part of our business, where your data may be transferred as part of that transaction, subject to appropriate safeguards.

Where we transfer personal data outside of Malaysia, we take steps to ensure that an adequate level of protection is provided in accordance with applicable law.

7. Data Retention & Deletion

• We retain your personal data only for as long as necessary to provide the Platform, operate our business, and meet legal, accounting or reporting requirements.
• Account and profile data are generally kept while your account is active. If you request deletion, we will remove or anonymise your personal data, except where we are required or permitted to keep certain information (for example, for fraud prevention, dispute resolution or legal obligations). For step-by-step instructions, see our User Data Deletion page.
• Seller advertisements, reviews and public posts may remain visible or stored in backup systems for a reasonable period, even after account closure, unless removal is required by law or technically feasible.
• Logs and security records (such as device, IP and phone-reveal logs) may be retained for a period necessary to investigate abuse, enforce our Terms, and comply with law.

8. Security Measures

• OTP verification for account security (Email OTP for all users, SMS OTP + IC verification for sellers).
• Use of industry-standard security practices to protect data in transit and at rest, including encryption for sensitive information where appropriate.
• Access controls to ensure only authorised staff and service providers can access personal data where necessary.
• Monitoring and logging to help detect suspicious activity, abuse or security incidents.

However, no method of transmission over the internet or electronic storage is completely secure. While we strive to protect your personal data, we cannot guarantee absolute security.

9. Your Rights and Choices

As a Marigig user, and subject to applicable law, you have the right to:

• Access the personal information we hold about you.
• Update or correct inaccurate or incomplete personal information via your account settings or by contacting us.
• Request deletion of your account and personal data, subject to our legal obligations and legitimate interests as explained above. See our User Data Deletion page for how to submit a request.
• Withdraw consent for certain processing where we rely on consent (for example, marketing communications), without affecting the lawfulness of processing based on consent before its withdrawal.
• Object to or request restriction of certain processing where permitted by law.
• Manage cookies and tracking technologies through your browser or device settings, and through any cookie banners or preferences we provide.
• Report misuse, scams or privacy concerns via our contact channels.

To exercise any of these rights, please contact us using the details in Section 12 below, or follow the process in Section 18. We may need to verify your identity before fulfilling your request.

10. Children

The Platform is intended for adults and business users. If you are under 18, you should only use the Platform with the consent and supervision of a parent or legal guardian. We do not knowingly collect personal data from children in violation of applicable law. If you believe a child has provided us with personal data without appropriate consent, please contact us and we will take appropriate steps.

11. Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. Any changes will be posted on this page with an updated "Last Updated" date. Where changes are material, we may also provide additional notice (for example, via email or an in-app banner).

12. Contact Us

13. PDPA Principles and Consent Management

14. Notice, Choice, and Mandatory Data

15. Disclosure Controls and Cross-Border Transfers

16. Data Retention Schedule

17. Data Accuracy and User Responsibilities

18. Access, Correction, and Deletion Request Process

19. Security Incident Response