Anyara Privacy Policy

This Privacy Policy explains how we collect, use, share and protect personal information when you use the Anyara mobile applications, namely the Resident App and the Guard App (together, the “Apps”).

The Apps are operated by Goldhill Fortune Sdn Bhd (Company No. 0931812-H), with its registered office at Level 5, Tower 1, Avenue 3, The Horizon, Bangsar South, No. 8, Jalan Kerinchi, 59200 Kuala Lumpur (referred to in this Policy as “Goldhill”, “we” or “us”).

The Apps are developed and maintained on our behalf by our technology service provider, Global Line Network Sdn Bhd. This Policy is issued in accordance with the Personal Data Protection Act 2010 (the “PDPA”).

By installing and using the Apps, you confirm that you have read and understood it.

1. Who is responsible for your information

The Apps are deployed at residential properties under contract with the Joint Management Body, Management Corporation, or property manager of each property (each a “Property Operator”).

The Property Operator determines how the Apps are used at its property and is the party primarily responsible for resident, guard and visitor information under the PDPA. Goldhill provides and operates the platform on the Property Operator’s behalf.

Questions about how a particular property is managed should be directed to your Property Operator. Questions about the Apps, or about this Policy, should be directed to Goldhill using the contact details at the end.

2. Information we collect

The information we collect depends on which App you use and how you interact with it.

Resident App. We collect:

• your name, unit or parcel address, mobile number, email address and identification number;
• your profile photograph, if you choose to upload one;
• vehicle and household details that you provide;
• details of guests and visitors you register, including their name, mobile number, vehicle details and visit information;
• feedback, service requests, photographs and other content you submit;
• device and technical information such as your device model, operating system, app version, IP address and crash diagnostics; and
• records of how you use the App, including login history and access timestamps.

Guard App. We collect:

• your name, employee or guard identification number, mobile number, employer and deployment site;
• your profile photograph;
• operational records, including shifts, patrol logs, visitor QR scans, incident reports, and time-stamped check-in and check-out records; and
• device, technical and usage information, as described above.

What we do not collect

Neither App collects location or GPS data from your device. Neither App uses biometric authentication such as face recognition or fingerprint scanning, and we do not otherwise collect sensitive personal data through the Apps.

3. Information about other people

When you register a guest, contractor or other visitor through the Resident App, you provide personal information about another individual. You must ensure that they have consented to your disclosure of their information to us and to your Property Operator, and that they are aware of how it will be used.

We use guest and visitor information only for access control, security and record-keeping.

4. How we use your information

We use personal information for the following purposes:

• to create and administer your account, and to verify your residency or guard appointment;
• to provide the services available through the Apps, including guest registration, visitor management, feedback submission, emergency SOS alerts, patrol logs, and incident management;
• to communicate with you about your property, your account, or the Apps;
• to investigate incidents and complaints, conduct security audits, and meet record-keeping obligations;
• to maintain, secure and improve the Apps, including diagnosing technical issues and preventing fraud or misuse; and
• to comply with our legal, regulatory, tax and audit obligations.

Our legal basis for processing your information is your consent (provided when you register and use the Apps), the necessity of the processing for the services we provide to you, our legal obligations, and, in emergencies, the protection of vital interests.

5. Who we share your information with

We share personal information only with parties that need it in order to provide the service:

• your Property Operator and its authorised personnel;
• security service providers engaged by your Property Operator;
• Global Line Network Sdn Bhd, our technology service provider, which develops and maintains the Apps under a written agreement with us;
• DigitalOcean, LLC, our cloud infrastructure provider, which hosts the platform on our behalf;
• other service providers that support our operations, including push notification, email and SMS gateways, crash and performance monitoring providers, and our professional advisers, in each case under contracts that protect your information;
• law enforcement authorities, courts and regulators, where disclosure is required by law or is reasonably necessary to investigate or respond to security incidents; and
• a successor entity in the event of a merger, acquisition, or sale of all or part of our business, subject to confidentiality protections and the continued application of a privacy policy materially equivalent to this one.

We do not sell personal information, and we do not share it with third parties for their own marketing purposes.

6. Where your information is stored

The Apps are hosted on cloud infrastructure operated by DigitalOcean, LLC in its Singapore data centre. DigitalOcean is an established international cloud infrastructure provider holding ISO/IEC 27001 and SOC 2 Type II certifications.

As a result, personal information collected through the Apps is stored and processed in Singapore. This cross-border transfer is carried out in accordance with section 129 of the PDPA and the related Cross-Border Personal Data Transfer Guidelines issued by the Personal Data Protection Commissioner.

Singapore has in force the Personal Data Protection Act 2012, which we consider to provide a level of protection at least equivalent to that under the Malaysian PDPA, and DigitalOcean processes personal information under written contractual safeguards with us. We maintain a record of our cross-border transfers as required by the Commissioner.

7. How long we keep your information

We retain personal information only for as long as is necessary for the purposes for which it was collected, and to meet any applicable legal, regulatory or audit requirements.

Indicative retention periods are as follows:

• account information — for the duration of your active use of the App and for up to 24 months after your account is deactivated or your residency or guard appointment ends;
• visitor and guest records — 12 months from the date of the visit;
• incident reports and SOS event records — 7 years, given their potential evidentiary value;
• feedback and communications — 24 months from resolution;
• technical and audit logs — up to 12 months; and
• financial and corporate records — seven years, in accordance with applicable tax and company law in Malaysia.

Once the applicable retention period has expired, personal information is securely deleted or irreversibly anonymised.

8. How we protect your information

We take the security of personal information seriously and, together with our service providers, apply technical and organisational measures designed to protect it against unauthorised access, loss, alteration or disclosure.

These measures include:

• encryption of personal information in transit and, where appropriate, at rest;
• role-based access controls and the principle of least privilege;
• multi-factor authentication for administrative access to our systems;
• logging and monitoring of access to personal information;
• contractual security obligations on our service providers and sub-processors; and
• periodic review of our information security practices.

No system can be made completely secure. While we apply current industry-standard measures, we cannot guarantee absolute security. We ask that you also take reasonable steps to protect your account, including by safeguarding your login credentials and device.

9. Personal data breach

In the event of a personal data breach that is likely to result in significant harm to data subjects, we will notify the Personal Data Protection Commissioner within the prescribed timeframe and, where required, the affected individuals.

Where we are acting on behalf of a Property Operator, we will also notify the Property Operator without undue delay so that it can comply with its own notification obligations.

10. Your rights

Subject to the conditions in the PDPA, you have the right to:

• request access to the personal information we hold about you;
• request correction of any information that is inaccurate, incomplete or out of date;
• withdraw your consent to our processing of your information;
• require us to stop processing your information where it is causing damage or distress;
• require us to stop using your information for direct marketing;
• request that your information be transmitted to another data controller, where technically feasible; and
• lodge a complaint with the Personal Data Protection Commissioner.

To exercise any of these rights, please contact us using the details at the end of this Policy. We may need to verify your identity before responding. Where your request relates to data for which a Property Operator is responsible, we will work with the Property Operator to respond.

11. Children

The Apps are intended for adults. Where personal information of a minor is required to be processed — for example, where you register a household member who is a minor, or in the context of an emergency — we rely on the consent of the parent or legal guardian, and process such information only to the extent necessary for the stated purpose.

12. Changes to this Policy

We may update this Policy from time to time to reflect changes in our practices, technologies or legal requirements. The current version will always be available in the Apps.

Where the change is material, we will provide additional notice, for example by in-app notification or email. Your continued use of the Apps after the effective date of any updated Policy constitutes your acceptance of the changes.

13. How to contact us

For any questions, requests relating to your rights, or complaints regarding this Policy or our handling of your personal information, please contact us at: