Privacy policy

Gathiqo is operated by GATHIQO TECH SOLUTIONS (Registration No. 202603188859 (PG0590667-D)). We are the data user responsible for your personal data under the Personal Data Protection Act 2010 (PDPA). Contact us at privacy@gathiqo.com.

This notice is issued in English and Bahasa Melayu as required by section 7(3) of the PDPA. If the two versions differ, the English version prevails.

• Account data: your email address, the name you ask us to call you, your role (customer or vendor), and, if you add them in settings, your phone number and language preference.
• Sign-in: you sign in with a one-time code we email to you. Gathiqo has no passwords, so we never store one.
• Booking requests: event type and date, guest count, venue, notes, the package you chose and the request's status history.
• Messages: your in-app conversations with vendors or customers. Phone numbers and email addresses are automatically removed from messages, venues and notes before they are saved.
• Reviews: reviews you post are public and shown with your display name.
• Vendor verification (KYC): full name, IC (MyKad) or passport number, contact number, social media links or website, and either SSM registration details and certificate, or a photo of the IC and a recent bank statement with bank account details. See Security for how these are protected.
• Agreement records: which version of our Terms of Service, Privacy Policy and (for vendors) Vendor Agreement you accepted, and when.
• Location: if you choose ‘Near me’, your browser shares your approximate location with us once to find the nearest city and nearby vendors. We don't store it, though it appears in that search's page address.
• Technical data: your IP address, used briefly to limit abuse (for example, too many code requests), plus anonymous page-view and performance data and error reports (see Analytics and error monitoring).

Mostly from you, when you create an account, send a booking request, message someone or verify your business. Some comes from the other side of a booking (for example the event details a customer sends a vendor, or a vendor's reply), and for vendor checks we may compare what you give us with public registers such as SSM.

• Required for everyone: your email address and a name, to create an account and sign in.
• Required for vendors to go live: full name, IC or passport number, contact number, at least one social link or website, at least one package with a price, and either your SSM certificate or a photo of your IC and a recent bank statement.
• Optional: your phone number in settings, language and marketing preferences, and a photo of your IC when you verify with SSM.
• If you do not give us required data, we cannot open your account or publish your listing. Optional data only changes what we can personalise.

A photo of a MyKad can show the holder's religion, which is sensitive personal data under the PDPA. We ask for your explicit consent before you upload an IC photo, use it only to confirm your identity, never show it to customers, and do not use it for automated face matching.

• To run the marketplace: showing vendors, sending booking requests to vendors and letting both sides message each other.
• To sign you in and keep your account secure.
• To check every vendor before their listing goes live, award the Verified badge, and prevent fraud and abuse.
• To help resolve disagreements and complaints, using the booking and message history.
• To meet legal duties, such as keeping marketplace records required by consumer-protection law.
• To send service emails: sign-in codes, booking updates and account notices.
• To find and fix bugs and keep the site fast.

A booking on Gathiqo is a request that the vendor confirms. Gathiqo does not process, hold or refund payments today: any deposit or payment is arranged directly between you and the vendor, so we never receive your card or bank details as a customer. Secure in-app payments are coming soon; we will update this policy, including the payment provider we use, before they launch.

• The other side of a booking: when you send a booking request, the vendor sees your display name and the event details. Customers see a vendor's public business profile. Neither side sees the other's email address or phone number through Gathiqo.
• Service providers who run Gathiqo for us, only for that purpose:
  • Cloud hosting and database providers: running the website, signing you in, and storing your account data, messages and files.
  • An email delivery provider: sending sign-in codes, booking updates and account emails.
  • Analytics and error-monitoring providers: cookieless page-view and speed measurement, and error reports with personal details removed.
• Authorities, when Malaysian law requires it.

Some of these providers store or process data outside Malaysia. We transfer data abroad only with the safeguards section 129 of the PDPA allows, such as contractual data-protection commitments with each provider. You can ask us for the current list of providers and the countries they use at privacy@gathiqo.com. We do not sell your personal data, and we do not share it with advertisers.

• Analytics: we count page views and measure page speed without cookies and without building a profile of you across sites.
• Error monitoring: we receive a report when something breaks. We switch off the collection of IP addresses and cookies, never record your screen, and strip email addresses, phone numbers, IC numbers and account numbers from every report before it leaves your browser or our servers.

We only use first-party cookies that keep you signed in. Your light or dark theme choice and your compare shortlist are saved in your browser's local storage. We do not use advertising or cross-site tracking cookies.

• All traffic is encrypted over HTTPS.
• Sign-in uses single-use email codes that expire, so there are no passwords to leak.
• Database access is restricted per account by row-level security rules.
• Vendor verification documents (SSM certificates, IC photos and bank statements) are kept in private storage that only the vendor who uploaded them and Gathiqo’s review team can open. Vendors' contact details and social links are never shown to customers.
• Sensitive identifiers (IC number, bank account number and phone number) are encrypted at the application level with AES-256-GCM before they are stored. Admins see masked values, and every time an admin reveals a full value it is recorded in an audit log.

• Account data is kept while your account is open.
• When you ask us to delete your account, we delete or anonymise your personal data, except booking and message records we need to keep to resolve open disagreements or meet a legal obligation. Those are kept only as long as that need lasts.
• Vendors' identity and business details (name, address, contact number, email, IC or passport number, business registration and bank account numbers) and booking records are kept for 3 years, as the Consumer Protection (Electronic Trade Transaction) Regulations 2024 require, then deleted. Images of IC cards and bank statements are deleted within 90 days after a vendor account closes.
• Records that relate to an open claim or dispute are kept until it is resolved.
• Error reports are kept for up to 90 days. Analytics are kept only as aggregated, anonymous statistics.

Under Malaysia's Personal Data Protection Act 2010 you can:

• ask for a copy of the personal data we hold about you;
• ask us to correct data that is inaccurate, incomplete or out of date;
• withdraw your consent, or ask us to stop or limit processing, including closing your account;
• ask us to send your personal data to another organisation, where that is technically feasible;
• opt out of marketing emails at any time.

You can change your name and contact details yourself in account settings. For anything else, email privacy@gathiqo.com from the address on your account. We reply within 21 days. Withdrawing consent may mean we can no longer provide parts of the service, such as keeping your account open.

If a personal data breach happens, we notify the Personal Data Protection Commissioner and, where it is likely to cause you significant harm, we tell you directly, within the time the law requires, along with what we are doing about it and what you can do.

Gathiqo is for people aged 18 and over. We do not knowingly collect data from children.

If we change how we use your data, we will update this page and the date at the top. For significant changes, such as launching in-app payments, we will also tell you by email or in the app before the change applies.

Privacy and personal-data requests: privacy@gathiqo.com. Anything else: support@gathiqo.com.