This Privacy Policy explains how [Your registered business name or full name] (“NatCamp”, “we”, “us”) collects, uses, discloses and protects your personal data when you use the NatCamp website and application (the “Platform”). We process personal data in accordance with the Malaysian Personal Data Protection Act 2010 (“PDPA”)and its amendments. Where we serve users in the EU/EEA, the EU General Data Protection Regulation (GDPR) may also apply.
1. Who we are (Data User)
Data User: [Your registered business name or full name] (Reg. [Business/Company registration no., if any]), [Your business address]. Privacy contact / Data Protection Officer: [Data Protection Officer name, if appointed]: admin@natcamp.com.
2. Personal data we collect
- Account data: name, email, phone number, password (stored only as a secure hash), role (guest/host), and (for hosts) profile bio and photo.
- Booking data: guest name, phone, email, stay dates, number of guests, notes, booking and payment status.
- Listing data (hosts): property details, location, pricing, photos and availability.
- Messages: chat content between guests and hosts (and, if enabled, WhatsApp messages synced to your conversation), member-to-member direct messages, and group chat messages. Messages are stored on our systems and are not end-to-end encrypted.
- Community content: diary posts, photos, comments, likes, saves and your public profile (display name, @handle, bio, avatar, cover).
- Groups & social connections: groups you create or join, your role in them, join requests, group posts, and your follower/following relationships.
- Reviews: ratings and review text after a stay.
- Technical data: limited cookies/local storage needed to keep you logged in and remember consent (see section 9).
Providing personal data is voluntary, but some data is necessary to create an account, make or manage a booking; without it we cannot provide those features.
3. Purposes of processing (Notice & Choice)
- To create and manage your account and authenticate you.
- To process, confirm and manage bookings between guests and hosts.
- To enable messaging, reviews and community/social features (profiles, the feed, groups, direct and group messages, following).
- To keep the community safe — to moderate content, handle reports, and detect and prevent abuse, harassment and unlawful content.
- To send service communications (e.g. verification, booking and message notifications).
- To operate, secure, and improve the Platform and prevent fraud or abuse.
- To comply with legal obligations.
4. Legal basis & consent
We rely on your consent (given when you register, book, or submit content), and on the necessity of processing to perform our contract with you and to comply with the law. You may withdraw consent at any time (section 8), though this may limit your ability to use the Platform.
5. Disclosure of personal data
We do not sell your personal data. We disclose it only as needed:
- To hosts: when you book or message, the relevant host receives your booking and contact details to fulfil the stay.
- To other users: content you choose to share is visible to its intended audience — your public profile and feed posts are public; a direct message is visible to its recipient; group posts and group chat are visible to that group's members; and your @handle and profile may appear where you post, comment, follow or join.
- To service providers (data processors): hosting (Render), payments (Stripe and, where applicable, Malaysian gateways such as ToyyibPay/Billplz), email delivery (Resend), image hosting (Cloudinary), and WhatsApp messaging (Meta Platforms) where you use that feature.
- For legal reasons: to comply with law, court orders, or to protect rights, safety and security.
6. Cross-border data transfer
NatCamp is operated from outside Malaysia and some service providers store or process data outside Malaysia (including in the EU/EEA and the United States). By using the Platform and providing your data, you consent to such transfers. We take reasonable steps to ensure recipients provide a comparable level of protection as required by the PDPA.
7. Retention
We keep personal data only for as long as necessary for the purposes above or as required by law (e.g. tax/accounting records), after which it is deleted or anonymised.
8. Your rights
- Access the personal data we hold about you and request a copy.
- Correct inaccurate or incomplete data (you can edit much of it in your account).
- Withdraw consent and request deletion, subject to legal retention requirements.
- Limit processing for direct marketing.
To exercise any right, email admin@natcamp.com. We may verify your identity before responding.
9. Cookies & local storage
We use only essential cookies/local storage: a secure session cookie to keep you logged in, and a flag to remember your cookie-consent choice. We do not use third-party advertising cookies. You can clear these via your browser settings; disabling the session cookie will log you out.
10. Security
We apply reasonable technical and organisational measures, including password hashing, encrypted connections (HTTPS), and access controls. No system is perfectly secure, but we work to protect your data.
11. Data breach
In line with the PDPA (as amended), if a personal data breach occurs that meets the notification threshold, we will notify the Personal Data Protection Commissioner and affected individuals as required.
12. Children
The Platform is intended for users aged 18 and above. We do not knowingly collect data from children without appropriate consent.
13. Changes
We may update this policy; the “effective date” above shows the latest version. Material changes will be notified through the Platform.
14. Contact & complaints
Questions or complaints: admin@natcamp.com. You also have the right to lodge a complaint with the Personal Data Protection Department (Jabatan Perlindungan Data Peribadi, JPDP), Malaysia.