Skip to content
KontrakHub

Legal

Privacy Policy

Last updated 10 August 2025

This Privacy Policy explains how 100 STARTUPS CONSULT ("we", "us"), which operates KontrakHub and the website kontrakhub.com, collects, uses, discloses and protects personal data. It is our notice under section 7 of Malaysia's Personal Data Protection Act 2010, as amended by the Personal Data Protection (Amendment) Act 2024 ("PDPA"), and our privacy notice under Indonesia's Law No. 27 of 2022 on Personal Data Protection ("UU PDP"). A Bahasa Indonesia version is on this website, and a Bahasa Malaysia version is available on request.

This policy covers this website and enquiries made through it. When we build and deploy KontrakHub for an organisation, that organisation controls the data in its own platform, on its own infrastructure, under its own agreement with us.

1. Personal data we collect

  • What you send us on WhatsApp. When you tap a "Request a demo" or WhatsApp button, WhatsApp opens with a message you can edit before sending. If you send it, we receive your name and phone number as shown on WhatsApp, and anything you tell us, such as your organisation, role and needs.
  • Technical data. Our hosting provider, Cloudflare, processes your IP address, browser, device and the pages requested, to deliver the site and protect it from attacks.

The website has no forms, no accounts, no analytics and no advertising or tracking technologies. We do not set cookies. Cloudflare may set a strictly necessary security cookie to tell people from automated traffic.

We do not ask for sensitive personal data (Malaysia) or specific personal data (Indonesia), such as health, biometric, financial or criminal records data. Please do not send it to us.

2. Why we use it, and on what basis

  • To reply to your enquiry, arrange a demo and prepare a proposal: with your consent, and to take steps you ask for before a contract.
  • To deliver and manage services if you become a client: to perform our contract with you.
  • To keep the website secure and working: our legitimate interest in protecting the site and its visitors.
  • To meet legal, tax and accounting obligations: compliance with the law.

We will not send you marketing messages unless you ask for them, and you can stop them at any time.

3. Is providing data mandatory?

No. You can read the whole website without giving us any personal data. If you contact us, we need your contact details and enough information to reply; without them we cannot respond.

4. Who we share it with

We do not sell personal data. We share it only with:

  • Cloudflare, Inc.: website hosting, delivery and security.
  • WhatsApp (Meta Platforms): the messaging service you choose to contact us with. WhatsApp handles your messages under its own terms and privacy policy.
  • Professional advisers, such as lawyers and accountants, under a duty of confidentiality.
  • Authorities, where the law requires it.

Our service providers act on our instructions and are bound by confidentiality and data protection obligations.

5. Transfers outside Malaysia and Indonesia

Cloudflare and WhatsApp may process data in other countries. Where data leaves Malaysia, we rely on the destination having laws substantially similar to the PDPA, or on adequate safeguards, as section 129 of the PDPA requires. Where data leaves Indonesia, we ensure an equal or higher level of protection or adequate, binding safeguards, as Article 56 of the UU PDP requires; otherwise we ask for your consent first.

6. Security and data breaches

We protect personal data with access controls, encryption in transit and least-privilege practices. If a breach is likely to cause significant harm, we will notify the Personal Data Protection Commissioner in Malaysia within 72 hours and affected individuals without undue delay, and, for people in Indonesia, notify the affected individuals and the authority in writing within 3 x 24 hours, as each law requires.

7. How long we keep it

We keep enquiry messages for up to 2 years after our last contact, and client records for as long as tax and company law require. After that we delete or anonymise them.

8. Your rights

Everyone

  • Find out whether we hold your personal data, and get a copy of it.
  • Correct data that is inaccurate, incomplete or out of date.
  • Withdraw your consent, or ask us to stop or limit processing.
  • Ask us to stop any direct marketing.
  • Ask us to send your data to another organisation, where technically feasible.

People in Indonesia, under the UU PDP, also have the right to

  • Have your personal data deleted or destroyed.
  • Object to decisions based solely on automated processing, including profiling.
  • Sue for and receive compensation for a breach of your personal data.

We reply to requests within 21 days in Malaysia, and within the shorter periods set by the UU PDP for people in Indonesia (for most requests, 3 x 24 hours). We may need to confirm your identity first. Under the PDPA we may charge the fee it permits for a copy of your data.

9. Children

This website is for organisations and is not directed at children. We do not knowingly collect children's data.

10. Contact and complaints

Send questions, requests or complaints to our Data Protection Officer on . Please start your message with "Data protection request".

If you are not satisfied with our reply, you may complain to the Personal Data Protection Commissioner (Jabatan Perlindungan Data Peribadi) in Malaysia, or, in Indonesia, to the Ministry of Communication and Digital Affairs (Komdigi) or the personal data protection authority established under the UU PDP.

11. Changes to this policy

We may update this policy. The version on this page, with its date, is the one that applies.