Watchpost Privacy Policy (Personal Data Protection Notice)

This Privacy Policy (the "Notice") explains how XYZ Sdn Bhd ("Watchpost", "we", "us") collects, uses, discloses, stores and protects personal data when you visit our website, sign up, are invited to or join a Workspace, pay, contact us, report a problem or otherwise use the Watchpost social media scheduling service (the "Service"). Section 7 explains our more limited role for personal data inside content that our Customers manage.

This Notice is our written notice under section 7 of the Personal Data Protection Act 2010 (Act 709), as amended by the Personal Data Protection (Amendment) Act 2024 ("PDPA"). It also gives the information required by Articles 13 and 14 of the EU General Data Protection Regulation ("GDPR") and the UK GDPR, and by section 20 of Singapore's Personal Data Protection Act 2012 ("SG PDPA"). Our Platform Disclosures page forms part of this Notice. Read it together with our Terms of Service (the "Terms"), Cookie Policy, Data Processing Agreement ("DPA"), Sub-processors page and Data Deletion Instructions.

"Section" or "clause" means a section or clause of this Notice unless another document is named; "s." and "ss." mean sections of a statute; "reg." means a regulation; and "Art." means an article of the GDPR or the UK GDPR.

Summary

1. Who we are and how to contact us

1.1 Data controller (PDPA s.4; GDPR Art. 4(7)) for all personal data in this Notice except where Section 7 applies:

XYZ Sdn Bhd (Company Registration No. 202601000000), Malaysia Email: [email protected] · Contact page

We show our name and registration number as section 30 of the Companies Act 2016 requires.

1.2 Data Protection Officer. We have designated a Data Protection Officer ("DPO") as the contact person for every question, request and complaint about personal data. Contact the DPO by email at [email protected] (subject "Privacy") or by post at Data Protection Officer, XYZ Sdn Bhd, Malaysia. You may write in Bahasa Malaysia or English. Where our processing meets the thresholds set under PDPA s.12A, the DPO is appointed and registered with the Commissioner as that section requires; until then the DPO acts as our designated privacy contact. The DPO is also our data protection officer for Singapore. (PDPA s.7(1)(d) and s.12A; Personal Data Protection Regulations 2013 ("PDP Regulations") reg. 4; GDPR Art. 13(1)(b); SG PDPA s.11(3)–(5).)

1.3 EU and UK representatives (GDPR and UK GDPR Art. 27). Where the law requires us to appoint a representative in the European Union or the United Kingdom, we will publish its details here. Until then, contact us at [email protected].

1.4 Languages. We publish this Notice in Bahasa Malaysia and English, as PDPA s.7(3) requires, and both versions have equal standing. We write them to mean the same thing; if they are inconsistent, we will apply the meaning that is more favourable to you.

2. Definitions and our two roles

2.1 Defined terms.

2.2 Controller. We are the data controller for Account Data. We decide why and how it is used (PDPA s.4; GDPR Art. 4(7); for Singapore, we are the "organisation" responsible under SG PDPA s.2(1)).

2.3 Processor. We are a data processor for Customer Content, and for Platform Data and Analytics Data that we process on a Customer's instructions. The Customer, or an agency's own client, is the controller (PDPA s.4; GDPR Art. 28; "data intermediary" under SG PDPA s.4(2)). See Section 7. We act as a controller for that data only to the limited extent that we use it for our own security, abuse prevention, Platform compliance, legal obligations and legal claims (purposes 6, 10, 11 and 12 in Section 4).

2.4 Platforms are independent controllers. Each Platform handles data under its own terms and privacy policy, which we do not control. When you connect an account or publish a post, you instruct us to send data to that Platform. Platforms are not our Sub-processors.

2.5 Our payment processor has two roles. Our payment processor is our Sub-processor for the payments we ask it to handle. It is also an independent controller for its own fraud-prevention, anti-money-laundering, know-your-customer and regulatory processing, under its own privacy policy.

3. The personal data we collect and where it comes from

3.1 The table below lists each category of data, what it includes and where it comes from (PDPA s.7(1)(a) and (c); GDPR Arts. 13(1) and 14(1)(d), 14(2)(f)).

3.2 Sensitive personal data. We do not ask for sensitive personal data. Under PDPA s.4 this means data about a person's physical or mental health or condition, political opinions, religious or similar beliefs, the commission or alleged commission of an offence, biometric data, and any other data the Minister specifies; see also GDPR Art. 9. Do not upload such data without the explicit consent of the person it is about or another lawful ground (PDPA s.40). We do not run facial recognition or any other biometric processing on media.

3.3 Media metadata. When you upload a still image, we re-encode it and strip embedded metadata, including location data. Video files already in a supported format, and animated images, are stored as uploaded and may keep metadata that your camera or phone embedded, which can include location. Remove it before uploading if you do not want it stored or published.

3.4 Other people's data. When you invite a Team Member, add a billing contact, share a preview link or upload content showing other people, you must be entitled to give us their data and must tell them about it (PDPA ss.6–7; GDPR Art. 14; SG PDPA s.20). Our invitation emails link to this Notice.

4. Why we use personal data and our legal bases

4.1 We use personal data only for lawful purposes directly related to our business, and only as much as each purpose needs (PDPA s.6(3)). For each purpose, the table states our basis under PDPA s.6 and under GDPR and UK GDPR Art. 6(1). Where we rely on legitimate interests, it names the interest (GDPR Art. 13(1)(c)–(d)).

4.2 Singapore. For Singapore users, we rely on:

4.3 New purposes. Before using your data for a new purpose, we will tell you and, where required, ask for your consent (PDPA s.7(2); GDPR Art. 13(3)).

4.4 Consent records. We record each consent with the version of the wording, the time and the method, and present it separately from other matters (PDP Regulations reg. 3; GDPR Art. 7). The marketing box is never pre-ticked.

5. Whether you have to give us personal data

5.1 Required data (PDPA s.7(1)(g)–(h); GDPR Art. 13(2)(e)).

If you do not provide this data, we cannot open your account, add you to the Workspace, activate publishing and analytics, issue the invoice you asked for, or connect the Platform.

5.2 Optional data. Everything else is optional, including your display name and picture, extra billing contacts, notes, marketing consent and support messages. If you leave it out, the related feature may not be available.

6. Connected Platforms

6.1 How connections work. When you connect an account, the Platform's own login page shows the permissions we request, and you decide whether to grant them. We request only the minimum permissions for the features you use. We store the token the Platform returns in encrypted form and use it only on your instructions. You can disconnect in Watchpost at any time, or revoke our access in the Platform's own settings. Our Platform Disclosures page gives more detail for each Platform.

Each Platform's own policy governs how it handles data:

6.2 Our commitments for all Platform Data. We do not sell, license or buy Platform Data, or use it for advertising, profiling individuals, eligibility decisions, surveillance, identity matching, re-identification, inferring sensitive characteristics or training AI models. We collect it only through authorised APIs within the permissions you grant (PDPA s.130). We delete it as soon as reasonably possible when it is no longer needed, when you ask or disconnect, or when a Platform or the law requires (Section 10).

6.3 Meta (Facebook Pages, Instagram and Threads).

6.4 Google (Sign-In, YouTube and Google Business Profile).

(a) Watchpost's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy (opens in a new tab), including the Limited Use requirements.

In particular, we use data received from Google APIs only to provide or improve the user-facing features you see in Watchpost; we transfer it only where those features need it, for security, to comply with the law, or, in a merger, acquisition or sale of assets, with your explicit prior consent; we never use it for advertising, sell it, use it for credit or lending decisions, or use it to train generalised AI or machine-learning models; and no person at Watchpost reads it unless you give your affirmative agreement for specific data, reading is necessary for security or legal compliance, or the data is aggregated and anonymised for internal operations (Platform Disclosures clause 4).

(b) Google Sign-In. We receive your Google ID, name, email and profile picture. We use them only to create your account, sign you in and show your name and picture to your team.

(c) YouTube.

(d) Google Business Profile. We access the locations you select (including their name, address, categories, rating and review count), the posts you publish (such as updates, events and offers) and the performance data Google returns. We act only for locations you own or are authorised to manage, and only on your specific instruction. Watchpost does not reply to reviews, answer questions, or create or edit listings. We store content retrieved from this API securely and delete it once it is older than 30 days.

6.5 TikTok. We access the accounts you connect (identifiers, names, avatars and tokens), the videos and photo posts you publish with the privacy, interaction, commercial-content and AI-label settings you choose, the most recent videos (up to 50) with their public counts when you connect, and the metrics TikTok returns. We use them only to publish as you instruct and show you your results. We do not build profiles or databases of TikTok users or add our branding to your content. TikTok's Partner Privacy Policy governs the data TikTok receives. We delete TikTok data when you ask, when you disconnect or when TikTok requires; if TikTok ends our access, we delete all TikTok data we hold, including from our servers. If a security compromise affects TikTok data, we disconnect from TikTok's services and report it to TikTok immediately.

6.6 X. X is switched off in the Service for now; this clause applies once it is switched on. We access the account you connect (identifier, username, avatar and tokens), the posts, threads, polls and media you publish, and public metrics on your posts. We do not import X posts published outside Watchpost. If X content we hold is deleted, protected, suspended, withheld or modified on X, we delete or update our copy within 24 hours of a request from X or the account owner. We do not use X content for AI training, for advertising outside X, to match X users with other identities or to infer their sensitive characteristics.

7. Customer Content: Watchpost as a processor

7.1 Who is the controller. The Customer decides what content is created, where it is published and which analytics are collected. For Customer Content, and for Platform Data processed on the Customer's instructions, the Customer (or an agency's own client) is the controller and we are the processor. This covers, for example, an agency's clients, people in photos, tagged accounts, preview-link reviewers, and audience members where a Platform returns identifiable data. (PDPA ss.4, 5(1A) and 9; GDPR Art. 28; SG PDPA s.4(2)–(3).)

7.2 What we do with Customer Content. We process it only to provide the Service as you instruct through the product, to keep it secure, and as the law requires. We do not use it for our own purposes, sell it or train AI models on it; we keep only fully anonymised, aggregated statistics, such as the number of posts published per Platform (DPA clause 5.3). Our staff look at a Workspace only to resolve a support request you make or agree to, or where needed for security, to investigate a breach of our Acceptable Use Policy, or to comply with the law. Access to our administration tools is restricted to named staff, and every change made through them is logged. Data received from Google APIs is read only as Section 6.4(a) allows.

7.3 The DPA. Our DPA forms part of our Terms and applies automatically whenever we process personal data in Customer Content (Terms clause 20.3). It sets out our processor duties: documented instructions, confidentiality, security, Sub-processor rules, help with rights requests and breaches, deletion or return of data at the end, and audits. It includes the GDPR Art. 28(3) terms, the EU Standard Contractual Clauses and the UK Addendum, and is the written contract required by SG PDPA s.4(2).

7.4 If you are not a Watchpost user but your data appears in content a Customer manages, please contact that business, because it is the controller. If you contact us instead, we will pass your request to the Customer within 5 working days and help it respond (DPA clause 10.2).

7.5 Customers' own duties. Customers must have a lawful basis, and give the required notices, for the data they put into Watchpost. This includes sending that data to us and to the Platforms (PDPA s.7; GDPR Arts. 13–14).

8. Who we share personal data with

8.1 We disclose personal data only to the classes of recipients listed below, and we keep a register of these disclosures (PDPA ss.7(1)(e) and 8; PDP Regulations reg. 5; GDPR Art. 13(1)(e)).

8.2 Sub-processors. We use service providers in these categories:

Every Sub-processor works under a written contract that requires protection meeting PDPA s.9 and GDPR Art. 28(4). The categories are listed on our Sub-processors page; the current list of named providers is available on request at [email protected]. We give Workspace Owners at least 30 days' notice before a new or replacement Sub-processor starts processing personal data, or an existing one starts processing it in a new country. You may object on reasonable data protection grounds within the notice period (Sub-processors page, clause 10).

8.3 Platforms receive the content you publish, the actions you instruct and the token exchanges that keep your account connected. They receive this as independent controllers (Section 6). Where a Platform's terms require it, we also report security incidents to it and cooperate with its audits and misuse investigations, limited to data concerning that Platform (Acceptable Use Policy clause 13.6).

8.4 Your Workspace and people you share with. Other Team Members in a Workspace can see your name, email, avatar, role and activity there. Billing contacts receive invoices and payment notices. Anyone who has a post preview link that a Team Member shares can see that preview and its review comments, and add comments, until the post is deleted; the name and comments a reviewer adds can be seen by the Team Members and by others who have the link. Media files are stored at long, random web addresses because Platforms fetch them from there when publishing; anyone who obtains such an address can open the file. Reports and exports go to whoever a Team Member sends them to.

8.5 Other recipients.

8.6 We do not sell personal data and do not share it for anyone else's marketing (PDPA s.8).

9. Cross-border transfers

9.1 Where your data is stored. Your data is stored on servers we operate or control. Data is encrypted in transit, and our backups are encrypted before they leave our servers (Section 8.2). Our service providers and the Platforms you connect may process personal data in other countries, as this Section explains.

9.2 Transfers to other countries. Some Sub-processors process data in other countries (Section 8.2), and the Platforms process data where they operate. We transfer personal data to another country only where one of the following applies (PDPA s.129, as amended; Guideline No. 3/2025 on Cross Border Personal Data Transfer):

We keep a record of each transfer. A summary is available from [email protected].

9.3 EEA and UK users (GDPR Arts. 13(1)(f) and 44–46; UK GDPR as amended by the DUAA). Malaysia has no EU or UK adequacy decision.

You can get a copy of the clauses and a summary of the assessment from [email protected].

9.4 Singapore users (SG PDPA s.26; Personal Data Protection Regulations 2021 regs. 10–11). We protect your personal data to a standard comparable to the SG PDPA, and require each Sub-processor that receives it outside Singapore to do the same under a legally enforceable contract. For Customer Content, our DPA contains these obligations.

9.5 Platforms. When you publish, the Platform may process the data in the United States or elsewhere under its own safeguards.

10. How long we keep personal data

10.1 We keep personal data only as long as its purpose requires. Then we delete or anonymise it, using scheduled jobs, and record the disposal (PDPA s.10; PDP Regulations reg. 7; Personal Data Protection Standard 2015; GDPR Arts. 5(1)(e) and 13(2)(a); SG PDPA s.25). Where our Data Deletion Instructions give a shorter period than this table, the shorter period applies.

10.2 If a law, court order or dispute requires us to keep specific data longer, we keep only that data, only for as long as required, and restrict its use.

11. How we protect personal data

11.1 We take practical steps to protect personal data against loss, misuse, unauthorised access or disclosure, alteration and destruction (PDPA s.9; PDP Regulations reg. 6; Personal Data Protection Standard 2015; GDPR Art. 32; SG PDPA s.24). Because Watchpost holds tokens that can publish as real businesses, our key controls are backed by automated tests or written procedures:

11.2 Vulnerabilities. Please report vulnerabilities to [email protected]. We will not take action against good-faith research that follows our Security and Vulnerability Disclosure Policy.

12. Personal data breaches

12.1 A "personal data breach" is any breach, loss or misuse of, or unauthorised access to, personal data (PDPA s.4). We keep a breach register and an incident response plan.

12.2 If a breach affects your data, we will:

12.3 Our notice to you will be in plain language, sent separately from other messages, and will explain what happened, what data was involved, what we have done, what you can do, and how to contact our DPO.

13. Your rights

13.1 Rights under the Malaysian PDPA.

13.2 Rights under the GDPR and UK GDPR.

13.3 Rights under the Singapore PDPA. You can ask for access (s.21) and correction (s.22), free of charge. We respond within 30 days, or tell you within that time when we will respond. You may withdraw consent on reasonable notice (s.16); we will tell you the likely consequences before acting on it.

13.4 How to exercise your rights.

(a) Self-service. In Settings you can edit your profile, export your data, revoke sessions, disconnect accounts, delete content, leave or delete Workspaces, delete your account and manage marketing preferences.

(b) By request. Email [email protected] (subject "Privacy"), in Bahasa Malaysia or English, saying which right you want to use. We acknowledge your request and track the deadline (PDP Regulations reg. 9). We verify your identity through your registered email address or two-factor authentication; if you no longer control that address, we ask only for information the account holder would have (Data Deletion Instructions clause 7.2). For Malaysian requests we may ask for the details permitted by reg. 10.

(c) Customer Content. Where we are the processor (Section 7), the Customer answers your request, and we help it do so.

(d) Refusals. If we refuse a request, we explain why in writing and tell you how to complain (PDPA ss.33 and 37; GDPR Art. 12(4)).

13.5 People in other countries. Customers and users anywhere in the world are welcome. Wherever you live, you keep the rights your local data protection law gives you, in addition to those in this Section, and you can use them by contacting us at [email protected]. If you are a consumer, nothing in this Notice takes away a protection that the law of your country gives you and that cannot be excluded by agreement.

14. Deleting your data

14.1 Self-service deletion. You can delete data without contacting us:

14.2 Deletion from the Platform side. Removing Watchpost in a Platform's settings ends our access: we delete the tokens when we learn of it and the other Platform Data within 7 days of the revocation or deauthorization (Section 10). For Meta, a Data Deletion Request leads to deletion at once and gives you a confirmation code and a status page. Our Data Deletion Instructions cover every route, including for people who are not Watchpost users.

14.3 What we keep after deletion. Only records we need to keep for legal, accounting, security or evidential reasons: billing records (7 years), acceptance and consent records (7 years), security logs (2 years), the breach register, support and request records and your suppression record, for the periods in Section 10. Deleted data leaves our encrypted backups as they rotate (Section 10).

15. Cookies and similar technologies

15.1 Watchpost sets only strictly necessary cookies. We use no analytics or advertising cookies, pixels or trackers, and our emails contain no tracking pixels. On billing pages where you add or change a card, our payment processor's script sets its own fraud-prevention cookies. All of these are exempt from consent (ePrivacy Directive Art. 5(3); UK PECR reg. 6(4)), so we do not show a cookie banner. If we ever add a non-essential cookie, we will ask for your consent before it is set. Our Cookie Policy gives the name of each cookie.

15.2 The app also keeps some settings and conveniences in your browser's storage: for example your theme, calendar and media-library views, the last Workspace you opened, tips and notices you dismissed, and an unsent post draft with the hashtags and mentions you used recently. They stay in your browser, are never sent to us automatically, and are listed in our Cookie Policy.

16. Marketing communications

16.1 Opt-in only. We send marketing email only if you tick the separate, unticked box at sign-up or switch it on in Settings (PDPA s.6(1); GDPR Art. 6(1)(a); UK PECR reg. 22; SG PDPA s.13). We do not buy lists and never give your details to others for their marketing.

16.2 Opting out. Use the unsubscribe link in any marketing email, change your preferences in Settings, or email [email protected] (PDPA s.43; GDPR Art. 21(2)–(3)). Unsubscribe links and Settings take effect immediately; written requests within 7 days. We keep a suppression record. Every marketing email identifies us and gives a contact address (UK PECR reg. 23; Singapore Spam Control Act 2007).

16.3 Service messages. Service messages (purpose 5) are sent regardless of your marketing choice. You can switch off optional ones, such as the weekly summary, in your notification preferences. Security alerts cannot be switched off.

16.4 No telephone or SMS marketing. We do not market by telephone, SMS or messaging app. If we start, we will first get your consent and check Singapore's Do Not Call Registry where it applies (SG PDPA Part 9).

17. Children

17.1 Watchpost is a business tool for users aged 18 and over. We do not knowingly collect personal data from anyone under 18 as a user (Contracts Act 1950 s.11; Age of Majority Act 1971; PDP Regulations reg. 3(3); GDPR Art. 8). At sign-up you confirm that you are 18 or over. If we learn that an account holder is under 18, we close the account and delete its data.

17.2 Customer Content may show or name children. The Customer is responsible for having a parent's or guardian's consent where the law requires it (PDP Regulations reg. 3(3); Terms clause 16.3(b)) and for using each Platform's settings for content made for children.

18. Automated decisions and AI

18.1 We make no decisions about you based solely on automated processing that have legal or similarly significant effects (GDPR Art. 22; UK GDPR Arts. 22A–22D; Commissioner's Guideline on Automated Decision-Making and Profiling 2026). We do not profile individuals: our analytics describe accounts and aggregated audiences.

18.2 The Service uses automated calculations to help you: best-time suggestions from the engagement of your own posts (adjusted for follower count) and your audience's online hours, checks against Platform limits, rule-based insight sentences, security rate limits, and fair-use checks that count publishing activity and flag it for a person on our team to review (a flag alone never changes anything; Acceptable Use Policy clause 11A). You stay in control of every post. Watchpost does not use third-party generative AI; if we add AI features, we will update this Notice first.

19. Changes to this Notice

19.1 When we update this Notice, we change the version, the effective date and the version history, in both language versions at the same time. Before any material change takes effect, such as a new purpose or a new class of recipient, we will notify you by email or in the Service, ask you in the Service to confirm that you have read the new version and, where required, ask for your consent (PDPA s.7(2); GDPR Art. 13(3)).

20. Complaints and regulators

20.1 Please contact our DPO first at [email protected]. You may also complain to a regulator at any time:

21. Version history

XYZ Sdn Bhd (Company Registration No. 202601000000) · Malaysia · [email protected] (including our DPO)