Privacy Notice

1. Who this notice applies to

This notice applies to property owners, authorised team members, prospective customers, guests and other individuals whose personal data is processed through Dejavu Stay. A property owner or accommodation operator may separately control guest data entered into the platform. In that situation, the owner is responsible for its own privacy obligations and Dejavu Capital processes that data to provide the service.

2. Personal data we may collect

• Identity and account data, including name, email address, authentication records, role, Company membership and account preferences.
• Business and property data, including company or operator details, building and unit information, addresses, booking-channel references and operating instructions.
• Reservation and guest data, including stay dates, contact details, requests, communications, check-in and checkout activity, payment status and operational notes.
• Payment and transaction data, including amounts, currency, payment status, provider references, refunds and subscription records. Full payment-card details are intended to be handled by the relevant payment provider rather than stored by Dejavu Stay.
• Technical and security data, including IP address, device and browser information, timestamps, session records, audit trails and diagnostic events.
• Information supplied in enquiries, support requests, privacy requests, demonstrations or communications with us.

3. Sources of personal data

• Directly from you when you register, configure an account, contact us or use the service.
• From a property owner, authorised team member or accommodation operator acting in connection with a stay.
• From booking channels and calendar feeds that an authorised user connects or imports.
• From payment, email, hosting, security and other service providers used to operate the platform.
• Automatically through normal website, application and security operations.

4. Why we process personal data

• To create and administer accounts, Companies, memberships and subscriptions.
• To provide calendars, reservations, booking requests, guest communications, housekeeping, maintenance, reporting and related property-management functions.
• To process or evidence payments, refunds and fees where payment features are enabled.
• To authenticate users, prevent misuse, investigate incidents and maintain audit and security records.
• To deliver service messages, verification emails, support and requested communications.
• To improve reliability, usability and product planning using appropriately limited operational information.
• To comply with legal obligations, enforce agreements and establish, exercise or defend legal claims.
• For other purposes disclosed at collection or carried out with consent where consent is required.

5. Disclosure and service providers

We may disclose personal data only as reasonably necessary to authorised Company users; accommodation operators; payment, email, hosting, database, security and support providers; professional advisers; prospective transaction parties under confidentiality; and regulators, courts or law-enforcement bodies where legally required. We do not sell personal data.

Booking channels and other third-party services operate under their own terms and privacy notices. Connecting them may cause information to be processed independently by those third parties.

6. International processing

Some technology providers may process or store information outside Malaysia. Where a cross-border transfer occurs, we will take reasonable steps intended to ensure an appropriate level of protection and comply with applicable Malaysian requirements.

7. Security

We use administrative, technical and organisational safeguards appropriate to the nature of the information, including access controls, Company-scoped permissions, secure transport, audit records, masking and restricted export workflows. No internet service or storage method is completely secure, and we cannot guarantee absolute security.

8. Retention

We retain personal data only for as long as reasonably required for the purposes described above, including service delivery, security, accounting, dispute resolution and legal obligations. Retention periods vary by record type. Data may be archived, anonymised or securely deleted when no longer required, subject to backups, legal holds and records that must be preserved.

9. Your choices and rights

• Request access to or correction of personal data, subject to identity verification and lawful exceptions.
• Ask how personal data has been used or disclosed and raise a privacy concern.
• Withdraw consent where processing relies on consent, without affecting earlier lawful processing.
• Request deletion, anonymisation or restriction for review, subject to contractual, security, evidential and legal retention requirements.
• Opt out of optional promotional communications using the method provided in the message.

10. Required and optional information

Fields identified as required are needed to create an account, provide a requested service, maintain security or comply with law. If required information is not provided, we may be unable to create the account or provide the relevant feature. Optional information may generally be omitted, although this may limit related functionality.

11. Cookies and similar technologies

Dejavu Stay uses strictly necessary cookies and similar technologies for authentication, security, language or interface preferences and service continuity. If optional analytics or advertising technologies are introduced, we will provide appropriate information and choices before using them where required.

12. Children

Dejavu Stay is intended for business users and is not directed to children. Owners and operators must not use the platform to collect children’s personal data unless they have a lawful reason, appropriate authority and suitable safeguards.

13. Changes to this notice

We may update this notice when our services, providers or legal obligations change. The updated version will show a revised date. We will provide additional notice where a change is material or consent is required.

14. Contact and privacy requests

Contact Dejavu Capital Sdn. Bhd. at support@dejavustay.com with the subject “Privacy Request”. Please do not send identity documents or sensitive payment information by ordinary email unless we provide a secure method. You may also have the right to contact Malaysia’s Personal Data Protection Commissioner.

Official guidance: Personal Data Protection Commissioner Malaysia.

Read the Intellectual Property Notice