1. Who is responsible for your data

The Site is operated under the brand name 老虎哥 (HuGe), a marketing and IT services business. Under the PDPA the operator acts as the data controller for the limited personal data described below. (The 2024 amendments renamed the statutory term “data user” to “data controller”; the substance of the role is unchanged.)

• Registered entity: [PLACEHOLDER: registered entity name]
• Business registration number: [PLACEHOLDER: business registration number]
• Registered or business address: [PLACEHOLDER: business address]
• Written enquiries: [PLACEHOLDER: contact email]
• Day-to-day contact channel: Telegram — t.me/TigerbroGalaxy

These fields are placeholders because no registered legal entity, company registration number or published business address currently exists for this brand. They must be completed before this notice is relied on. Note that PDPA obligations attach to the person who processes personal data in respect of commercial transactions, whether or not that person has incorporated a company — so the absence of a registered entity does not remove the obligations described here; it simply means the responsible person is the individual operator.

2. Language of this notice

Section 7(3) of the PDPA requires a data protection notice to be made available in both the national language (Bahasa Malaysia) and English. Only the English version currently exists.

[PLACEHOLDER: Bahasa Malaysia translation of this notice] — a Bahasa Malaysia version must be published alongside this page to satisfy section 7(3).

3. What we actually collect

This Site has no contact forms, no user accounts, no logins, no payment processing, no newsletter sign-up, no comments and no file uploads. There is therefore no form on this Site through which you can submit personal data to us. What is collected falls into two narrow categories.

3.1 Website analytics

The Site loads Google Tag Manager (container GTM-WKZFGTR2), which in turn loads Google analytics tooling. Through that tooling the following may be collected about your visit:

• Your IP address (used by Google primarily to derive an approximate location such as country or city)
• Device and browser information — device type, operating system, browser, screen size, language setting
• Pages viewed on this Site, the order they were viewed in, and time on page
• The referrer — the page or source that sent you here, including search or campaign parameters in the URL
• Identifiers stored in cookies or similar storage that let Google distinguish one browser from another across visits

We use this only in aggregate, to understand which pages are read and which traffic sources work. We do not attempt to identify individual visitors from it, and we do not combine it with any other source of information about you.

Whether this data is “personal data” under the PDPA is a question of degree: an IP address plus a device identifier can, in combination and in the hands of a party able to link them to a person, identify an individual. We treat it as personal data and describe it here rather than argue the point.

3.2 What you send us on Telegram

The only contact channel offered on this Site is Telegram (t.me/TigerbroGalaxy). If you message us there, we receive whatever you choose to send: your Telegram username or display name, your message content, and any files, screenshots, campaign details, business information or contact details you volunteer.

Telegram messages are transmitted, stored and handled on Telegram’s own infrastructure and are governed by Telegram’s privacy policy, not this one. We do not control Telegram, and we cannot change how Telegram retains or processes your data. Please review Telegram’s policy at telegram.org/privacy before sending anything sensitive. Do not send passwords, account credentials, payment card numbers, identity documents or third-party personal data through Telegram.

4. Why we process it

• Analytics data — to measure Site traffic, understand which content is useful, and diagnose problems with how the Site loads.
• Telegram messages — to answer your enquiry, scope work you have asked about, and (if we go on to work together) to communicate about that engagement.

We do not use either category for automated decision-making, profiling that produces legal effects, or credit assessment.

5. Cookies and how to switch analytics off

The Site itself sets no cookies for advertising, personalisation or session management. The only cookies or similar browser storage originate from Google Tag Manager and the Google analytics tooling it loads — typically a first-party analytics identifier used to distinguish returning browsers and to attribute a series of page views to one session.

Malaysia has no dedicated ePrivacy or cookie statute equivalent to the EU’s ePrivacy Directive, and there is no Malaysian legal requirement that is directly equivalent to the GDPR-style “accept cookies” banner. That is why this Site does not show one. The PDPA’s general consent and notice principles still apply, which is what this section is for: telling you plainly what is set and how to stop it.

You can prevent this collection in any of the following ways:

• Browser settings — block or delete cookies for this site, or use your browser’s private/incognito mode. Every major browser lets you block third-party and first-party cookies per site.
• Google Analytics Opt-out Browser Add-on — available at tools.google.com/dlpage/gaoptout, which stops Google Analytics tooling from sending data from your browser on any site.
• Tracking protection / blockers — browser-level tracking protection or a content blocker will prevent Google Tag Manager from loading at all.

Blocking analytics does not break the Site. All content on this Site is visible without JavaScript.

6. Who we share it with

We do not sell personal data, and we do not rent, trade or otherwise make it available to data brokers, advertising networks or list vendors. There is no revenue model on this Site that involves your data.

The only third parties that receive data in connection with your visit are:

• Google (Google Tag Manager and Google analytics services) — as the analytics processor described above.
• Telegram — if and only if you choose to message us there.
• Our hosting provider — which necessarily handles the network request that delivers this page to you.

We may also disclose personal data where we are required to do so by law, by a court order, or by a lawful request from a regulator or law enforcement agency.

7. International transfer of data

Google operates a global infrastructure. Analytics data collected through Google Tag Manager is processed on Google’s servers, which are located outside Malaysia, including in the United States and other jurisdictions. Telegram likewise operates infrastructure outside Malaysia.

The PDPA as amended in 2024 removed the previous “whitelist” mechanism for cross-border transfers. Transfers outside Malaysia are permitted where the destination has laws substantially similar to the PDPA or otherwise ensures an adequate level of protection, or where one of the statutory exceptions applies — including where the data subject has consented to the transfer. By continuing to use this Site without blocking analytics, and by choosing to contact us through Telegram, you accept that these transfers occur.

8. How long we keep it

• Analytics data — retained for the retention period configured in the Google analytics property, after which Google deletes or aggregates user-level records. Aggregate, non-identifying reports may be retained indefinitely.
• Telegram conversations — retained for as long as the enquiry or working relationship is live, and afterwards only for as long as needed to deal with follow-up questions, disputes or legal obligations. Telegram’s own retention is governed by Telegram, not by us.

We do not keep personal data longer than is necessary for the purpose it was collected for, in line with the PDPA’s Retention Principle.

9. Security

The Site is served over HTTPS. Fonts and images are self-hosted, so your browser makes no third-party requests other than to Google Tag Manager. Because the Site holds no accounts, no database of visitors and no payment data, the attack surface for your personal data on this Site is minimal.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security — particularly for data held on Telegram’s or Google’s systems, which are outside our control.

10. Your rights under the PDPA

Subject to the conditions and exceptions in the Act, you have the following rights in relation to personal data we hold about you:

• Access — to ask whether we hold personal data about you and to be supplied with a copy (section 30). A reasonable prescribed fee may apply.
• Correction — to ask us to correct personal data that is inaccurate, incomplete, misleading or out of date (section 34).
• Withdraw consent — to withdraw your consent to our processing of your personal data at any time, by written notice (section 38).
• Limit or stop processing — to require us to stop processing where the processing is causing or is likely to cause unwarranted substantial damage or distress (section 42).
• Stop direct marketing — to require us to cease processing your personal data for direct marketing purposes (section 43).
• Data portability — the 2024 amendments introduced a right to request transmission of your personal data to another data controller, where technically feasible and format-compatible. In practice this Site holds almost nothing portable about you.

11. How to make a request or complaint

Send your request through Telegram to t.me/TigerbroGalaxy, or in writing to [PLACEHOLDER: contact email]. Tell us what you are asking for and give us enough detail to locate the data — for a Telegram enquiry, the username you messaged from is usually enough.

Please note the practical limit: for analytics, we hold only aggregate reports and have no way to isolate “your” records from them, because we hold no identifier that links an analytics record to you. If you want analytics data about you erased or restricted at source, the effective route is Google’s own controls and the opt-out add-on described in section 5.

If you are not satisfied with our response, you may complain to the Personal Data Protection Commissioner (Jabatan Perlindungan Data Peribadi / Department of Personal Data Protection, Malaysia) at pdp.gov.my.

12. Children

This Site is directed at businesses, operators, agencies and affiliates. It is not intended for children, and we do not knowingly collect personal data from children. If you believe a child has sent us personal data through Telegram, contact us and we will delete what we hold.

13. Changes to this notice

We may update this notice as the Site, the services, or the law change. Any updated version will be published at https://tiger.jackportia.com/privacy/ with a revised effective date at the top of this page. Because this Site has no accounts and no mailing list, we have no way to notify you individually — the published page is the notice. Please check this page if you want to know whether anything has changed. Continuing to use the Site after an update means you accept the revised notice.

This notice describes the Site only. Any engagement for marketing, advertising, development or IT services is governed by a separate written agreement between you and us, and that agreement may involve additional data processing described separately at that time. See also our Terms of Service.