Privacy Policy

Introduction

DigiHwy Certainty Sdn Bhd ("DHC", "we", "us", or "our") operates JoinNests. This Privacy Policy explains how we collect, use, store, and protect personal data in connection with the JoinNests platform, in accordance with Malaysia’s Personal Data Protection Act 2010 (PDPA). By using JoinNests, you agree to the practices described in this policy.

1. Who This Policy Covers

This policy applies to two categories of individuals: Organisation users — staff, admins, and owners who create and manage a JoinNests account on behalf of their organisation; and Members — individuals whose data is collected through an organisation’s JoinNests registration forms. If you are a member of an organisation using JoinNests, your primary relationship for data purposes is with that organisation. DHC processes your data as a data processor on the organisation’s behalf.

2. Data We Collect

Organisation users: name, email address, password (stored as a one-way hash — we never store your plaintext password), organisation name and details, billing information (processed by Stripe — we do not store card numbers), and usage logs.

Members (collected on behalf of the organisation): name, email address, phone number, and any additional fields configured by the organisation in their registration form, which may include identification numbers, professional credentials, employment details, uploaded documents, and consent records.

3. How We Use Your Data

We use personal data to provide and operate the JoinNests platform, process subscription payments, send transactional emails (account verification, password reset, application status updates, renewal reminders), maintain security and prevent fraud, and comply with our legal obligations. We do not use personal data for advertising or sell it to third parties.

4. Legal Basis for Processing

We process personal data on the following bases under the PDPA: contractual necessity — to perform our obligations under your subscription agreement; legitimate interests — to operate, maintain, and improve the platform; consent — where you have explicitly provided it, such as when a member consents to an organisation’s privacy policy during registration; and legal obligation — where required by Malaysian law.

5. Data Storage and Security

All data is stored on Cloudflare’s global infrastructure, with servers processing data across Cloudflare’s network. We implement technical and organisational measures to protect your data including encrypted connections (TLS), hashed passwords (PBKDF2), access controls, and regular security reviews. No system is completely secure. If we become aware of a data breach that affects your personal data, we will notify you in accordance with our obligations under the PDPA.

6. Sub-processors

We share data with the following third-party service providers who process data on our behalf:

Cloudflare, Inc. — infrastructure, hosting, and content delivery. Data may be processed globally on Cloudflare’s network.

Microsoft Corporation — email delivery via Microsoft Graph API. Transactional emails are sent through Microsoft’s infrastructure.

Stripe, Inc. — payment processing. Billing data is processed by Stripe. We do not store card numbers or full payment details.

All sub-processors are required to handle data in accordance with applicable data protection law.

7. Data Retention

Organisation and member data is retained for the duration of your active subscription. Upon cancellation, data is retained for 90 days to allow for export, then permanently deleted. You may request early deletion at any time. Billing records may be retained for up to 7 years as required by Malaysian financial regulations.

8. Your Rights Under the PDPA

Under the Personal Data Protection Act 2010, you have the right to access the personal data we hold about you, request correction of inaccurate or incomplete data, withdraw consent where processing is based on consent, and request that we cease processing your data where it is causing you damage or distress. To exercise any of these rights, contact us at partnerships@dhcertainty.com. We will respond within 21 days.

9. Cookies

JoinNests uses only functional cookies necessary for the operation of the platform — specifically a session cookie for authentication. We do not use advertising or tracking cookies.

10. Children’s Data

JoinNests is not directed at children under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided data through the platform, contact us at partnerships@dhcertainty.com and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you by email before material changes take effect. The effective date at the top of this page will always reflect the date of the most recent revision.

12. Contact and Data Subject Requests

For privacy enquiries, data subject requests, or complaints, contact DigiHwy Certainty Sdn Bhd at people@joinnests.com or by post at Jalan SS 15/4, Subang Jaya, Selangor 47500, Malaysia.