Privacy Policy

Last updated: 3 August 2026

JoshCKH provides managed WhatsApp automation services to businesses in Malaysia. This policy explains what personal data we collect, why we collect it, and the choices you have. We handle personal data in line with Malaysia's Personal Data Protection Act 2010 (PDPA).

1. Who we are

JoshCKH is a sole proprietorship operated by Josh, based in Kuala Lumpur, Malaysia. For any privacy question or request, contact hello@joshckh.cloud.

2. Data we collect

When you contact us or book a call

Name, business name, email address and phone number
Anything you tell us about your business during a discovery call
Booking details captured through our scheduling provider

When we send you a business email

Business contact details (name, role, company, business email) sourced from publicly available business listings, company websites and professional directories
Whether an email was delivered, opened or replied to

When we operate WhatsApp systems for a client

Acting on our clients' instructions, we process messages sent to and from their WhatsApp Business number. This may include the sender's name, phone number, message content, booking details and conversation history. In this role we are a data processor — the client business is the data controller and decides how that data is used.

When you visit this website

This site does not use advertising cookies or third-party analytics trackers. Standard server logs (IP address, browser type, pages requested, timestamp) may be retained by our hosting provider for security and diagnostics.

3. Why we use it

Purpose	Data used
Responding to enquiries and running discovery calls	Contact details, call notes
Delivering and maintaining the service	Contact details, system configuration, client WhatsApp data
Billing and record keeping	Name, business name, billing details
Business-to-business outreach about our services	Business contact details, email engagement
Security, backups and troubleshooting	Server logs, system data

4. Legal basis and consent

We process personal data where you have given consent, where processing is necessary to perform a contract with you, or where we have a legitimate business interest that does not override your rights — such as contacting businesses about relevant services. You may withdraw consent at any time.

5. Marketing emails and opting out

Every marketing email we send includes an unsubscribe link. You can also opt out at any time by visiting our unsubscribe page, replying "unsubscribe" to any email, or emailing hello@joshckh.cloud.

Opt-out requests are actioned within 10 business days. We retain a minimal suppression record — your email address only — so that we do not contact you again. We do not sell or rent contact data to third parties.

6. Who we share data with

We share data only with service providers needed to run the service, and only to the extent required:

Meta Platforms — the official WhatsApp Business API that carries messages
Chatwoot — the shared inbox where conversations are managed
n8n — the automation layer that routes messages and triggers reminders
Stripe — subscription billing and payment processing
Cal.com — discovery call scheduling
Hostinger — website hosting
Email delivery providers used for business correspondence

Some of these providers process data outside Malaysia. Where that happens, we rely on the provider's own contractual safeguards and data protection commitments. We do not sell personal data.

7. How long we keep it

Enquiries that don't become clients: up to 24 months, then deleted
Client data: for the duration of the engagement and up to 30 days after cancellation, after which it is exported to you and deleted from our systems
Billing records: 7 years, as required for Malaysian tax and accounting purposes
Unsubscribe suppression list: retained indefinitely, so we can honour your opt-out

8. Your rights

Under the PDPA you may ask us to:

Access the personal data we hold about you
Correct data that is inaccurate, incomplete or out of date
Limit or stop processing of your data
Withdraw consent to marketing communications
Delete your data, where we are not required to retain it by law

Email hello@joshckh.cloud and we will respond within 21 days. We may ask you to verify your identity before actioning a request.

If your data is held inside a system we run on behalf of a client business, please direct your request to that business. We will assist them in responding, but they decide how their customer data is handled.

9. Security

Data is held on access-controlled infrastructure with encryption in transit, automated backups and health monitoring. Access is limited to what is necessary to operate and support the service. No system is perfectly secure, but we take reasonable technical and organisational steps to protect your data, and will notify affected parties without undue delay if a breach materially affects them.

10. Children

Our service is sold to businesses and is not directed at anyone under 18. We do not knowingly collect data from children.

11. Changes to this policy

We may update this policy from time to time. The "last updated" date at the top will always reflect the current version. Material changes affecting existing clients will be communicated directly.

12. Contact

Email: hello@joshckh.cloud
WhatsApp: +60 10-334 6241
JoshCKH, Kuala Lumpur, Malaysia