This notice explains how FlagOff.my processes personal data in connection with the captive portal, orders, payment verification and Access Code delivery, in accordance with the Personal Data Protection Act 2010 (PDPA).
Effective: 10 September 2026 · Version 1.0.2
1. Data we collect
Registration and order data: customer name (optional unless required), mobile or WhatsApp number, selected package, order number, order amount and payment method.
Device and connection data: device MAC address, IP address, router and location identifiers, portal context and activation records used to bind an Access Code to one device.
Payment verification data: the payment proof (image or PDF) you upload, verification outcomes and related audit records.
Support data: messages, WhatsApp or phone contact details you provide when requesting help.
We do not collect or store card numbers, banking passwords, OTPs or online banking credentials.
2. Why we process it
To register and manage your order, verify manual payments, deliver Access Codes, activate and bind devices on the hotspot, provide support, prevent fraud and abuse, maintain security and audit trails, and comply with legal obligations.
3. Disclosure to the hotspot provider
Because the Internet service is supplied by the hotspot provider, we disclose the data necessary for the provider to verify your payment and activate your access: order details, mobile number, device MAC, location and verification records.
The hotspot provider processes that data for its own service, support, refund and legal purposes and is responsible for its own PDPA compliance.
We may also disclose data to payment or technical service providers strictly as needed, and to authorities where required by Malaysian law.
4. Retention and security
Order, verification and activation records are retained for as long as needed for service, audit, dispute and legal purposes, and are then deleted or anonymised under our retention schedule.
We apply reasonable technical and organisational safeguards, including access control, rate limiting and audit logging. However, no system can be guaranteed completely secure.
5. Your rights under the PDPA
Subject to the PDPA and applicable exemptions, you may request access to your personal data, request correction, withdraw consent (which may affect our ability to provide portal services), and limit or object to certain processing.
To exercise these rights, contact the platform operator using the details below. You may also lodge a complaint with the Department of Personal Data Protection (JPDP) of Malaysia.
6. Cookies and local storage
The portal uses only essential cookies and local storage required for security, sessions and the captive-portal workflow. We do not use advertising cookies.
7. Contact
Data user / platform operator: FlagOff.my. Website: https://www.flagoff.my/. Support: contact the location admin.
