Last updated 27 August 2026. Written to meet the Personal Data Protection Act 2010 as amended in 2024. Counsel review is pending. This is not a regulator certification.
Who we are
Lokalhost SDN BHD (“Lokalhost”, “we”) operates lokalhost.net from Kuala Lumpur, Malaysia. Privacy contact: Contact Us (mailbox: [email protected]).
This notice covers the public website, enquiries, hosting, systems administration, PDPA work, custom software, and payments when we offer them. It is our PDPA notice for website visitors, people who write to us, and customers. A signed service agreement can add operational detail; it does not reduce the rights in this notice. On personal data, this notice and the PDPA prevail over the Terms of Service.
On a full-root VPS, you are usually the data user for what you put on the machine. We process account, billing, and infrastructure data to run the host. If we do sysadmin or PDPA consulting on your systems, we act as a processor of that content only under that engagement — we do not read customer disks by default.
Privacy-first default
You do not need an account to read this site. We do not run ad pixels, we do not sell personal data, and we do not build advertising profiles. Marketing messages go out only if you opt in.
We process personal data only when you ask us to (for example by sending a ticket), when a contract or payment cannot run without it, or when Malaysian law requires a record. That is the closed list. Everything else stays off.
What we do not do
- Sell, rent, or trade personal data.
- Use third-party advertising or analytics trackers on this site.
- Require tracking cookies to read pages. Any cookie we set later for a logged-in Client Area will be for the session, not for ads.
- Use a contact-form message for a newsletter or other marketing unless you separately opt in.
- Store full card numbers or CVV. Card data stays with the card networks and a licensed payment service provider.
- Ask for sensitive personal data (health, political, religious, and similar PDPA categories) as a condition of service. If a ticket includes it, we use it only for that request.
When we process data
These are the situations where personal data is processed. If a situation is not listed, we do not collect for it.
Browse
No account. Our servers may keep short security logs (IP address, time, user agent, requested path) to handle abuse. That is not analytics and is not used to profile you.
This public site serves IBM Plex Sans and JetBrains Mono from our own servers. We do not load fonts from Google or other third-party CDNs.
Contact form — opt-in
If you submit the form, we process your name, email, topic, message, and the consent tick so we can reply. Submitting the form is consent to that reply, not to marketing. Messages are delivered and stored with Proton Mail so we can answer from [email protected].
Customers — contract
To quote, contract, and support: name, company, contact details, billing address, service description, and tickets. Legal basis: the contract and steps you ask us to take before it.
Payments — necessary exception
If you pay by Visa, Mastercard, FPX, or another licensed rail, the card or bank network and our payment service provider process the payment. We do not store PAN or CVV. We keep what we need to match the payment to an invoice: amount, time, status, and a transaction reference or last four digits if the provider gives us that.
Hosting and operations — security and delivery
To run the service: hostnames, service IPs, access and authentication logs, and abuse reports. Legal basis: the contract and security of the network (including duties under Malaysian computer-crime and communications rules). This is not marketing.
Legal records
Invoices and accounting records are kept because the Income Tax Act 1967 and Companies Act 2016 require identifiable business records. Electronic messages that form part of a contract may be kept under the Electronic Commerce Act 2006. We cannot delete those records on request while they are still required, even if you withdraw consent for other processing.
Opt-in and opt-out
In: the contact form (to get a reply); any future newsletter, only if you tick a separate marketing box.
Out: Contact Us to withdraw marketing consent or to close an open enquiry we no longer need. We will stop optional processing.
You cannot opt out of payment settlement, tax invoices, or security logs and still keep a paid service. Those are not consent-based. If you end the contract, we stop service processing and then keep only what the law still requires.
Sharing
We share personal data only with:
- Proton Mail — to deliver and store enquiries and operational mail. That is a transfer outside Malaysia. We use Proton for encrypted transport and mailbox access control, not to expand collection. Customer compute and storage still default to Malaysian facilities.
- Licensed payment service providers and card networks (including Visa, Mastercard, and FPX where used) — to take payment. They receive what a payment needs; we do not hand them our full customer files for advertising.
- Malaysian data-centre and network upstreams — only as needed to run hosts.
- Authorities — when Malaysian law requires it.
We do not disclose personal data for other parties’ marketing.
Retention
- Enquiries: until we have handled the request, plus a short follow-up window, then delete from active mail unless a contract started.
- Marketing lists: until you withdraw.
- Security logs: a short operational window (days to a few weeks unless an incident is open).
- Invoices and tax records: seven years, as commonly required for Malaysian tax records.
- Hosting accounts: life of the contract, then the tax period above for billing records.
Security
Access is need-to-know. Mail and the public site use encryption in transit (including SMTP STARTTLS to Proton). We do not claim systems cannot be breached. We do not publish customer data in marketing.
Your PDPA rights
Subject to the PDPA, you may ask to access your personal data, correct it, withdraw consent where consent is the basis, or limit processing. We will not charge for a reasonable request. We may need enough information to verify you are the person the record is about.
Contact Us for access, correction, or other PDPA requests. We aim to respond within the time the PDPA requires. You may also complain to the Personal Data Protection Commissioner of Malaysia.
Access and deletion do not override records we must keep for tax, company law, or an open security investigation.
Incidents
If a personal-data breach meets the PDPA threshold, we will assess it and notify the Commissioner and affected individuals as the Act requires.
Children
Our services are for businesses. The site is not directed at people under 18. If you believe we have data about a child, Contact Us and we will delete it unless the law requires a record.
Changes
We will post material changes on this page with a new date. Continued use of the site after a change means you have seen the updated notice. Contract customers will be told of changes that affect how we process their account data.
Contact
Lokalhost SDN BHD, Kuala Lumpur, Malaysia.
Privacy requests: Contact Us ([email protected])