Privacy Policy

Effective date: 6 May 2026

Last updated: 6 May 2026

1. Who We Are

This Privacy Policy explains how NewBond Care Sdn Bhd ("NewBond", "we", "us", or "our"), operator of NewBond Confinement Centre, located at 7, Jalan Batai, Bukit Damansara, 50490 Kuala Lumpur, Malaysia, collects, uses, discloses, retains, and protects personal data of visitors to our website https://newbondcare.com.my, users of our social media pages, and users of any application we operate on Meta platforms (including Facebook and Instagram).

We are the data controller of personal data collected through these channels. We comply with the Malaysian Personal Data Protection Act 2010 (PDPA) and, where applicable, with Meta Platform Terms and Developer Policies.

2. Information We Collect

We collect the following categories of personal data:

2.1 Information you provide directly

• Full name, phone/WhatsApp number, email address, residential address;
• Expected due date (EDD), package preference, preferred language;
• Messages, enquiries, feedback, and any other content you send us;
• Photos or testimonials you choose to share with us (always with your written consent before public use).

2.2 Information from Meta platforms (Facebook / Instagram)

If you interact with us through our Facebook Page, Instagram account, Messenger, Instagram Direct, or by using "Login with Facebook", we may receive limited information that Meta makes available to us, which may include:

• Your public profile information (name, profile picture, public username, age range, locale);
• Your email address (only if you grant the email permission);
• The content of messages you send us through Messenger or Instagram Direct;
• Comments, reactions, and tags you make on our content;
• Page-level insights and aggregated analytics provided by Meta about how users engage with our Page or content (this is anonymised aggregate data, we do not see individual user activity beyond what is described above);
• Lead information you submit through Meta Lead Ads forms or Click-to-Message ads (typically name, phone, email, and answers to qualifying questions you choose to provide).

We only request the minimum permissions necessary to provide our services and we never request access to your friends list, private posts, or other data unrelated to your enquiry.

2.3 Information collected automatically

• Technical data such as IP address, browser type, device type, operating system, and referring URL;
• Usage data such as pages visited, time on page, and clicks, collected through Google Tag Manager, Google Analytics, and the Meta Pixel;
• Cookies and similar technologies (see Section 7).

3. How We Use Your Information

We use personal data only for the following purposes:

• Responding to enquiries and bookings, and providing confinement-care services to you and your baby;
• Communicating with you via phone, WhatsApp, email, Messenger, or Instagram Direct in connection with your enquiry, booking, or stay;
• Sending service-related updates such as booking confirmations, reminders, and post-stay follow-up;
• Improving our website, services, and customer experience through analytics;
• Measuring the effectiveness of our advertising on Meta platforms and Google;
• Complying with our legal, regulatory, accounting, and tax obligations in Malaysia;
• Protecting our legitimate interests, the rights of our staff, the safety of our guests, and the security of our systems.

4. How We Share Your Information

We do not sell your personal data. We share it only in the limited circumstances below:

• Service providers we rely on to operate our business, for example, our website host (DigitalOcean), email and form delivery (Google Workspace, Google Apps Script), CDN and security (Cloudflare), analytics (Google Analytics), and customer messaging (WhatsApp Business, Meta Messenger). These providers process data on our behalf under contractual confidentiality and security obligations.
• Meta Platforms, Inc., when you message us or interact with us on Facebook or Instagram, your interaction is also subject to Meta's own Privacy Policy.
• Professional advisers such as accountants, auditors, and lawyers, where reasonably required.
• Legal and regulatory authorities where we are required by law, court order, or other legal process to disclose data.
• Business transfers, if we are involved in a merger, acquisition, or sale of assets, personal data may be transferred to the relevant party, subject to confidentiality and the protections of this Policy.

We never share photos or details of mothers or babies in any public material without explicit written consent.

5. International Transfers

Some of our service providers (including Meta, Google, Cloudflare, and DigitalOcean) operate servers outside Malaysia. Where personal data is transferred outside Malaysia, we take reasonable steps to ensure that the data continues to be protected to a standard comparable to that required under the Malaysian PDPA, including through provider-level data processing agreements.

6. Data Retention

We keep your personal data only for as long as is necessary for the purposes described in this Policy, or as required by law. In practice:

• Enquiry records are kept for up to 24 months after your last contact with us, then deleted or anonymised;
• Booking and stay records are kept for up to 7 years to comply with Malaysian accounting, tax, and statutory record-keeping requirements;
• Messenger and Instagram Direct conversations are kept on Meta's platforms in line with Meta's retention policies; copies retained by us are deleted after 24 months unless required for an active service or legal matter;
• Analytics data is retained in line with the default settings of the relevant tool (typically 14-26 months) and is held in aggregated, non-identifying form thereafter.

7. Cookies and Tracking

Our website uses cookies and similar technologies to operate the site, remember your preferences, measure traffic, and improve our marketing. We use:

• Strictly necessary cookies that the site cannot function without;
• Analytics cookies (Google Analytics via Google Tag Manager) that help us understand site usage in aggregate;
• Advertising and measurement cookies including the Meta Pixel, used to measure the performance of our Facebook and Instagram advertising and, where you have consented on Meta's platform, to show you relevant ads.

You can disable cookies in your browser settings or through the privacy controls on Facebook and Instagram. Disabling cookies may affect the functionality of the site.

8. Your Rights

Under the Malaysian PDPA and, where applicable, other privacy laws, you have the right to:

• Access a copy of the personal data we hold about you;
• Correct any inaccurate or incomplete data;
• Withdraw consent for any processing that is based on your consent;
• Limit our processing or object to certain types of processing (such as direct marketing);
• Request deletion of your personal data (see Section 9 below);
• Lodge a complaint with the Personal Data Protection Department of Malaysia (JPDP) at www.pdp.gov.my.

To exercise any of these rights, contact us using the details in Section 10. We will respond within a reasonable time, and within any timeframe required by law.

9. Data Deletion Request

If you would like us to delete personal data we hold about you, including any data we received from your interaction with us via Facebook, Instagram, or Messenger, you can request deletion in any of the following ways:

• Email us at customer@newbondcare.com.my with the subject line "Data Deletion Request";
• WhatsApp us at +60 12-689 3288 stating that you would like to request data deletion;
• Write to us at: NewBond Care Sdn Bhd, 7, Jalan Batai, Bukit Damansara, 50490 Kuala Lumpur, Malaysia.

Please include enough information for us to identify you (for example, the name, phone number, or email address you used when contacting us, or the Facebook/Instagram username you messaged us from). We may ask for further verification before processing the request.

We will confirm receipt of your request within 7 days and complete deletion within 30 days, except where we are legally required to retain certain records (for example, accounting and tax records). In that case we will tell you which data we must retain and for how long.

If your request relates specifically to data we received via Meta platforms, you can also revoke our app's access at any time by visiting Facebook → Settings & Privacy → Settings → Apps and Websites (or the equivalent Instagram setting) and removing NewBond from the list. Doing so will instruct Meta to stop sharing your data with us going forward.

10. How to Contact Us

For any privacy questions, requests, or complaints, please contact our Privacy Officer:

11. Children's Privacy

Our services are intended for adults (typically expecting or new mothers and their families). We do not knowingly collect personal data directly from children under the age of 13. If you believe a child has provided us personal data without parental consent, please contact us and we will take steps to delete it.

12. Security

We implement reasonable administrative, technical, and physical safeguards designed to protect personal data against unauthorised access, loss, misuse, alteration, or destruction. These include encryption in transit (HTTPS/TLS), access controls, staff training, and provider-level security commitments. No method of transmission or storage is 100% secure, however, and we cannot guarantee absolute security.

13. Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. The "Last updated" date at the top of this page shows when the policy was most recently revised. Material changes will be communicated through a prominent notice on our website. Continued use of our services after a change indicates acceptance of the revised policy.

14. Language

This Privacy Policy is also available in 中文 (Chinese). In the event of any inconsistency between the English and Chinese versions, the English version prevails.