Privacy Policy
What we hold about you, why we hold it, who sees it, and what you can ask us to do about it.
Last updated: 27 September 2026 · Issued by Landbar Holding Sdn Bhd (Company No. 959553-U), trading as ListingMine · Governed by the Personal Data Protection Act 2010 (Malaysia).
The short version. We hold what we need to run the software: who you are, how to reach you, your professional registration, and — where your agency uses our commission tools — your bank and identity details so that payments can be recorded correctly. We do not sell personal data, and we do not use your clients' data for our own purposes. You can ask to see what we hold, correct it, or have it removed.
1. Who is responsible
Landbar Holding Sdn Bhd (Company No. 959553-U), trading as ListingMine, is the data user for the personal data described in this policy, except where section 5 says otherwise.
This policy covers the ListingMine website, the ListingMine mobile application, the Agent OS and ERP/CRM, the ACN, the Academy, the calculators and ListingMine Music.
2. What we collect
We collect only what the Services actually need. In practice, that is:
| What | When | Why |
|---|---|---|
| Mobile number and country code | Registration — it is your login identity | To identify your account and send one-time verification codes |
| Name and password | Registration | To create and secure your account |
| Referral code | Registration, if you were referred | To attribute the referral |
| Email address | Profile | Notifications, account recovery, support |
| Postal address, profile photo, biography, and links to your Facebook, LinkedIn, X/Twitter and YouTube profiles | Profile, optional | To populate your profile and business card within the Services |
| NRIC or company registration number | Where your agency's commission and payment records require it | To identify the correct payee on vouchers and statements, and to support your agency's own record-keeping obligations |
| Bank name and account number | Where commission payments are recorded | So that payment vouchers name the right account. We do not move money — payment happens through your agency's own banking |
| REN/REA registration number and registration date | Profile, where applicable | To record your professional standing and support co-broking verification |
| Agency role, designation, upline, joining and resignation dates | Set by you or your agency | To compute commission splits and hierarchy correctly |
| Cases, listings, documents, vouchers, invoices and receipts you create or upload | As you work | To deliver the ERP/CRM |
| Academy and competency activity | As you learn | To track progress and issue results |
| Technical data — IP address, device and browser type, operating system, pages viewed, timestamps, error logs | Automatically | Security, fraud prevention, diagnosing faults, and understanding how the Services are used |
What we never collect: payment credentials. ListingMine does not operate a payment gateway and takes no payment online. We hold a bank account number so that a payment voucher can name the right account — but we never ask for, receive or store card numbers, CVV codes, online banking usernames or passwords, or payment authorisation codes. All money moves offline, outside the Services.
3. Sensitive data
Some of what we hold is sensitive: NRIC numbers, bank account details, and the identity documents attached to cases.
We collect these only where a function genuinely requires them — principally commission processing and your agency's own compliance records. They are visible only to people your agency has authorised, and to the small number of our staff who need access to operate and support the system. We never use them for marketing, profiling or analytics.
If you would rather not provide a particular item, tell us or your agency. Some features will not work without it — a payment voucher cannot name an account we do not hold — but you should not be asked for more than the task needs.
4. Why we use it
Under the PDPA we must tell you the purposes. They are:
- To provide the Services — creating your account, running the ERP/CRM, computing commission, producing vouchers and statements, operating the ACN and the Academy.
- To verify identity and secure accounts — one-time codes, login security, detecting and preventing fraud and misuse.
- To support you — answering enquiries, investigating faults.
- To improve the Services — understanding which features are used, diagnosing errors, planning work. We use aggregated and technical data for this, not the contents of your cases.
- To communicate with you — service notices, changes to terms, security alerts. These are operational and you cannot opt out of them while you hold an account.
- Marketing, where you have agreed to it. You can withdraw at any time — see section 10.
- To meet legal obligations — responding to lawful requests, keeping the records the law requires.
We do not sell personal data. We do not share it with advertisers or data brokers. We do not make decisions about you by automated means that produce legal effects.
5. Your clients' data — who is responsible for what
When an agent or agency uploads information about a client — a buyer, seller, landlord or tenant — the agency is the data user and we are processing that data on the agency's behalf.
The agency decides what is collected and why. We store and process it so the software works. We do not use it for our own purposes, and we act on the agency's instructions.
If you are a client of an agency that uses ListingMine and you want to see, correct or remove your data, please contact that agency first — they control it. If you cannot reach them, contact us and we will help you get to the right place.
Agencies: your obligations under the PDPA are yours. Our Terms of Use set out what you undertake when you upload personal data.
6. Who we share it with
We share personal data only where it is necessary, and only with these categories:
- Your agency and your team. If you are part of an agency, the people it authorises can see the data your role exposes to them — cases, commission records, hierarchy.
- Co-broking counterparties, where you choose to share a case or cooperate through the ACN. You control what is shared.
- Our hosting provider, whose servers run the Services and hold the files you upload.
- Communication providers who deliver our email, one-time codes and push notifications — including email delivery services, WhatsApp/SMS for verification codes, and mobile push notification infrastructure.
- Analytics — Google Analytics, as described in section 7.
- Partner platforms you connect, such as Affirmplus, and only the data needed for that connection.
- Professional advisers — lawyers, auditors — under duties of confidence.
- Authorities, where we are required by law, court order or a valid regulatory request.
- A successor, if the business is reorganised, merged or sold. We would tell you, and this policy would continue to apply until replaced.
Our providers act on our instructions and are bound to protect the data. They are not permitted to use it for their own purposes.
7. Cookies and analytics
We keep this deliberately light.
- Essential cookies keep you logged in and keep your session secure. Without them the Services cannot work.
- Google Analytics 4 (property
G-J7B8V5F9V5) tells us how many people visit, which pages they read and roughly where they are. It is configured for measurement, not advertising. Google's own privacy terms apply to what it collects. - Some pages load fonts, icons and script libraries from a content delivery network, and embed video from YouTube. Those providers may see your IP address as part of delivering the content.
We do not run advertising pixels, retargeting tags or session-recording tools on the website. If that changes, we will update this policy and, where the law requires, ask for your consent first.
You can block or delete cookies in your browser, and opt out of Google Analytics using Google's browser add-on. Blocking essential cookies will stop you being able to log in.
8. How long we keep it
We keep personal data only as long as there is a reason to:
| Data | Kept for |
|---|---|
| Account and profile | While your account is open, then two years after closure, so you can reactivate and so we can resolve any dispute |
| Commission, voucher, invoice and receipt records | Seven years, to meet Malaysian tax and accounting record-keeping requirements |
| Case documents uploaded by an agency | As directed by that agency, subject to its own retention obligations |
| Technical and security logs | Two years |
| Marketing preferences | Until you withdraw, plus a record of the withdrawal so we can honour it |
When a retention period ends we delete the data or irreversibly anonymise it. Backups are overwritten on their own cycle, so a deleted item may persist in backup for a short period before it is gone for good.
9. How we protect it
We take the security of this data seriously, particularly the identity and banking details. Our measures include encryption in transit, hashed passwords, one-time code verification at login, role-based access so people see only what their role requires, access logging, and restricting staff access to those who need it.
No system is perfectly secure, and we do not claim otherwise. If a breach occurs that is likely to cause you significant harm, we will tell you and the relevant authority promptly, and explain what happened and what we are doing about it.
10. Your rights
Under the PDPA you may:
- Ask what we hold about you, and get a copy;
- Correct anything inaccurate, incomplete or out of date;
- Withdraw consent to processing that relies on it — marketing, for instance;
- Limit processing for direct marketing, at any time and without charge;
- Ask us to delete data we no longer have a reason to keep;
- Complain to the Personal Data Protection Commissioner if you believe we have not met our obligations.
Write to us using the details in section 14. We will respond within 21 days as the PDPA requires. We may need to verify your identity first — we will not hand your data to someone claiming to be you.
Where the data belongs to a case owned by an agency, see section 5: the agency decides, and we will point you to them.
11. Where your data is held
ListingMine is hosted with a commercial hosting provider. Our hosting is presently configured for Malaysia, and the files you upload — case documents, identity documents, vouchers and receipts — are stored on that hosting rather than in a separate foreign cloud storage service.
We cannot promise that data will remain in one country at all times. Hosting and infrastructure providers may store, replicate, back up or route data through other locations for resilience, maintenance or performance, and they may change those arrangements without our involvement. We may also change provider or region ourselves. Where that happens we rely on the contractual and technical protections those providers offer.
Separately, some supporting services operate outside Malaysia by their nature:
- Google Analytics receives technical and usage data about website visits;
- Email delivery providers receive the address and content of the emails we send you;
- WhatsApp and SMS gateways receive your mobile number, to deliver one-time verification codes;
- Push notification infrastructure receives a device token, to deliver notifications to the app;
- Content delivery networks and embedded video may see your IP address as part of loading a page.
Wherever personal data is held or transferred, we take reasonable steps to ensure it is protected to a standard comparable with that required by the PDPA, through the contractual terms our providers offer. If you need to know the current hosting arrangement for a specific purpose, ask us and we will tell you what it is at that time.
12. Children
The Services are for working professionals and are not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us data, tell us and we will delete it.
13. Changes
We may update this policy. The "last updated" date at the top always reflects the current version. Where a change materially affects how we handle your data, we will notify you in the app or by message before it takes effect.
14. How to reach us
For any privacy question, access or correction request, or complaint:
Landbar Holding Sdn Bhd (Company No. 959553-U), trading as ListingMine
Email: [email protected]
WhatsApp: +60 16-383 2819
If you are not satisfied with our response, you may complain to the Personal Data Protection Department (Jabatan Perlindungan Data Peribadi), Malaysia.