Privacy Policy

1. Who is responsible for your information

Flagstick Ventures Sdn Bhd operates Golf24 at the venue address below. This notice covers our website, customer accounts, indoor golf reservations and related customer communications. It is intended to explain our handling of personal data under applicable Malaysian data-protection law, including the Personal Data Protection Act 2010, as amended.

This notice does not describe CCTV or other in-venue monitoring. If such monitoring is introduced or used, an appropriate separate notice must be provided at the venue. Other websites and payment, sign-in or messaging services have their own privacy notices.

2. Information we collect

• Account and profile details: your name, email address, phone number, account identifier, sign-in method and verification status. If you choose Google sign-in, the authentication service receives the profile information needed to sign you in, such as your name and email address.
• Booking and transaction details: your chosen venue or bay, date, time, duration, price, booking reference, reservation history, payment reference and payment status. We also keep the information needed to investigate a payment or refund.
• Communications: information you send through enquiries or WhatsApp, including your sender number, booking instructions, message identifiers and delivery or processing status. Please do not send card details, banking passwords or unnecessary identity documents in chat.
• Preferences and verification records: your WhatsApp opt-in choice and the information needed to verify or remove the link between a phone number and your account.
• Technical information: our hosting, authentication and security providers may process IP addresses, browser or device information, access logs and error information when you use the service.

3. How and why we use it

We seek consent where applicable law requires it. A WhatsApp booking-update preference is not permission to send unrelated advertising. We will obtain any separate permission needed before introducing optional marketing communications.

• Create and secure your account, verify your identity and provide password recovery.
• Show availability, reserve a bay, reconcile payments, provide booking records and handle changes, cancellations, refunds and disputes.
• Send service communications and respond to enquiries. We use your verified WhatsApp number for booking updates and faster bookings when you opt in.
• Prevent misuse and fraud, diagnose service failures, keep appropriate business records and meet applicable legal obligations.
• Prepare internal operational and financial reports. Access is limited to authorised staff and service providers who need the information for their work.

4. What is required and what is optional

Browsing the public website does not require an account. Your name, email or sign-in identity, and the contact and booking information requested during checkout are needed to manage an account and reservation. Without required information, we may be unable to complete the requested service.

Linking WhatsApp to your account is optional. You can change your profile and WhatsApp preference in My Account or contact us. Withdrawing optional consent does not affect processing already carried out lawfully, or records we must retain for legitimate legal and business purposes.

5. Service providers and disclosure

We disclose information only as needed to deliver the service, comply with law or protect legitimate rights. Our current website uses the following services; the information shared depends on how you use Golf24.

We do not sell personal information. Information is not made public merely because you create an account or make a booking. Keep booking QR links and verification codes private: anyone with a valid booking link may be able to view the limited booking information it authorises.

• Supabase: account authentication, customer profiles, reservations and database services.
• Vercel: website hosting and request processing, including operational and security logs.
• Billplz and the relevant payment institutions: payment checkout, transaction references, amounts and payment reconciliation. Depending on the booking channel, we provide the contact details needed to create a payment request.
• Twilio and WhatsApp/Meta: messages, phone numbers, booking communications and verification when you choose WhatsApp.
• Google: optional Google sign-in. The website also loads Google Fonts, which can involve a request from your browser to Google containing technical connection information. Opening directions takes you to Google Maps under its own terms.
• Authorised professional advisers, regulators, law-enforcement bodies or other recipients where a lawful requirement or a properly assessed legal claim requires disclosure.

6. Cookies and browser storage

The service uses essential browser storage for sign-in sessions and security. It also temporarily saves your selected booking date, duration and bay in session storage so that you can continue after signing in. A password-recovery flow may store a short-lived security marker in the same browser session.

The current website does not include advertising pixels or a third-party analytics SDK. Hosting logs and the provider requests described above still occur. If optional tracking is introduced, this notice and any required consent controls will be updated before use.

You can clear or restrict storage through your browser settings. Doing so may sign you out, clear a pending selection or prevent parts of the account service from working. Payment and messaging services may use their own cookies when you visit them.

7. Processing outside Malaysia

Our technology providers may store or process information outside Malaysia. Where personal data is transferred internationally, we will take the steps required by applicable Malaysian law, including assessing the transfer and using appropriate contractual or other safeguards. Contact us for information about the safeguards relevant to your request.

8. Retention and security

We retain information for as long as reasonably needed for the purpose for which it was collected, including account administration, bookings, accounting, tax, fraud prevention and the resolution of complaints or legal claims. Retention depends on the type of record, applicable legal obligations and whether a dispute is pending. Information that is no longer required should be deleted or anonymised in accordance with our retention process.

We use access controls, authenticated account access and other reasonable technical and organisational measures to protect information. No website or communication method can guarantee complete security. Tell us promptly if you believe your account or booking information has been misused.

9. Your requests and rights

Subject to applicable law, you may request access to or correction of your personal information, withdraw consent where processing depends on it, and ask us to explain or limit relevant processing. You may also request deletion or data portability where applicable; some records may need to be retained for legal, security or dispute-resolution reasons.

Use the privacy contact below and describe your request. We may need proportionate information to verify your identity before disclosing or changing records. We will respond within applicable legal time limits and explain any lawful restriction or charge before proceeding. You may raise unresolved data-protection concerns with the Malaysian Personal Data Protection Commissioner.

10. Children and guardians

An adult should make and manage bookings for a child. Parents or legal guardians should provide only the information necessary for the booking. If you believe a child has supplied personal information without appropriate authority, contact us so that we can assess and address it.

11. Updates and contact

We may update this notice when our services or legal requirements change. The published effective date will identify the version in use, and we will draw attention to material changes where appropriate. This draft has no effective date until the merchant details and text are finalised.

For privacy questions or requests, contact Flagstick Ventures Sdn Bhd using the merchant details below. The example email shown in this draft is not a working contact channel.