LEGAL

PDPA Notice

Published personal data protection notice.

Published document · review required

This is the existing policy text, dated 1 July 2026. Some product, provider and pricing references reflect the older service. It must be reconciled with the current offer before launch.

1. Purpose of this notice

This notice is issued in accordance with Malaysia's Personal Data Protection Act 2010 ("PDPA"). It applies to personal data collected by Upside on behalf of participating F&B businesses, including data collected via WhatsApp messaging, online bookings, and account setup. It supplements, and should be read alongside, our full Privacy Policy.

2. Personal data we collect

Depending on how you interact with Upside, we may collect: name and phone number (from WhatsApp conversations and bookings), message content and timestamps, order and reservation history, and — for restaurant owners — business registration and billing details.

3. Purpose of processing

We process this data to respond to enquiries and bookings via WhatsApp AI, to generate marketing campaigns and content tailored to each business, to produce analytics and a weekly CMO strategy, and to administer subscriptions and billing.

4. Disclosure to third parties

Personal data may be disclosed to the following processors strictly to deliver the service:

  • DeepSeek — used to generate AI reply drafts and campaign copy from conversation and business context.
  • Supabase — our database and file storage provider.
  • Meta — operator of the WhatsApp Business Platform used to send and receive messages.

We do not disclose personal data to third parties for their own marketing purposes.

5. Cross-border transfer

DeepSeek, Supabase, and Meta may process data on servers located outside Malaysia. Where this occurs, we require contractual safeguards from our processors intended to provide a standard of protection comparable to the PDPA.

6. Data subject rights

Under the PDPA, you have the right to: request access to your personal data; request correction of inaccurate data; withdraw consent to processing at any time; and request that we cease processing where consent is withdrawn, subject to any legal or contractual obligations that require continued processing.

7. Security & retention

We apply technical and organisational safeguards proportionate to the sensitivity of the data involved, and retain personal data only for as long as necessary to provide the service or as required by law.

8. Exercising your rights

To make a PDPA request — access, correction, or withdrawal of consent — email support@upside.com.my with your name and the phone number or account associated with your request. We aim to respond within 21 days.