Privacy policy
Last updated: 11 October 2026
This policy explains how Kudos Creative (“we”, “us”) collects, uses and protects personal data, including data processed when we, or organisations using our PULSE platform, send messages through the WhatsApp Business Platform. We handle personal data in line with Malaysia’s Personal Data Protection Act 2010 (PDPA).
Who is responsible
Kudos Creative is responsible for personal data we collect for our own business. When we run PULSE for a client organisation, that organisation decides who is messaged and why, and we process the data on its behalf and on its instructions.
What we collect
- Contact details you or our client provide: name, mobile number and email address.
- Message data: the content of WhatsApp messages sent to you, your replies and button taps, and delivery information from WhatsApp (sent, delivered, read, failed) with timestamps.
- Link activity: when you open a link in one of our messages, the time it was opened.
- Consent records: how and when you agreed to receive WhatsApp messages.
- Account data for staff who use PULSE: name, work email, role and an audit log of their actions.
How we use it
- To send you messages you have agreed to receive, such as payment reminders, service updates and, where you opted in, offers.
- To respond to your replies and requests.
- To measure whether messages were delivered, read and acted on, so they can be improved.
- To keep records required for approvals, security and legal compliance.
We do not sell personal data, and we do not use it for advertising.
Consent and opting out
We only send WhatsApp messages to people who have agreed to receive them. You can stop promotional messages at any time by tapping “Stop promotions” or replying STOP, and you can ask us to stop all messages using the contact details below.
Who we share it with
- Meta Platforms (WhatsApp), which delivers the messages, under the WhatsApp Business terms.
- Our service providers that host the platform: Supabase (database and storage, Singapore region) and Vercel (web hosting).
- The client organisation on whose behalf a message was sent.
- Authorities, where the law requires it.
Some providers may process data outside Malaysia. We use providers that protect it to a standard comparable to the PDPA.
How long we keep it
We keep message and delivery records for as long as the client relationship needs them, and no longer than 7 years unless the law requires otherwise. Customer lists can be deleted on request.
How we protect it
Access is limited to authorised staff with individual accounts, every change is recorded in an audit log, data is encrypted in transit, and messages need internal approval before they are sent.
Your rights
You can ask to see the personal data we hold about you, correct it, withdraw your consent, or have it deleted. Email us and we will respond within 21 days.
Contact
Kudos Creative · khairul@kudoscreative.my
Changes
We may update this policy. The date at the top shows the latest version.