1Who this policy applies to
This Privacy Policy applies to residents, parcel owners, tenants, committee members, property management staff, security personnel, visitors, contractors, and other individuals who access SmartStrata, or whose personal data is processed through SmartStrata for property administration purposes.
2Roles, data control and Property Data
2.1 Property as the primary data controller
For Property Data processed through SmartStrata, the relevant Joint Management Body (JMB) or Management Corporation (MC) is generally treated as the primary data controller for the property. The JMB or MC determines, authorizes, or oversees the purposes for which personal data and property operational data are processed in connection with the management and administration of the property. Where a developer or other lawful management body performs the equivalent management function before the establishment of a JMB or MC, that entity may act as the relevant data controller for that period.
2.2 Appointed property management companies
A property management company appointed by the JMB, MC, developer, or other lawful management body may access and process Property Data to the extent authorized and necessary to perform its property management responsibilities. Appointment as a property management company, possession of administrative system access, or payment of a SmartStrata subscription does not by itself transfer ownership or control of the property's Property Data to the property management company. Where a property management company independently determines the purposes or means of particular processing activities, it may have separate obligations as a data controller under applicable law for those activities.
2.3 SmartStrata
SmartStrata acts as the platform operator and technology service provider supporting property administration, billing, communication, record keeping, artificial intelligence features, and other enabled operational workflows. Where APEXAI LABS SDN. BHD. processes Property Data solely on behalf of the relevant data controller, it acts as a data processor and processes that data only for authorized purposes and instructions connected with providing, securing, maintaining, and supporting the SmartStrata services, subject to applicable law. APEXAI LABS SDN. BHD. may separately act as a data controller for limited processing for which it independently determines the purposes, including its own service security, customer support, legal compliance, and business administration. SmartStrata does not acquire ownership of a property's Property Data merely because that data is stored, processed, analyzed, or generated through the SmartStrata platform.
2.4 Subscription and data control
The party that purchases, pays for, administers, or holds a SmartStrata subscription is not necessarily the data controller and does not acquire ownership of Property Data solely by reason of being the subscriber or payer. Data-controller status is determined by the applicable legal and operational relationship and by who determines, controls, or authorizes the purposes and manner in which personal data is processed.
2.5 Property Data
For the purposes of SmartStrata, "Property Data" includes data provided to SmartStrata for the administration of a property and records generated through the property's ordinary use of SmartStrata, including, where applicable:
Parcel, owner, tenant, resident, committee, and authorized-user records
Billing, payment, accounting, and financial records
Visitor, parking, issue, work permit, and operational records
Notices, correspondence, and property documents
Projects, quotations, quotation analyses, and contractor records
Committee decisions, approvals, and voting records
Contracts, renewal information, and historical records
Other operational records generated in connection with the administration of the property
Property Data remains associated with and under the control of the relevant property notwithstanding a change of committee members, building management personnel, managing agent, or appointed property management company.
2.6 Change of management company
A change in the appointed property management company does not transfer, extinguish, or reset the property's Property Data. Subject to appropriate authorization, identity verification, security controls, and applicable legal requirements, SmartStrata may transfer administrative access from an outgoing management company to the property or its newly appointed management company while preserving the property's historical records.
2.7 Leaving SmartStrata
If a property terminates its use of SmartStrata, the authorized JMB, MC, developer, or other lawful management body may request one standard export of its Property Data at no additional charge for handover or migration. The standard export covers the property's records and uploaded documents retained in the service, in agreed machine-readable formats, subject to authorization, security checks and applicable legal restrictions. It excludes other properties' data, credentials and platform intellectual property. Custom transformation, integration, migration assistance or additional bespoke work may be quoted separately and undertaken only with prior approval. This commercial handover arrangement does not limit an individual's statutory personal-data rights. Termination does not transfer ownership of Property Data to SmartStrata.
2.8 SmartStrata intellectual property
Property Data is separate from SmartStrata's platform intellectual property. SmartStrata and its operator retain all applicable rights in the SmartStrata software, source code, system architecture, algorithms, prompts, methodologies, templates, platform configurations, security systems, and other proprietary technology. A Property Data export does not include SmartStrata source code, proprietary system components, internal security information, or other SmartStrata intellectual property unless separately agreed in writing.
3Personal data we collect
Depending on the modules enabled and your role, SmartStrata may process:
Name
Email address used as a unique login identifier
Account credentials; passwords are stored as password hashes, not in readable form
Contact number for operational and emergency communication where applicable
Unit number or parcel identifier
Unit share count for maintenance fee calculation where configured by the property
Parking administration records, including vehicle identifier, lot allocation, sticker serial number, parking validity period, and status
Billing address and mailing address for billing, registered correspondence, and property administration
Visitor names, contact details, vehicle numbers, destination units, visit purposes, QR passes, arrival and departure records, parking charges, and uploaded visitor or vehicle photographs and supporting documents where captured
Basic security and session logs necessary to secure and operate the platform, and browser preferences such as the selected notice language
SmartStrata seeks to process only personal data that is reasonably necessary and not excessive for the relevant property administration or service purpose. NRIC details or copies are not required for standard account or visitor registration. Do not submit unnecessary identity documents or sensitive personal information in free text, photographs or uploads. Ordinary photographs are not used for biometric identification or facial recognition. SmartStrata may use artificial intelligence to assist authorized property workflows, such as quotation analysis, operational queries, document analysis, and administrative assistance. AI-assisted access to Property Data remains subject to the requesting user's authorized role and access permissions. Such features are not intended to create sensitive resident profiles or make decisions about residents based on protected or sensitive personal characteristics.
4How we use personal data
To create and manage user accounts and role-based access
To authenticate users and maintain platform security
To manage resident, parcel owner, committee, and staff records
To generate invoices, payment vouchers, statements, and related financial records
To support property operations such as notices, billing, parking administration, and registered correspondence
To maintain accurate historical records and institutional knowledge for legal, operational, governance, audit, continuity, and dispute resolution purposes
5Disclosure of personal data
SmartStrata does not sell personal data.
Personal data will not be disclosed for unrelated purposes or to unauthorized parties except where consent has been obtained or disclosure is otherwise permitted or required by applicable law. Personal data may be disclosed where necessary to:
The relevant property’s authorized JMB, MC, developer, or appointed management company personnel, according to their authorized role
Technology providers supporting hosting, email, backup, security, AI and messaging services, to the extent needed for enabled workflows
Authorities, advisers, or professional parties where required by law or reasonably necessary to protect legal rights
Where security-group notifications are enabled, visitor details and photographs where included may be sent through an external messaging service to the property's configured security group. This makes that information available to the group's authorized recipients. The property is responsible for controlling group membership and authorized use; sharing outside the platform is also subject to the messaging provider's terms and data-handling practices.
6Data retention
Personal data is retained only for as long as reasonably necessary for the purposes set out in this policy, including property operations, billing integrity, historical record keeping, audit, legal compliance, and dispute management.
If a resident or parcel owner sells a unit or ceases to be associated with a property, the relevant property or unit relationship may be marked inactive without disabling access to other properties or units, while selected historical records are kept where necessary for administrative continuity and lawful record retention. Personal data that is no longer required for an authorized or lawful purpose will be deleted, destroyed, anonymized, or otherwise disposed of in accordance with applicable requirements and reasonable retention procedures.
7Access, correction and deletion requests
A resident, parcel owner, or authorized user may request access to, correction of, or deletion of personal data, subject to applicable legal, operational, accounting, and audit requirements.
Where full deletion is not possible, SmartStrata or the relevant JMB, MC, developer, or authorized property management may retain only the minimum data necessary to comply with legal obligations, preserve accounting records, or establish and defend legal claims.
You may also request applicable restrictions on processing, withdraw consent in writing where processing relies on consent, or request transmission of your personal data to another data controller, subject to applicable law and technical feasibility and compatibility. Contact your property's data controller or info@smart-strata.com. Identity and authority checks may be needed to protect your data and other people's privacy. Withdrawal may affect the services that depend on that consent, but does not prevent processing otherwise permitted or required by law. Reading this policy or using the platform does not itself constitute blanket consent.
8Security measures
Password hashing and secure authentication practices
Role-based access controls
Encrypted connections where supported
Logging, monitoring, and reasonable access restriction practices
Property-level access segregation and authorization controls
Reasonable measures to protect personal data during transmission, storage, backup, and administrative access
Access review and removal when authorized users, staff, committee members, or appointed management personnel change
9Personal data breach management
SmartStrata maintains reasonable procedures to identify, contain, investigate, document, and respond to suspected personal data breaches. Where SmartStrata acts as a data processor, it will notify and cooperate with the relevant data controller as reasonably necessary to support assessment, mitigation, and any notification required under applicable law.
10Service providers and cross-border processing
SmartStrata may use cloud hosting, email, backup, security, artificial intelligence, and other technology service providers to operate the platform. Such providers may process personal data only to the extent reasonably necessary to provide their services and subject to appropriate contractual, technical, and organizational safeguards.
Where personal data is transferred or processed outside Malaysia, SmartStrata and the relevant data controller will apply the safeguards and transfer requirements required by applicable Malaysian personal data protection law.
11Personal Data Protection Notice
This Privacy Policy describes SmartStrata's general privacy practices. Where required under Malaysian personal data protection law, the relevant data controller will provide a Personal Data Protection Notice containing the required information, including purposes of processing, categories of disclosure, access and correction rights, available choices, and whether provision of particular personal data is obligatory or voluntary. Such notice should be made available in Bahasa Malaysia and English as required by applicable law.
12Updates to this policy
This Privacy Policy may be updated from time to time to reflect operational, legal, or product changes. The latest version will be published on this page together with the updated effective date.
13Contact
For privacy-related questions or requests, please contact the SmartStrata team or your relevant property management office.
Operator: SmartStrata
Operating entity: APEXAI LABS SDN. BHD.
Privacy enquiries and personal-data requests: info@smart-strata.com
Need more information?
Contact your property management office or reach out to the SmartStrata team for privacy-related enquiries.
APEXAI LABS SDN. BHD. (202601007997 (1670095X))