Privacy policy.

Sandboxco Sdn Bhd ("Sandbox", "we", "our", "us") is committed to protecting your personal data in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA) and its principles of notice and choice, disclosure, security, retention, data integrity and access. This policy explains what we collect, how we use and share it, and your rights.

01 · What we collect

Depending on how you interact with us (enquiry, tour, membership, meeting room, podcast or event booking, WiFi login, payments), we may collect:

• Identity & contact: name, NRIC or passport number (when required for access control), photo (for access ID), company, job title, phone, email, address.
• Transactional: plan type, booking details, invoices, payment status, deposits, refunds and credits.
• Access & IT: door access logs, WiFi device identifiers (MAC), network telemetry for security purposes, and CCTV in common areas for safety and security.
• Support & communications: emails, WhatsApp and social messages, support tickets, survey responses.
• Website & cookies: pages viewed, referral information, session data. See Cookies below.

If you provide us with someone else's personal data (teammates or guests, for example), you confirm you are authorised to do so and have informed them of this policy.

02 · Why we collect it and how we use it

• Provide services: evaluate enquiries, onboard members, manage plans and bookings for meeting rooms, the podcast studio and events, issue access, and operate the facilities 24/7.
• Billing & payments: generate invoices, process card and FPX transactions, manage deposits, refunds and credits, prevent fraud and resolve disputes.
• Operate & secure the space and IT: WiFi access, network security, CCTV, incident response, visitor management, asset protection.
• Customer support & communications: respond to requests, service notifications, operational updates.
• Marketing (opt out anytime): event updates, promotions and newsletters relevant to Sandbox services.
• Legal & compliance: record keeping, audits, regulatory requests, and enforcement of house rules and contracts.

We will not use your data for purposes incompatible with the above without your consent, consistent with PDPA principles.

03 · Whether providing data is obligatory

Where data is required for (i) access control and safety, (ii) billing and payment, or (iii) fulfilling a booking or membership, failing to supply it may mean we cannot provide the requested service or access. This disclosure forms part of the PDPA notice and choice principle.

04 · Disclosures to third parties

• Payment processors and banks, to charge and refund payments and prevent fraud.
• IT and cloud providers: hosting, email, CRM and support, booking systems, access control, WiFi.
• Professional advisors: accounting, legal, audit.
• Event partners and service vendors, only as needed to deliver a booked service.
• Authorities and regulators where required by law.

We require processors to implement appropriate security measures and to process data only on our instructions, as the PDPA expects of data controllers engaging processors.

05 · Cross-border transfers

Some providers may process data outside Malaysia. Where this happens, we apply safeguards permitted under Section 129 of the PDPA, for example obtaining your consent, using contractual protections, or where the transfer is necessary to perform a contract you have requested (such as payment processing), consistent with the 2025 Cross-Border Transfer Guidelines.

06 · Retention

We keep personal data only as long as necessary for the purposes above and for legal and accounting requirements, after which we securely delete or anonymise it, in line with the PDPA retention principle.

07 · Security

We apply appropriate technical and organisational measures: role-based access, encryption in transit where applicable, network security, logging, staff training and vendor due diligence. No system is perfect, but we work to maintain the confidentiality and integrity of personal data.

08 · Your rights

Under the PDPA you can:

• Access the personal data we hold about you;
• Correct inaccurate, incomplete or outdated data; and
• Withdraw consent, including to direct marketing, at any time; this may affect our ability to provide some services.

To exercise these rights or to make a complaint, contact info@sandboxco.space. We will respond in accordance with PDPA requirements.

09 · Direct marketing choices

You may opt out of Sandbox promotional emails, SMS and WhatsApp at any time via unsubscribe links or by contacting us. We will still send service and transactional notices, such as invoices and access alerts.

10 · Cookies & analytics

Our website may use cookies and similar technologies to operate the site, remember preferences, analyse traffic and measure campaigns. You can control cookies via your browser settings; some features may not function properly without certain cookies.

11 · Updates

We may update this policy from time to time. Material changes will be notified on our website or by email where appropriate. Please check this page for the latest version.