privacy

Privacy

Last updated 22 October 2026

Short version: we collect very little, we never sell it, and you can ask us to see, fix, move or delete it at any time.

Read this notice in Bahasa Malaysia

If this English notice and the Bahasa Malaysia notice ever conflict, the English version prevails.

Who we are

ImmersiveRadar is operated by GIANT SEED ENTERPRISE, Kuala Lumpur, Malaysia. We are the data controller for the personal data described here, under Malaysia's Personal Data Protection Act 2010, as amended in 2024, and under the EU and UK GDPR. Contact: [email protected]. Put “Privacy” in the subject line.

What we collect, why, and the legal basis

We use three GDPR legal bases: consent, contract, and legitimate interest. Those are also the purposes we notify you of under the PDPA.

• Newsletter. Your email address, to send the weekly email. Basis: your consent (PDPA; GDPR Art. 6(1)(a)). Kit (ConvertKit, United States), our newsletter provider, may record whether an email was opened and which links were clicked. Unsubscribe from any email, or write to us, to withdraw that consent.
• Directory profiles. The details you submit: name or artist name, handle, city, country, region, bio, disciplines, tools, portfolio and image links, social and shop links, availability, an optional day-rate range, and a public contact link. If you give a private email, we use it only to confirm or update your listing, and we never publish it. You can leave the rate blank, or set your status to not taking work. Basis: your consent, which you can withdraw at any time.
• Job-post submissions. The role details you submit, which we publish, and your contact email, which we never publish. We use them to review, publish and follow up on the post you asked us to carry. Basis: contract — steps you asked us to take (GDPR Art. 6(1)(b)).
• Form submissions (contact, takedown, and an employer enquiry to a creator). Your name, email and message, so we can reply, pass a paid enquiry on, or correct the board. Basis: our legitimate interest in running the service, answering people who write to us, and keeping listings accurate (GDPR Art. 6(1)(f)).
• Collected listings. We collect job and gig listings from public employer pages and other public sources. We keep a short summary and a link to the source. A listing may name a contact person, such as a hiring contact, or a freelancer who posted their own gig. We strip email addresses and phone numbers. Basis: our legitimate interest in a public index of paid work. If a listing names you, email [email protected] or use the takedown page. We correct or remove it within 2 days.
• Security and analytics. Cloudflare, our hosting and CDN provider, processes your IP address and basic browser data to deliver the site and to run the Turnstile bot check on forms. Cloudflare Web Analytics, when enabled, counts page views without cookies and discards the IP address rather than storing it. Basis: our legitimate interest in a secure site and in knowing which pages are used. We do not build profiles of you, and we do not use ad trackers.

Fields marked * on a form are required. If you leave one out, we cannot publish the post or profile, or reply. Every other field is optional. You can skip optional fields and still use the rest of the site.

Cookies and on-device storage

We set no cookies. If you save a job, the list stays in your own browser (localStorage) and is never sent to us. Clear it from the browser at any time. We store it there only because you asked to save the job.

Who we share it with

We never sell personal data, and we never give it to advertisers or sponsors. These service providers process data for us:

• Hosting and CDN: Cloudflare (United States, global network) hosts the site and serves it.
• Newsletter: Kit (ConvertKit, United States) stores subscriber emails when the signup form is on.
• Forms and anti-spam: Cloudflare Turnstile checks forms for bots when a site key is set. Each form also has a hidden honeypot field. When a form endpoint is set, submissions go to a provider from the launch checklist: Formspree, Web3Forms or Tally. None of those is connected yet. Until then, the form opens your email app, and the message passes through your own email provider. The mailbox for [email protected] is planned as Cloudflare Email Routing.
• Analytics: Cloudflare Web Analytics, cookieless, when enabled.

Creator profiles and job posts are public. Anyone can read them. They also appear in our RSS and JSON feeds and in embeddable widgets, so other sites may show them, and search engines may index them. When you remove a profile we stop publishing it. We cannot recall copies others have already made.

We may also disclose data where the law requires it. No AI provider is named here: none is connected in the site, and the launch checklist does not name one. If one later handles personal data, we will name it on this page first. Public listings are summarised with automated tools. A person checks a correction or a removal before we publish it.

Data outside Malaysia

The providers above process data outside Malaysia, including in the United States (Kit and Cloudflare). Under section 129 of the PDPA, as amended in 2024, we transfer personal data only where the destination has a law substantially similar to the PDPA, or the data stays adequately protected, or a statutory exception applies, such as your consent or a contract with you. Protection here is each provider's data-processing terms, including the EU Standard Contractual Clauses where they apply and, where that provider is certified, the EU-US Data Privacy Framework. If you are in the EU or the UK, data you submit comes directly to us in Malaysia. Onward processing by the providers above is the cross-border step.

How long we keep it

• Newsletter subscribers: until you unsubscribe. We then keep only that email on a suppression list, for as long as we run the newsletter, so we do not add you again.
• Form submissions: contact, takedown and employer-enquiry messages for up to 12 months, then deleted. A short log of takedown actions (the URL, the date, and what we did) is kept for 2 years so a removed item stays removed.
• Directory profiles: for as long as you want to be listed. Applications we do not publish are deleted within 6 months. A private email is deleted when the profile is removed. We ask you to reconfirm once a year, and we hide the profile if we do not hear back within 30 days.
• Job-post submissions: the post leaves the board after 30 days. Your contact email and the post record are kept for up to 12 months.
• Server and analytics logs: we do not keep our own copies. Cloudflare Web Analytics keeps unsampled page-view data for 7 days and aggregated figures for up to 6 months, and discards IP addresses rather than storing them. Cloudflare request and security logs follow that plan's retention: at least 30 days on current Cloudflare plans.

Keeping it accurate

Rates and availability change. Email us and we will update your profile. If a listing is wrong, including a name in it, email [email protected] or use takedown. We act within 2 days.

Your rights

Under the PDPA and the GDPR you can ask us to:

• give you a copy of your data (access);
• correct it;
• delete it;
• send it to you, or to another controller, in a common format (data portability, including section 43A of the PDPA), where that is technically feasible;
• stop or limit processing, including processing likely to cause you damage or distress, and any direct marketing;
• withdraw consent at any time. Withdrawal does not undo processing we already did with your consent.

To exercise these rights, email [email protected] from the address we hold for you, and say what you want (access, correction, deletion, a portable copy, a limit on processing, or withdrawal of consent). Replying from that address is how we check it is you. We answer within 21 days under the PDPA, and within one month under the GDPR, free of charge. A correction or removal of a listing is faster: within 2 days.

You can complain to the Personal Data Protection Commissioner of Malaysia (JPDP, www.pdp.gov.my). In the EU or the UK, you can complain to your local data-protection authority. We have not appointed an EU or UK representative. Use the contact above.

Security and breaches

Access to personal data is limited to the people who operate the service. We use providers that commit to keeping data secure. If a personal-data breach happens, we notify the Commissioner within 72 hours of becoming aware of it, and any relevant EU or UK authority within the same period. We tell affected people without undue delay, and within 7 days of notifying the Commissioner, when the breach is likely to cause significant harm, including what happened and what you can do. We keep a breach record for at least 2 years.

Data protection officer

Malaysian law requires a data protection officer only above a size threshold (more than 20,000 people, or a lower threshold for sensitive data or regular monitoring). We are below that threshold. Privacy questions go to [email protected]. If we appoint an officer, we will say so on this page.

Age

ImmersiveRadar is for working professionals aged 18 and over. Do not submit a profile, a job or a form if you are under 18.

Changes

We update the date at the top when this page changes. We email newsletter subscribers about any significant change.