Introduction and General Terms

My Expat (MM2H) Sdn. Bhd. (“My Expat”, “we”, “us” or “our”) respects your privacy. This Privacy Policy explains how we collect, use, disclose, retain and protect personal data when you visit www.mm2h.co, enquire about or use our Malaysia My Second Home (MM2H), immigration, relocation or related services, or otherwise interact with us.

This Privacy Policy also serves as our Personal Data Protection Notice under Malaysia’s Personal Data Protection Act 2010 (Act 709), as amended by the Personal Data Protection (Amendment) Act 2024, and applicable regulations, standards, circulars and guidelines (together, the “PDPA”).

1. Who We Are

My Expat (MM2H) Sdn. Bhd. is a licensed MM2H consultancy based in Kuala Lumpur and recognised by the Ministry of Tourism, Arts and Culture Malaysia (MOTAC). We provide advice and assistance with MM2H applications and related expatriate and relocation services.

For the processing described in this Notice, My Expat is generally the data controller. Our contact details are in Section 14.

2. Personal Data We Collect

This Notice applies to personal data collected through our website and through other channels, including consultations, application forms, email, WhatsApp, physical documents and communications with our representatives.

We do not normally request passport copies, bank statements or full MM2H application documents through the public website. Such documents are collected separately when required to assess or process an application.

Depending on your enquiry, application and services, we may collect:

• Identity and immigration data, including your name, date and place of birth, nationality, gender, photograph, signature, passport and visa details, immigration history and identification numbers.
• Contact data, including residential and correspondence addresses, email address, telephone or WhatsApp number and emergency contact details.
• Family and dependant data, including marital status, relationship information and information about a spouse, children, parents, guardians or other dependants included in or relevant to an application.
• Financial and employment data, including occupation, employer or business details, income, bank statements, account details, assets, fixed deposits, tax information, pension information, proof of funds, payment and transaction records.
• Application and service data, including forms, supporting documents, eligibility information, correspondence, appointments, instructions and records of our advice and services.
• Sensitive personal data where relevant and permitted, including health or medical information, criminal-offence or background information, and religious beliefs where voluntarily supplied or required for a specific service.
• Website and technical data, including IP address, browser and device details, pages viewed, referral information, cookie identifiers and website usage data.
• Marketing and communications data, including your communication preferences and records of emails, calls, messages and feedback.
• Supplier, partner, job applicant and business contact data relevant to our operations.

If you provide personal data about another person, including a dependant, you confirm that you are authorised to do so and, where required, have informed them of this Notice and obtained their consent. For a child or person unable to provide consent, consent must be provided by a parent, guardian or other person legally authorised to act for them.

3. How We Collect Personal Data

• Directly from you through our website, forms, email, telephone, WhatsApp, meetings, consultations, applications, payments and document submissions.
• From your spouse, family member, employer, authorised representative, introducer, agent, adviser or other person involved in your application.
• From Malaysian authorities and official bodies, banks, medical providers, insurers, screening providers, professional advisers and other organisations, where lawful and relevant.
• Automatically through cookies and similar technologies when you use our website.
• From public or legally accessible sources.

4. Purposes of Processing

As a licensed MM2H agency, we collect and process personal data to assess eligibility, prepare and manage applications, communicate with applicants and submit required information and documents to MOTAC, the Immigration Department of Malaysia and other relevant authorities or service providers.

We may process personal data to:

• assess eligibility, provide consultations and respond to enquiries;
• prepare, submit, manage and support MM2H, immigration, visa, dependant and related applications;
• verify identity, documents, qualifications, financial standing and other application requirements;
• communicate with you and manage appointments, instructions, payments and our client relationship;
• coordinate related services such as banking, medical screening, insurance, property, education, relocation, transport or other expatriate support where requested;
• comply with legal, licensing, regulatory, reporting, record-keeping, anti-fraud and governmental requirements;
• protect our rights, safety, systems and business, prevent misuse and resolve complaints or disputes;
• operate, secure, analyse and improve our website, services and client experience;
• send service updates and, where permitted or consented to, marketing communications; and
• carry out recruitment, supplier management, administration, audit and business continuity activities.

5. Consent and Consequences of Not Providing Data

Where consent is required, we will seek it in an appropriate form. You may withdraw consent by contacting us, subject to legal and contractual restrictions and reasonable notice. Withdrawal will not affect processing already carried out lawfully.

You may choose not to provide requested personal data. However, some information is mandatory for us or the relevant authorities to assess or process an application. If it is not provided, we may be unable to advise you, submit or continue an application, provide a requested service, or comply with legal requirements.

6. Disclosure of Personal Data

We may disclose personal data, only as reasonably required for the stated purposes, to:

• MOTAC, the Immigration Department of Malaysia and other Malaysian or foreign government departments, regulators, statutory bodies, embassies or consulates;
• banks and financial institutions, medical providers, insurers and other organisations involved in eligibility checks or requested services;
• our employees, authorised representatives, related companies, professional advisers, auditors, insurers and business partners;
• IT, website, cloud storage, communications, payment, document-management, identity-verification and other service providers processing data for us;
• agents, introducers, relocation providers or other third parties involved in delivering services requested or authorised by you;
• law enforcement, courts or other parties where disclosure is required or permitted by law, or necessary to establish, exercise or defend legal rights; and
• a prospective buyer, investor or successor in connection with a genuine corporate transaction, subject to appropriate confidentiality and data-protection safeguards.

We do not sell personal data.

7. Cross-Border Transfers

Your personal data may be stored in or transferred to countries outside Malaysia, including where you are located overseas, an authority or service provider is overseas, or our technology providers use overseas infrastructure. Where the PDPA applies, we will take reasonable steps to ensure that transfers comply with Malaysian law and that appropriate protection is in place. This may include contractual safeguards, security controls, due diligence, obtaining consent where required, or relying on another permitted basis for transfer.

8. Retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Notice, including the duration of an enquiry or application and any required legal, licensing, immigration, tax, accounting, audit, complaint or dispute period. Retention periods vary according to the type of record and applicable requirements. When data is no longer required, we will take reasonable steps to securely delete, destroy or anonymise it.

9. Cookies and Website Analytics

Our website may use essential, functional and analytics cookies or similar technologies to operate the site, remember preferences, understand usage and improve performance. Some cookies may be provided by third-party services. You can manage cookies through your browser and, where available, our cookie controls. Blocking cookies may affect website functionality. Further details may be provided in a separate cookie notice.

10. Direct Marketing

We may contact you about relevant services, programme updates, events or news where permitted by law or where you have consented. You can opt out at any time by using the unsubscribe method in the communication or contacting us. We may still send non-marketing messages relating to an active enquiry, application, service or legal requirement.

11. Security and Data Breaches

We use practical technical and organisational safeguards designed to protect personal data from loss, misuse, unauthorised access, disclosure, alteration or destruction. Measures may include access controls, secure storage and transmission, backups, staff confidentiality and security procedures, and service-provider oversight. No internet transmission or storage system is completely secure.

If a personal data breach occurs, we will assess and manage it in accordance with the PDPA, including notifying the Personal Data Protection Commissioner and affected individuals where legally required.

12. Your Rights

Subject to the PDPA and applicable exceptions, you may:

• request access to personal data we hold about you;
• request correction of inaccurate, incomplete, misleading or outdated personal data;
• withdraw consent to processing where processing is based on consent;
• object to or require us to stop using your personal data for direct marketing;
• ask us to stop processing that is likely to cause unwarranted substantial damage or distress, where the PDPA permits; and
• ask questions or make a complaint to Malaysia’s Personal Data Protection Commissioner if you believe your personal data has not been handled in accordance with the PDPA.

We may need to verify your identity and may charge a fee where permitted by law. We may refuse or limit a request where the PDPA permits or requires us to do so. To exercise a right, contact us using Section 14.

13. Third-Party Links and Changes to This Notice

Our website may link to third-party websites or services. Their privacy practices are outside our control, and you should review their privacy notices.

We may update this Notice to reflect changes in our services, practices or legal requirements. The current version will be posted on www.mm2h.co with its effective date. Material changes may also be notified through an appropriate channel.

14. Contact Us

Questions, requests or complaints concerning this Notice or your personal data may be directed to:

My Expat (MM2H) Sdn. Bhd.

8-02, 8th Floor, Plaza 138
138 Jalan Ampang
50450 Kuala Lumpur, Malaysia

Website: www.mm2h.co
Contact page: www.mm2h.co/get-in-touch/

Please mark your communication “Personal Data / Privacy Request” and include enough information for us to identify you and understand your request. If you are dissatisfied with our response, you may contact Malaysia’s Personal Data Protection Commissioner through the official Personal Data Protection Department channels at www.pdp.gov.my.

Back to top

My Expat (MM2H) Sdn. Bhd. (www.mm2h.co) PRIVACY POLICY: Version No: 1.0 Updated: 12 July 2026