Privacy Policy

This notice explains what personal data Barterly collects, why we collect it, who we share it with, and the rights you have over it. It is issued in English and Bahasa Malaysia; both versions have equal effect, and in the event of any inconsistency the English version prevails.

1. Who We Are & Our Data Protection Officer: Barterly is owned and operated by AMK Energy Sdn Bhd (202601028791), a company incorporated in Malaysia, which is the data controller responsible for your personal data. We handle personal data in accordance with the Malaysian Personal Data Protection Act 2010 (PDPA) and, for our Singapore members, the Singapore Personal Data Protection Act 2012. Our Data Protection Officer can be reached at support@barr-ter.com (please mark your message "Attn: DPO"). The DPO is our contact point for all access, correction, deletion, portability, withdrawal, and complaint requests.

2. Personal Data We Collect: We collect the following categories of personal data, all of which you provide to us directly or which is generated by your use of the platform — we do not buy personal data from third parties:

• Account data — name, email address, password credentials (stored in hashed form by our authentication provider), and account role.
• Optional contact data — mobile phone number, if you choose to provide one.
• Listing data — item titles, descriptions, photos, videos, declared values, and any value-proof documents you upload.
• Location data — general location only (city, postcode, country, and approximate coordinates for distance display). We do not track your precise or continuous location.
• Transaction data — trades, bids, giveaways, platform fee payment records, receipts, and reviews.
• Communications — in-app chat messages, trade messages, forum posts, and support correspondence.
• Technical data — session and authentication cookies, and the country inferred from your IP address for market and currency selection.

3. Purposes & Legal Basis: We process your personal data to create and secure your account; publish your listings; match, facilitate, and record trades, auctions, and giveaways; operate in-app messaging and the community forum; collect platform service fees and issue receipts; send transactional notifications and reminders; display community reputation and reviews; prevent fraud, abuse, and prohibited listings; comply with legal, tax, and accounting obligations; and improve the platform. For our Malaysian members we rely on your consent given at registration, and on processing necessary for the performance of a transaction you have entered into and for compliance with our legal obligations. For our Singapore members we rely on consent, deemed consent (where you voluntarily provide data for an obvious purpose, such as sharing contact details to complete a handover), and legitimate interests (fraud prevention, platform security, and record-keeping).

4. Whether Provision Is Obligatory: Supplying your name and email address is obligatory — without them we cannot create your account or operate the platform for you, and registration cannot proceed. All other data is voluntary, but withholding it limits certain features: without location data we cannot show nearby listings or distance; without a phone number your counterparty receives only your email address for handover coordination; without a value-proof document your listing cannot display the "Value Verified" badge.

5. Who We Disclose Your Data To: We do not sell your personal data. We disclose it only to the following classes of third parties, and only to the extent necessary:

• Your trade counterparty — your email address, and phone number if provided, after the platform fee is paid and the trade is confirmed (see section 10).
• Payment providers — Stripe and CHIP, to process platform service fees and handle refunds and chargebacks.
• Cloud hosting, database, and authentication providers — to host and secure the platform.
• Email and notification providers — to deliver transactional emails and reminders.
• AI service providers — for the optional AI market price check, using listing details only and never your personal data (see section 12).
• Professional advisers, auditors, and regulators — where required for legal, tax, audit, or law-enforcement purposes, or to protect our rights.

6. Cross-Border Transfers: Your data may be stored and processed on secure servers operated by our infrastructure, payment, and communication providers, which may be located outside Malaysia and Singapore. Where we transfer personal data abroad, we do so only where the receiving jurisdiction has laws substantially similar to the Malaysian PDPA, or where we have taken reasonable steps and contractual measures to ensure the recipient affords the data a standard of protection comparable to that required under the Malaysian PDPA and the Transfer Limitation Obligation of the Singapore PDPA.

7. How Long We Keep It: We retain personal data only for as long as necessary for the purposes above:

• Account and listing data — for as long as your account is active, and deleted or anonymised within 90 days of account closure.
• Payment, fee, and receipt records — retained for 7 years after the transaction to meet Malaysian and Singaporean tax, accounting, and audit obligations, after which they are deleted or anonymised.
• Trade and chat records — retained for 24 months after a trade concludes, to support dispute resolution and fraud investigation.
• Reviews and reputation signals — retained while your account is active; on closure they are anonymised rather than deleted, so other members' trade histories remain intact.

8. Your Rights: You may, at any time and free of charge, ask us to: access the personal data we hold about you; correct data that is inaccurate, incomplete, or out of date; delete your account and associated data; receive a copy of your data in a portable, machine-readable format (data portability); withdraw your consent to processing; and opt out of direct marketing. You can also close your account yourself at any time from your Profile page: this immediately withdraws your listings, cancels your active bids and stops all notifications, and your personal profile details (name, phone number, photo and alert preferences) are permanently scrubbed after a 30-day grace period, within which you may email us to have the account restored. Accounts cannot be closed while a trade or won auction is still in progress, so that your counterparty is not left mid-exchange. Send other requests to our DPO at support@barr-ter.com. We will respond within 30 days, or tell you within that period when we will be able to respond. If you withdraw consent or request deletion, we will close your account and stop processing, except where we are legally required to retain records (see section 7) — you should be aware that this means you will no longer be able to trade, bid, list, or post on the platform.

9. Direct Marketing: We send marketing and launch announcements only to members and waitlist subscribers who have signed up, and every such email contains an unsubscribe link. You may also instruct us to stop at any time by emailing our DPO. We do not use your phone number for marketing calls or SMS — phone numbers are used solely to coordinate a confirmed trade handover — so no Do Not Call Registry check is required for our messaging.

10. Privacy-First Contact Model: To protect every member, we operate on a privacy-first basis. While a trade, auction, or giveaway is in progress, your personal contact details (phone number and home address) are never shared with the other party. All coordination happens through Barterly's built-in chat, and our messaging system actively blocks phone numbers and contact details from being exchanged prematurely. Contact information is exchanged only after the platform fee is paid and the trade is confirmed, and only between the two parties involved: both sides receive each other's email address (and phone number, if provided). Your details are never revealed to anyone other than your confirmed counterparty, and are never displayed publicly on listings.

11. Security & Data Breaches: We apply technical and organisational safeguards including encrypted transport, hashed credentials, row-level database access controls, and role-restricted administrative access, and we require our processors to apply comparable safeguards. If a personal data breach occurs, we will notify the Personal Data Protection Commissioner of Malaysia as soon as practicable and no later than 72 hours after becoming aware of it, and the Personal Data Protection Commission of Singapore within 3 calendar days of assessing the breach as notifiable. Where a breach is likely to cause you significant harm, we will notify you directly without unnecessary delay and no later than 7 days after notifying the regulator.

12. AI Price Guidance Data: If you choose to run the optional AI market price check when listing an item, only the listing details you provided (title, description, category, condition, estimated value, country, and currency) are processed by our AI provider together with publicly available market data. No personal data — such as your name, email, phone number, or precise location — is included in this analysis, and the results are shown only to you.

13. Value Proof Documents: Receipts or appraisals voluntarily uploaded for the "Value Verified" badge are stored securely and used solely to display the badge on your listing. The document itself is never shown publicly or shared with other members. Please redact any personal data you do not wish us to hold before uploading.

14. Cookies: We use essential cookies for authentication and session management only. We do not use third-party advertising or cross-site tracking cookies.

15. Minors: Barterly is not intended for children. You must be at least 18 years old to register, trade, bid, or pay fees on the platform. We do not knowingly collect personal data from anyone under 18; if we become aware that we have, we will delete the account and its data promptly.

16. Complaints: If you are unhappy with how we handle your personal data, please contact our DPO first at support@barr-ter.com so we can try to resolve it. You also have the right to lodge a complaint with the regulator: the Personal Data Protection Commissioner, Malaysia (Jabatan Perlindungan Data Peribadi) or the Personal Data Protection Commission (PDPC), Singapore.

17. Changes to This Notice: We may update this notice from time to time. The "Last updated" date at the top of this page always reflects the current version, and where changes are material we will notify registered members by email or through an in-app notice before they take effect.