1. Who controls your personal data
PITCH MY STORY NETWORK, trading as PitchMyStory, is the data user responsible for personal data described in this notice. This notice applies to customers, customer representatives, media contacts, journalists and editors, subscribers, website visitors and other people whose data is handled through the service.
- Trading name
- PitchMyStory
- Registered entity
- PITCH MY STORY NETWORK
- Registration number
- 202603187243 (TR0346113-K)
- Telephone
- +60176721376
2. Personal data we collect
The data collected depends on how you interact with us. Please do not upload identity documents, health information or other sensitive personal data unless we specifically request it and explain why it is needed.
- Identity and contact data: name, role, organisation, registration number where supplied, email, telephone, account identifier, billing details and correspondence.
- Release data: drafts, approved text, quotations, named media contact, photographs, logos, supporting files, websites, requested targeting, schedule, revisions and approvals.
- Media-directory data: professional name, role, outlet, desk, work email, region, language, topics, source URL or source description, subscription and consent evidence, verification status, last verification date and notes.
- Transaction data: package, amount, currency, tax treatment, order and provider references, payment and refund status, invoices and chargeback information. We do not store raw card numbers or security codes.
- Technical and usage data: IP address, browser and device information, essential session data, authentication events, pages and actions, timestamps, audit history, security signals and approximate location derived from IP where used.
- Distribution data: recipient-selection reason, send time, provider message ID, delivery, delay, bounce, complaint, open, click, unsubscribe, suppression and verified pickup events.
3. Where data comes from
We collect data directly from you, from the organisation or client you represent, from other authorised users on an order, and from Stripe, Supabase, Vercel, Resend and other disclosed service providers. Professional media-contact data may also come from the individual, an outlet's official website or masthead, a public professional directory or profile, a referral, or a lawfully obtained and authorised import. We record the source where reasonably practicable and do not purchase undisclosed consumer lists.
4. Purposes and legal grounds
We process personal data only for relevant purposes and on grounds permitted by the Personal Data Protection Act 2010. Depending on the context, the ground may be consent, steps requested before or performance of a contract, compliance with law, protection of vital interests, administration of justice or public functions, or a legitimate interest that does not override the individual's rights.
- Create and secure accounts; authenticate users; recover access; and prevent fraud or misuse.
- Validate submissions; conduct editorial and rights review; communicate revisions; publish, schedule, correct or remove releases.
- Process orders, payments, refunds, invoices, tax and accounting records, and resolve disputes.
- Select relevant media recipients, send approved releases, operate subscriptions and preferences, maintain suppressions, and create distribution reports.
- Provide support; respond to rights requests and complaints; audit staff activity; investigate incidents; protect the service and comply with lawful requests.
- Measure and improve the service using proportionate analytics. We do not place release drafts or the private contact directory into advertising profiles.
- Send customer product news or offers only where permitted and honour withdrawal or opt-out choices.
5. Public releases and media distribution
An approved Newswire page is public and may be indexed, cached, quoted, copied or archived by search engines and third parties. It may contain the company name, release text, website, approved assets and the media-contact details the customer chose for publication. Customers must avoid unnecessary personal data and obtain permission from individuals named in a release.
Approved material and its public URL may be sent directly to relevant professional media contacts. Customers receive aggregate or recipient-level operational reporting where appropriate, but do not receive the private media directory or unrelated contact data. Publication on PitchMyStory and email delivery do not establish external media publication.
6. Journalist subscriptions, professional outreach and suppression
Journalists and editors may subscribe and state their language, region and coverage preferences. A subscription is activated only after confirmation. Where permitted and operationally approved, we may send relevant professional press releases to a publicly listed or otherwise lawfully sourced newsroom contact. Every media message identifies the sender, contains the release in the email, and provides a visible unsubscribe option and standards-based one-click suppression.
We stop promotional or distribution email to an address after a valid unsubscribe, permanent bounce or complaint. A minimal suppression record is retained so that the address is not accidentally re-added. We do not sell the media directory.
7. Who receives data
We disclose only the data reasonably needed for the stated purpose. Recipients may include authorised PitchMyStory staff and contractors; the customer and authorised order users; the public and media recipients for approved release content; Supabase for database, authentication and storage; Vercel for hosting and application delivery; Stripe for payment processing; Resend for email delivery; professional advisers, auditors and insurers; regulators, law-enforcement bodies or courts where required; and a successor in a genuine corporate transaction subject to confidentiality and law.
Each service provider is expected to act under appropriate contractual, confidentiality and security duties. Their own notices apply where they independently control data, such as payment-account or newsroom activity.
8. Processing outside Malaysia
The service uses international cloud, payment and email providers, so customer, account, transaction, release, technical and distribution data may be accessed or processed outside Malaysia. Destinations depend on provider infrastructure and may include Singapore, the United States and other locations disclosed by the provider. Before a transfer, we use a ground allowed by Malaysian law and proportionate safeguards such as a contract, access restriction, encryption, provider due diligence and documented transfer review. Where consent is the transfer ground, we request and record it. Contact us for the current classes of recipients and transfer information relevant to your data.
9. Retention
We keep data only as long as reasonably needed for the purpose, legal duties, security, evidence and dispute resolution. The following operational periods apply unless a longer or shorter period is required by law, a claim, an investigation or a valid deletion request:
- Unpaid or abandoned submission drafts and associated uploads: up to 90 days after the last activity.
- Account and support profile data: while the account is active and generally 24 months after closure or last meaningful activity.
- Public releases: while published; after correction or removal, limited versions and audit evidence may remain for up to 24 months, subject to legal and archival needs.
- Orders, payment and refund references, invoices, policy acceptances, accounting evidence and material complaint records: seven years after the transaction or resolution.
- Distribution events and recipient-selection evidence: generally 24 months after the send. Permanent-bounce, complaint and unsubscribe suppression data: for as long as needed to honour the suppression and operate the programme.
- Routine security and access logs: generally up to 12 months; incident records may be kept longer. Encrypted backups expire on a rolling schedule, generally within 90 days after deletion from live systems.
10. Security and data breaches
We use role-based access, database row-level policies, private object storage, encryption in transit, restricted service credentials, signed links, input and file validation, audit records, webhook verification, backups and supplier controls. No service is completely secure. If a personal-data breach occurs, we will contain and assess it, preserve evidence, and notify the Personal Data Protection Commissioner within the applicable period where required. We will notify affected individuals without unnecessary delay where the breach is likely to cause significant harm and provide practical protective steps.
11. Your choices and rights
Subject to the Act and permitted exceptions, you may ask whether we process your data; request access to and a copy of it; correct incomplete, inaccurate, misleading or outdated data; withdraw consent; object to or stop direct marketing; limit processing likely to cause damage or distress; and complain about our handling. You may unsubscribe from media email at any time. Withdrawal does not invalidate earlier lawful processing, and we may keep restricted data required by law or to honour a suppression.
We do not currently make decisions producing legal or similarly significant effects solely by automated processing. Recipient matching, fraud signals and suppression rules may be automated, but material editorial and account decisions remain subject to human review. If this changes, we will provide the information and human-review rights required by law.
12. Exercising rights and complaints
Email editorial@pitchmystory.com with the subject “Privacy request”. Describe the request and the account, order or email address involved. We may request proportionate identity evidence and authority if you act for another person. We aim to acknowledge a request promptly and respond within the period required by law. If dissatisfied, you may contact the Personal Data Protection Commissioner of Malaysia.
13. Cookies, children and changes
Essential cookies and similar storage keep sessions secure, remember a submission and prevent abuse. Optional analytics should run only after the required choice and should not receive release bodies, payment credentials or the private media directory. PitchMyStory is a business service not directed to children under 18; do not submit a child's personal data without a lawful basis and appropriate authority.
We may update this notice when the service, vendors or law changes. The current date and version appear above. A material change affecting existing users will be communicated by a proportionate notice and, where required, fresh consent.
1. Siapa yang mengawal data peribadi anda
PITCH MY STORY NETWORK, yang berdagang sebagai PitchMyStory, ialah pengguna data yang bertanggungjawab terhadap data peribadi dalam notis ini. Notis ini terpakai kepada pelanggan, wakil pelanggan, hubungan media, wartawan dan editor, pelanggan senarai, pelawat laman dan individu lain yang datanya dikendalikan melalui perkhidmatan.
- Nama dagangan
- PitchMyStory
- Entiti berdaftar
- PITCH MY STORY NETWORK
- Nombor pendaftaran
- 202603187243 (TR0346113-K)
- Telefon
- +60176721376
2. Data peribadi yang kami kumpul
Data bergantung pada cara anda berinteraksi dengan kami. Jangan muat naik dokumen pengenalan, maklumat kesihatan atau data peribadi sensitif lain melainkan kami memintanya secara khusus dan menerangkan keperluannya.
- Data identiti dan hubungan: nama, jawatan, organisasi, nombor pendaftaran jika diberi, e-mel, telefon, pengenal akaun, butiran pengebilan dan surat-menyurat.
- Data siaran: draf, teks diluluskan, petikan, hubungan media, foto, logo, fail sokongan, laman web, sasaran, jadual, pindaan dan kelulusan.
- Data direktori media: nama profesional, peranan, saluran, meja berita, e-mel kerja, wilayah, bahasa, topik, sumber, bukti langganan atau persetujuan, status dan tarikh pengesahan serta nota.
- Data transaksi: pakej, amaun, mata wang, layanan cukai, rujukan pesanan dan penyedia, status pembayaran atau bayaran balik, invois dan maklumat pertikaian. Kami tidak menyimpan nombor kad mentah atau kod keselamatan.
- Data teknikal dan penggunaan: alamat IP, pelayar dan peranti, sesi penting, peristiwa pengesahan, tindakan, cap masa, audit dan isyarat keselamatan.
- Data pengedaran: sebab pemilihan penerima, masa penghantaran, ID mesej, penghantaran, kelewatan, lantunan, aduan, buka, klik, berhenti melanggan, sekatan dan liputan disahkan.
3. Sumber data
Kami mengumpul data terus daripada anda, organisasi atau pelanggan yang anda wakili, pengguna sah lain dalam pesanan, dan penyedia seperti Stripe, Supabase, Vercel dan Resend. Data hubungan media profesional juga boleh datang daripada individu, laman rasmi atau masthead saluran, direktori atau profil profesional awam, rujukan, atau import yang diperoleh dan dibenarkan secara sah. Kami merekod sumber jika munasabah dan tidak membeli senarai pengguna yang tidak didedahkan.
4. Tujuan dan asas yang sah
Kami memproses data hanya untuk tujuan berkaitan dan atas asas yang dibenarkan oleh Akta Perlindungan Data Peribadi 2010. Mengikut keadaan, asasnya mungkin persetujuan, langkah sebelum atau pelaksanaan kontrak, pematuhan undang-undang, perlindungan kepentingan penting, pentadbiran keadilan atau fungsi awam, atau kepentingan sah yang tidak mengatasi hak individu.
- Mencipta dan melindungi akaun, mengesahkan pengguna, memulihkan akses dan mencegah fraud atau penyalahgunaan.
- Mengesahkan penyerahan, menjalankan semakan editorial dan hak, berkomunikasi mengenai pindaan, menerbit, menjadual, membetulkan atau mengalih keluar siaran.
- Memproses pesanan, pembayaran, bayaran balik, invois, rekod cukai dan perakaunan serta pertikaian.
- Memilih penerima media berkaitan, menghantar siaran, mengurus langganan dan pilihan, mengekalkan sekatan serta menghasilkan laporan.
- Memberi sokongan, menjawab permintaan hak dan aduan, mengaudit aktiviti, menyiasat insiden, melindungi perkhidmatan dan mematuhi permintaan sah.
- Mengukur dan menambah baik perkhidmatan secara berkadar tanpa meletakkan draf atau direktori peribadi dalam profil iklan.
- Menghantar berita atau tawaran pelanggan hanya apabila dibenarkan serta menghormati penarikan persetujuan.
5. Siaran awam dan pengedaran media
Halaman Newswire yang diluluskan adalah awam dan boleh diindeks, dicache, dipetik, disalin atau diarkibkan oleh enjin carian dan pihak ketiga. Ia mungkin mengandungi nama syarikat, teks, laman web, aset dan butiran hubungan media yang dipilih pelanggan untuk penerbitan. Pelanggan mesti mengelakkan data peribadi tidak perlu dan mendapatkan kebenaran individu yang dinamakan.
Bahan yang diluluskan dan URL awamnya boleh dihantar kepada hubungan media profesional yang berkaitan. Pelanggan menerima pelaporan operasi yang sesuai tetapi tidak menerima direktori media peribadi atau data hubungan tidak berkaitan.
6. Langganan wartawan, jangkauan profesional dan sekatan
Wartawan dan editor boleh melanggan serta menyatakan pilihan bahasa, wilayah dan liputan. Langganan hanya diaktifkan selepas pengesahan. Jika dibenarkan undang-undang dan operasi, kami boleh menghantar siaran profesional yang relevan kepada hubungan bilik berita yang disenarai awam atau diperoleh secara sah. Setiap mesej mengenal pasti pengirim, memuatkan siaran dalam e-mel dan menyediakan pilihan berhenti melanggan yang jelas serta sekatan satu klik.
Kami menghentikan e-mel selepas berhenti melanggan, lantunan kekal atau aduan. Rekod sekatan minimum disimpan bagi mengelakkan alamat ditambah semula. Kami tidak menjual direktori media.
7. Penerima data
Kami hanya mendedahkan data yang munasabah diperlukan. Penerima mungkin termasuk kakitangan dan kontraktor sah PitchMyStory; pelanggan dan pengguna pesanan; orang awam dan media bagi kandungan diluluskan; Supabase bagi pangkalan data, pengesahan dan storan; Vercel bagi pengehosan; Stripe bagi pembayaran; Resend bagi e-mel; penasihat, juruaudit dan penanggung insurans; pihak berkuasa atau mahkamah jika diwajibkan; dan pengganti dalam transaksi korporat sebenar tertakluk pada kerahsiaan dan undang-undang.
8. Pemprosesan di luar Malaysia
Penyedia awan, pembayaran dan e-mel antarabangsa menyebabkan data pelanggan, akaun, transaksi, siaran, teknikal dan pengedaran mungkin diakses atau diproses di luar Malaysia. Destinasi bergantung pada infrastruktur penyedia dan boleh termasuk Singapura, Amerika Syarikat dan lokasi lain yang didedahkan penyedia. Sebelum pemindahan, kami menggunakan asas yang dibenarkan dan perlindungan berkadar seperti kontrak, kawalan akses, penyulitan, usaha wajar penyedia dan semakan pemindahan. Jika persetujuan ialah asas pemindahan, kami meminta dan merekodkannya.
9. Tempoh penyimpanan
Kami menyimpan data hanya selama yang munasabah perlu untuk tujuan, kewajipan undang-undang, keselamatan, bukti dan pertikaian. Tempoh operasi berikut terpakai kecuali undang-undang, tuntutan, siasatan atau permintaan pemadaman sah memerlukan tempoh lain:
- Draf belum dibayar atau ditinggalkan dan muat naik: sehingga 90 hari selepas aktiviti terakhir.
- Data akaun dan sokongan: semasa akaun aktif dan lazimnya 24 bulan selepas penutupan atau aktiviti bermakna terakhir.
- Siaran awam: semasa diterbitkan; selepas pembetulan atau pengalihan, versi terhad dan bukti audit boleh disimpan sehingga 24 bulan, tertakluk pada keperluan undang-undang.
- Pesanan, rujukan pembayaran dan bayaran balik, invois, penerimaan dasar, bukti perakaunan dan rekod aduan material: tujuh tahun selepas transaksi atau penyelesaian.
- Peristiwa pengedaran dan bukti pemilihan: lazimnya 24 bulan. Data sekatan lantunan kekal, aduan dan berhenti melanggan: selama diperlukan untuk menghormati sekatan.
- Log keselamatan rutin: lazimnya sehingga 12 bulan; rekod insiden mungkin lebih lama. Sandaran terenkripsi luput secara berperingkat, lazimnya dalam 90 hari selepas pemadaman sistem langsung.
10. Keselamatan dan pelanggaran data
Kami menggunakan akses berasaskan peranan, polisi baris pangkalan data, storan objek peribadi, penyulitan semasa penghantaran, kelayakan terhad, pautan bertandatangan, pengesahan input dan fail, rekod audit, pengesahan webhook, sandaran dan kawalan pembekal. Tiada perkhidmatan selamat sepenuhnya. Jika pelanggaran berlaku, kami akan membendung dan menilainya, memelihara bukti, serta memaklumkan Pesuruhjaya dalam tempoh yang berkenaan jika diwajibkan. Kami akan memaklumkan individu tanpa kelewatan yang tidak perlu jika risiko kemudaratan ketara wujud.
11. Pilihan dan hak anda
Tertakluk pada Akta dan pengecualian, anda boleh bertanya sama ada kami memproses data; meminta akses dan salinan; membetulkan data tidak lengkap, tidak tepat, mengelirukan atau lapuk; menarik persetujuan; membantah atau menghentikan pemasaran langsung; mengehadkan pemprosesan yang mungkin menyebabkan kerosakan atau tekanan; dan membuat aduan. Penarikan tidak membatalkan pemprosesan sah terdahulu dan kami boleh menyimpan data terhad yang diwajibkan atau perlu untuk sekatan.
Kami tidak membuat keputusan yang menghasilkan kesan undang-undang atau sama penting sepenuhnya melalui pemprosesan automatik. Padanan penerima, isyarat fraud dan sekatan mungkin automatik, tetapi keputusan editorial dan akaun material boleh disemak manusia.
12. Melaksanakan hak dan aduan
E-mel editorial@pitchmystory.com dengan subjek “Permintaan privasi”. Terangkan permintaan serta akaun, pesanan atau alamat e-mel berkaitan. Kami boleh meminta bukti identiti dan kuasa yang berkadar. Kami akan mengakui permintaan dengan segera dan menjawab dalam tempoh undang-undang. Jika tidak berpuas hati, anda boleh menghubungi Pesuruhjaya Perlindungan Data Peribadi Malaysia.
13. Kuki, kanak-kanak dan perubahan
Kuki dan storan penting melindungi sesi, mengingati penyerahan dan mencegah penyalahgunaan. Analitik pilihan hanya patut berjalan selepas pilihan yang diwajibkan dan tidak menerima kandungan siaran, kelayakan pembayaran atau direktori media peribadi. PitchMyStory ialah perkhidmatan perniagaan yang tidak ditujukan kepada individu bawah 18 tahun.
Kami boleh mengemas kini notis apabila perkhidmatan, penyedia atau undang-undang berubah. Tarikh dan versi semasa dipaparkan di atas. Perubahan material akan dimaklumkan secara berkadar dan persetujuan baharu akan diminta jika diwajibkan.