Updated 2026-03-03
 

Zupu.my, a Malaysia nonprofit corporation with its principal offices in Kuala Lumpur Malaysia.  (“Zupu.my”), is dedicated to family history and genealogical research. When referring to “us,” “we,”  or “our” we mean Zupu.my. In this Notice, we provide you with information about how we process  your personal data.  

 

Creating an online account on our website and applications (“Website”) or otherwise submitting data  to Zupu.my allows you to access the services and Website that we offer, including building a family  genealogy ; connecting with family members; and accessing and sharing family photos, digital  records, recorded oral histories, and other memorabilia submitted by you or your relatives, or which  have been obtained from public and historical sources worldwide.  

 

Zupu.my respects the privacy of individuals who use our Website. In this Privacy Notice, we identify  the personal data we collect, our basis for processing personal data, and our data processing terms  in accordance with your rights and applicable law. We encourage you to carefully read this Privacy  Notice before submitting personal data to us. As the delivery of our Website depends on the  processing of your personal data in accordance with the Zupu.my Terms of Use and the Content  Submission Agreement, please also carefully read these documents.  

 

1. Who controls your personal data? 

When you share your personal data on our Website or engage in interactions or communications  with us, we process your personal data as the data controller.  

Zupu.my is affiliated with and supported by Malaysian Chinese Cultural Society (MCCS) as a public  service. Creating an online account with our Website does not mean you endorse or are otherwise  affiliated with the Society.  

 

2. What personal data do we collect? 

We collect personal data that (a) you submit; (b) other users submit; (c) we record; and (d) we obtain  from third parties.  

 

1. Data You Submit. You submit personal data to us, and we may collect personal data submitted  by you, when you create an account on our Website, request Zupu.my materials, request access to  Zupu.my services or the Website, submit or upload your personal data to Zupu.my tools or the  Website (e.g., building your family Zupu), or engage in other interactions or communications with  Zupu.my. When you interact with Zupu.my and create an account, we generally process your name,  birth date, mobile number, email address, location (e.g., country), and sex. You also may submit  account and registration data for processing, such as your username, display name, password,  email address, and settings and preferences.  

When you use our services, you also may choose to submit additional information to participate at  your own initiative in other Zupu.my genealogical activities, including submitting personal  genealogical data (e.g., life sketch, life events, alternate names, family relationships, life facts,  memories, biographical information), photos, memorabilia, records, and historical information about  you and your relatives. You choose what personal data to submit, and, in some cases, you may  choose to submit information that could be considered sensitive, such as ethnic background, race,  national origin, religious background, citizenship, medical information, or immigration status.  However, you should not submit or share any sensitive data about persons other than yourself if  such persons are still living. 

 

1. Data Other Users Submit. As we explain in more detail under “With whom do we share personal  data?,” the Zupu.my platform permits other users of the Website, such as your relatives, to submit  your non-sensitive personal data as part of a family genealogy or in other limited tools and features.  The ability to share basic information about family members is essential to performing genealogical  research and to connecting researchers with their family genealogy. When a user submits the  personal data of a person who is still living (“Living Data”) to a family genealogy, that Living Data is  initially only visible to the user himself. In some limited cases, the user also may be able to share  such data in restricted areas of the website with a limited number of users in a closed group setting,  which is accessible by invitation only. Each user is responsible for their own processing of any Living Data that they submit or share on the Website, and will only do so for personal purposes to  document and research their family history, as required by the Content Submission Agreement and Terms of Use.  
2. Data We Record and Cookies. When you visit our resources, our servers (using log files or  filtering systems) may collect information that your web browser sends any time you visit a website.  This information may include, but is not limited to, your Internet Protocol address (IP address),  browser type, operating system, language preference, a referring web page you visited before  entering our site, the date and time of each visitor request, information you search for on our  resources, and other information collected by cookies or similar technologies. Please refer to the  Cookie Preferences tool (“Cookie Preferences”) posted on each of our mobile applications and the  footer of our websites to learn more. Cookie Preferences allows you to choose the types of cookies  we use. If you do not accept cookies, you may not be able to use some sections or functions of our  sites or applications, as outlined in Cookie Preferences. Please also be aware that you cannot  disable certain cookies that are necessary to the Website’s core functionality. By using our Website,  you consent to the use of cookies as described in the Cookie Preferences. You may opt out of  certain cookies used on our Website by clicking the Cookie Preferences link at the bottom of this  page.  

To the extent permitted by applicable laws, we also may obtain genealogical and historical personal  data about you from archives or other publicly available sources.  

 

3. How do we process your personal data? 

In most cases we process your personal data with the use of automatic means (automated  processing), though in some cases we may process your personal data without the use of automatic  means (manual processing), or with a combination of automatic and manual means of processing  (mixed processing).  

Processing operations that we perform on your personal data may include the following: collecting,  recording, organizing, structuring, storing, adapting or altering, analyzing, retrieving, consulting,  using, transferring (transmission, access, disclosure), including cross-border transfers as explained  in this Notice, aligning or combining, generating derivative data, restricting, erasing, or destroying  your personal data.  

 

4. For what purposes do we process personal data? 

We process your personal data in connection with the Website and services offered by Zupu.my for  the following purposes:  

 Genealogy/Family History Research: To provide training, resources, and tools to help you  and your relatives trace your ancestry and lineage, build your family genealogy, conduct  family history research, and connect with family members. 

 Preservation of Historical Records: To digitize and archive historical documents, photos, artifacts,  and public records for future generations.  

 Record Family History: To record important family history, historical, and cultural information that  otherwise may be lost (e.g., oral histories).  

 Communication and Collaboration: To allow you to communicate and collaborate with other users  when doing family history research, such as in our discussion feature.  

 

 Website Administration: 

• To authenticate your access to your Zupu.my account and other Zupu.my applications and services.  
• To communicate with you, answer your questions, and provide you with information with respect to  technical, security, or other operational issues.  
• To build and improve our Website, tools, and services, including by tracking analytics on your activity  in the Zupu.my Website.  
• To notify you of new Zupu.my applications and services, invite your participation, and  alert you to new potential relatives in your family genealogy.  
• To prevent error, fraud, or criminal activity and enforce our Terms of Use.  

 

5. What is our legal basis for processing your personal data? 

We strive to ensure we have a fair and lawful basis for processing all personal data that we collect.  Our legal basis for processing may differ depending on area of the website; the purposes for which  we process your personal data, including the purposes described above in “For what purposes do  we process personal data;” and local legal requirements in your jurisdiction. 

 

Our primary legal basis for processing the personal data of users is consent, which we obtain from  you when you create an account on our Website, periodically when you upload personal information  to our Website, or when you fill out other forms where you submit your personal information to  ZUPU.MY.  

 

We also may process personal data to preserve our legitimate interests as a nonprofit genealogical  research organization, including where necessary to provide a platform for you to conduct and  document genealogical research and for auditing, data analysis, system troubleshooting, legal  claims, and regulatory obligations. In each case, we will balance our legitimate interests against your  rights and freedoms and will only process data that is necessary to accomplish the purposes  described above.  

 

In some restricted areas of our Website, we provide a closed platform in which users are permitted  to share Living Data with a small group of other invited users, as necessary to conduct genealogical  research. In these areas, Zupu.my processes user-generated content containing Living Data on  behalf of the users, in accordance with the user’s instructions. We do not process or use Living Data  for our own purposes or determine the legal basis for processing. Each user is responsible for their  own processing of any Living Data that they submit or share on the Website. You will be notified  when you are submitting data in one of these areas (e.g., user-owned ) and reminded that you are  responsible for any Living Data that you submit.  

 

Depending on the local requirements in your jurisdiction, if you process Living Data in connection  with a purely personal or household activity you may not be subject to privacy law requirements. In  any case, however, you must have the right or permission to share any Living Data with other users  in accordance with the Zupu.my Content Submission Agreement and Terms of Use.  

 

6. With whom do we share personal data?

You may stop us from sharing your personal information or limit the information we share by  modifying your profile preferences or by contacting us using the information provided below. We  share your personal data with other parties in the following circumstances:  

 

1. Third-party Service Providers. We may provide personal data, including some or all of the  categories identified in this notice, to third parties to perform functions on our behalf as data  processors or sub-processors (for example, payment processing, maintenance, security, data  analysis, hosting, measurement services, data-driven social media messaging, surveys, and so on).  In such instances, in accordance with this Notice and as required by applicable laws, we  contractually require service providers to protect personal data from additional processing (including  for marketing purposes) and from transfer. For a list of third parties which may collect some of your  personal information using cookies, please see the Cookie Preferences.  
2. Website Users. To better protect your privacy, we have designed the Website so that users are  only permitted to share Living Data with other website users in certain restricted areas of the website, which are accessible by invitation only. In these restricted areas, you may choose to make some of  the optional genealogical information that you provide on the Website accessible to other Zupu.my  users (for example, information you upload to your family genealogy). Without your request or action, Zupu.my will not make Living Data that you provide accessible to anyone other than you, the  submitter. You must choose to make it available (e.g., when you join a group and share personal  data within that group). You should not, however, attach memories that have Living Data to a  deceased person in a public genealogy. Zupu.my strives to limit the situations in which you can  share Living Data in order to comply with applicable laws and to protect the privacy of your relatives.  

As indicated above, each user is responsible for their own processing of any Living Data that they  submit or share on the Website. When you choose to share Living Data with other users, you affirm  that you are responsible for such data; that you have the right or permission to share such data with  other users in accordance with the Zupu.my Content Submission Agreement and Terms of Use; that  you share such data only for personal and genealogical research purposes; and that such sharing  complies with applicable laws.  

 

You may adjust the visibility of personal data to other Zupu.my users or to the public at any time by  changing your privacy settings or by contacting us using the information provided below. All  memories containing Living Data should be set to “private.”

  

Zupu.my may, however, make certain personal data obtained from public and historical sources  publicly available when permitted by applicable local laws.  

1. Legal Requirements. We may access and disclose your personal data, posts, online chats,  personal notes, content, or other submissions to a third party if we have a good-faith belief that doing so is required by a subpoena, by a judicial or administrative order, or is otherwise required by law.  Additionally, we may disclose your personal data and other information as required by law or to  exercise or defend legal rights; to take precautions against liability; to protect the rights, property, or  safety of the resource of any individual or of the general public; to maintain and protect the security  and integrity of our services or infrastructure; to protect ourselves and our services from fraudulent,  abusive, or unlawful uses; to investigate and defend ourselves against third-party claims or  allegations; or to assist government law enforcement agencies.  
2. Where do we store personal data? 

We may store your personal data outside of your country of residence, including in the Malaysia, on  servers, in cloud storage solutions, or on the premises of Zupu.my and its affiliated sponsoring  entities. To ensure adequate protection of personal data transferred to other jurisdictions, we  conclude data transfer and processing agreements between Zupu.my and our service providers,

affiliated entities, and archives where legally required. These transfer agreements include Standard  Contractual Clauses approved by the European Commission in compliance with EU law or other  clauses as required by applicable law (which you may be entitled to review if you contact us using  the information at the end of this Notice).  

 

8. How do we secure personal data? 

We use technical and organizational measures to protect the personal data we receive against loss,  misuse, and unauthorized alteration and to protect its confidentiality. We regularly review our  security procedures and consider state of the art security technology and methods. We also use  current encryption technology to encrypt the transmission of data on our log-in pages. However,  because we cannot guarantee the complete security of these encryption technologies, please use  caution when submitting personal data online.  

 

9. How long do we retain personal data? 

We retain collected personal data, including information collected via the Website and other  submissions, for a reasonable period of time to fulfill the processing purposes mentioned previously.  We then archive it for time periods required by law. When archiving is no longer required, we delete  personal data from our records within the time period required by applicable law, with the exception  of limited historical profile information and personal data retained as part of permanent genealogical  or historical records.  

 

10. How can you access and correct your personal data? 

We endeavor to maintain the accuracy of personal data and rely on you to ensure your personal  data and any Living Data that you submit are complete and accurate. You may request access to  your personal data and verify, correct, or update it, and limit visibility of your personal data through  your website-specific registration, through your profile, or through your Zupu.my Account, as  applicable. To review these options, please visit your Zupu.my Account settings here.  

 

Depending on the jurisdiction in which you reside, consumer protection or privacy laws may provide  you with additional rights regarding the use of your personal information. You may contact us to  exercise additional statutory rights using the information provided below. Such rights may include:  

• the right to be informed, including obtaining a copy of the personal data we hold about you; the right to access and delete personal data;  
• the right to correct personal data;  
• the right of data portability; and  
• the right to opt out of further processing or to restrict processing.  
  
  

The exact scope of these rights may vary by jurisdiction. Please contact us with any questions or to  exercise these rights.  

 

You also may have the right to lodge a complaint with a supervisory authority, depending on where  you live.  

 

If another user is processing or sharing your personal information, please contact that user to ask  them to delete or correct any personal data that they have submitted or shared about you. Each user  is responsible for their own processing of any Living Data that they submit or share on the Website  about other persons. You may also reach out to us directly using the contact information provided  below and we can assist with correcting or deleting your personal information upon request. 

If you experience problems with modifying, deleting, or updating your personal data, you can contact  us using the information provided at the end of this Notice.  

 

11. Effective date and amendments. 
    This Notice is effective March 03, 2026, and may be amended from time to time.
    
    
12. Contact us. 
    

    Inquiries concerning this Notice or the security of personal data that we process may be sent  through our email , fax, or mail:  

    Email: support@zupu.my 

    Fax : +603-2181 1976  

    Mail : Zupu.my Data Privacy  

    15th Floor, Wisma MCA, 163, Jalan Ampang, 50450 Kuala Lumpur, Malaysia