Privacy policy.

1. Who is responsible

Hubtal OÜ is the data controller for this corporate website and enquiries sent to hello@hubtal.com. It determines how those enquiries are handled and is the company responsible for the website enquiry inbox. This notice also covers recruitment for Hubtal OÜ roles. Where a job posting identifies a different hiring organisation, that organisation is responsible for its recruitment processing as described in the posting and any applicable recruitment notice.

Hubtal Malaysia SDN BHD is a separate Hubtal company. Its registered details are listed below for transparency, but it does not control or have access to the website enquiry inbox. If you deal directly with that company for a separate purpose, the responsible company and relevant processing information must be identified for that interaction.

For privacy questions or to exercise your rights, email hello@hubtal.com or write to the relevant registered address above. Please include “Privacy enquiry” and enough context for us to identify the matter. You do not need to identify a legal entity before contacting this central privacy contact.

This notice covers Hubtal’s corporate website, enquiries and recruitment for roles advertised by Hubtal. It does not describe how customers use Draft.Jobs, Causaro, Emerhub Brain, Emerhub One or a client’s platform to process their own users’ information; the relevant product or customer notice applies to that processing.

2. Information we handle and where it comes from

Enquiries and correspondence

We receive the name, email address, message and any company or other details you choose to send us. The website form requires a name, email address and message; company is optional. You can also email us directly. Providing information is voluntary, but without a way to contact you and enough context we may be unable to respond or take the steps you request.

The form prepares an email draft in your browser. It does not submit to a Hubtal form database or CRM. Hubtal receives your message only if you send it through your email app. Google Workspace provides our business email service. Your own browser or email provider may retain autofill information or drafts according to its settings.

Recruitment

If you apply through Draft.Jobs, the recruiting company receives the details you submit for that role. Depending on the application, these can include contact details, your CV, employment and education history, portfolio links, answers to application questions, correspondence and records of interviews or assessments. Details come from you and from the hiring steps described for the role. Please do not submit unrelated identity, health, financial or other sensitive records.

Where a posting is for another hiring organisation, that organisation is identified in the posting. Its handling of your application may also be covered by its own recruitment notice. Job alerts and your Draft.Jobs account are subject to the information provided by Draft when you use those features.

Website delivery and security

Hosting services process technical request information, which can include IP address, browser and device information, requested page, referrer and request time, to deliver and protect the website. Google Analytics is delivered through Google Tag Manager. Neither loads until you allow analytics. Measurement can include pages viewed, visit and session identifiers, device/browser information and technical request information received by Google. We do not send enquiry messages or application contents to analytics.

3. Why we use personal information

Where Malaysian law applies, we process information with the consent required for the relevant purpose or under an applicable statutory exception, including necessary steps you request before a contract or performance of a contract with you. The privacy notice itself is not a request for blanket consent. Where separate consent is needed, we seek it for the stated purpose.

Sending an enquiry or applying for a role does not subscribe you to marketing or give permission to keep your application indefinitely for future roles. We do not sell this enquiry or application information or use it for advertising profiles.

4. Who may receive information

Access is limited to the people who need information for the relevant enquiry, hiring process or support function. Relevant recipients can include Hubtal staff, the hiring organisation identified in a job posting, service providers and professional advisers. We may also disclose necessary information to an authority or another party where legally required, or for a specific legal claim.

Our current services include Google Workspace for business email, Vercel for hosting the public website, and Draft.Jobs for recruitment applications. These providers process relevant information for their services under the applicable service and data-processing terms. Their own account, security and service-administration processing can also be covered by their notices.

Google Analytics is used after your permission to measure website use. Google receives relevant measurement and technical request information when its service loads. No advertising pixel, HubSpot connection or newsletter service is installed. The careers page retrieves public job listings without loading Draft’s browser widget.

5. How long information is kept

We retain information for the purpose for which it is needed, rather than keeping every record indefinitely. For an enquiry, relevant factors are whether we have answered it, whether there is continuing correspondence or a resulting business relationship, and any applicable legal record-keeping or claim requirements.

For recruitment, the criteria include whether the application or hiring process is active, whether questions or a dispute remain, and applicable employment and legal-claim requirements. Keeping an application for future roles requires a separate, explained basis. If you join a company, employment records are handled under the relevant employment arrangements and notice.

Technical logs are retained according to their operational and security purpose and the hosting service’s applicable settings and terms. Information needed for a legal obligation or specific claim may be retained for the necessary period even after another purpose ends.

The contact form itself keeps no server-side contact record. Your cookie choice is valid for 180 days; after expiry, we ask again before loading optional analytics. Google Analytics cookies are configured to last up to 180 days without visit-based refresh; browser restrictions can shorten this. Analytics record retention depends on the active Google Analytics property settings and the reporting purpose; contact us for the applicable configuration. You can clear browser data sooner, but clearing cookies does not erase data already received by Google. See the cookie policy.

6. International processing

Website enquiries are handled by Hubtal OÜ. Hubtal Malaysia SDN BHD is not given access to that enquiry inbox. This website notice therefore does not describe an automatic sharing of enquiry records between the two companies.

Our email, hosting and optional measurement providers can process information in countries where they and their authorised subprocessors operate, including outside the European Economic Area. Their published data-processing terms include international-transfer provisions and Standard Contractual Clauses where applicable. The relevant arrangements depend on the service, recipient and processing involved.

Google Workspace and Vercel use international infrastructure and subprocessors. Their published processing and transfer terms explain their arrangements: Google Cloud Data Processing Addendum and Vercel Data Processing Addendum. Google measurement services have separate data-processing terms and a privacy policy. Google may process measurement data outside the EEA, including in the United States; applicable transfer terms depend on the service and recipient.

Where a transfer is subject to GDPR restrictions, an applicable lawful transfer mechanism and any necessary additional safeguards are required. Transfers out of Malaysia must satisfy the applicable requirements of the Malaysian Personal Data Protection Act. You can contact hello@hubtal.com for information about the recipient, processing location and safeguards relevant to your information, including an available copy of applicable safeguards with unrelated confidential details removed.

7. Cookies and your choices

Optional analytics is off until you accept. You can accept analytics, reject optional tracking, or save a choice in Manage preferences. Google Analytics is not loaded before permission, and we do not use pre-consent measurement pings. Advertising consent remains denied.

We store your choice in first-party local storage for 180 days. The old informational-notice dismissal is not treated as consent. Use Cookie settings in the footer to change or withdraw your choice at any time. Withdrawal stops future analytics and removes accessible Google Analytics cookies from this site; it does not undo prior lawful processing.

Our cookie policy describes browser storage, optional Google measurement and your controls. Search Console ownership is verified through DNS; it does not require a visitor tracking tag. External websites have their own privacy and cookie practices.

8. Your data protection rights

Where the GDPR applies

Subject to the relevant conditions and exceptions, you may request access, correction, erasure or restriction, and data portability where processing is automated and based on consent or contract. You may object to processing based on legitimate interests on grounds relating to your situation, and object to direct marketing at any time. If we rely on consent, you can withdraw it without affecting processing that was lawful before withdrawal.

We respond to GDPR rights requests within one month. Where the law permits an extension for complexity or number of requests, we explain the extension within that first month. Requests are generally free; legally permitted exceptions apply to manifestly unfounded or excessive requests.

Where Malaysian law applies

You can request access to and correction of your personal data, withdraw applicable consent, and exercise the rights to prevent processing likely to cause unwarranted damage or distress and to stop direct marketing. You may request direct transmission to another controller under the data-portability provisions, subject to technical feasibility, format compatibility and other applicable conditions. Requests are handled within the applicable statutory time limits.

How to make a request

Email hello@hubtal.com. Tell us the right you want to exercise and enough context to find the information. We may request proportionate verification when necessary to protect against disclosure to the wrong person; do not send identity documents unless we explain why they are needed. If we cannot fulfil a request, we explain the applicable reason and available options.

You may complain to the Estonian Data Protection Inspectorate or another competent EEA supervisory authority, including in your habitual residence or place of work where applicable. In Malaysia, you may contact the Personal Data Protection Commissioner. You do not need to contact us first to exercise a right to complain.

9. Security and automated decisions

We take proportionate technical and organisational measures for the information and services involved, including restricting access to what is needed and using service-provider security functions. Where a breach requires notice under applicable law, the required notifications must be made.

This corporate website does not make decisions with legal or similarly significant effects about you solely through automated processing. The published recruitment process includes application review and interview or assessment stages; the relevant role describes its hiring steps. This notice does not describe the separate AI features used by customers within Hubtal products.

10. Changes to this notice

The date above identifies the latest version. If a new use, provider or feature materially changes how information is handled, we update this notice and provide additional information or obtain any consent required before that processing begins.