Privacy Policy

Updated 3 November 202618 min read

Overview and Data Controller

bmborneo.com (“bmborneo.com“) operates an online business directory and classified marketplace serving Brunei Darussalam and the wider Borneo region (Borneo).

This Privacy Policy explains what personal data the platform collects, how it is used, who has access to it, and how members can export or delete their information.

  • Organisation responsible for your data: Rayyan Secutech
  • Registered Address: Brunei Darussalam
  • Privacy contact (our designated person for data protection): our Privacy contact, by email at [email protected] (put “Privacy” in the subject)
  • Applicable Legislation: The Personal Data Protection Order, 2025 of Brunei Darussalam, which has applied since 1 January 2026, governs how we handle personal data. It is overseen by the Authority for Info-communications Technology Industry of Brunei Darussalam (AITI). We aim to handle your data in line with it.
  • Where we operate: The site is run from Brunei Darussalam. If you use it from outside Brunei Darussalam, your data is still handled by us in Brunei Darussalam and by the service providers named in section 5 (see “Where your data is kept” there).

Questions and complaints

Write to [email protected] with “Privacy” in the subject. We aim to acknowledge your message within 3 working days and tell you who is dealing with it. If you are not satisfied with our answer, you may complain to AITI. AITI asks people to raise the problem with the organisation first.

Personal Information We Collect

We collect information directly from you when you register an account, publish content, submit requests, or interact with the directory.

Account Details

When you register for an account, we collect:

  • Your email address (used as your account login)
  • Your chosen display name
  • A securely hashed password (plain-text passwords are never stored)

Listings and Advertisements

When you submit a business profile or classified advertisement, we collect:

  • Title, category, location, and written description
  • Contact phone numbers and WhatsApp numbers
  • Business email address and website URL
  • Physical street address and operating hours
  • Price, currency, and item condition (for classified ads)
  • Uploaded photographs
  • Selected public meetup locations (for classified ads)

Everything you put in a listing is public. The phone number, WhatsApp number, business email, website, street address and photographs you enter are shown to anyone who opens the listing, including people who are not signed in, and search engines may list them. This is true for classified ads posted by individuals as well as for businesses. Only enter contact details you are happy to publish. Photographs can carry hidden details such as the place where the picture was taken. We resize large photos but we do not promise to remove that hidden information, so switch off location tagging in your camera if it matters to you.

Reviews and Ratings

When you review a business, we collect:

  • Star rating (1 to 5 stars)
  • Written review comments
  • Date and time of submission
  • Your member account association
  • Your public reviewer name, which is formatted as your first name and the initial of your last name (for example, “Aisha K.”). If your display name contains an email address or matches your account username, the review displays publicly as “A customer”.

Saved Listings and Searches

When you save content while signed in, we store:

  • Identifiers of businesses and classified ads you add to your saved list
  • Search queries and filter parameters you save (such as search keywords, categories, and areas)
  • Location coordinates and search radius parameters are deliberately excluded and are never stored in saved searches.

Booking and Quote Enquiries

When you send an enquiry or booking request to a business, we collect:

  • Full name
  • Email address
  • Phone number
  • Requested date, time, and party size
  • Written message content

Support Requests

When you contact support through our support desk portal, we collect:

  • Your member account details
  • Ticket subject, category, and message text
  • Any files you attach and any communication history between you and our support staff

Support messages are stored on our own server in the support desk. Please do not send identity documents or other sensitive papers unless we ask for them. Tickets and their attachments are kept for 24 months after the last message in the ticket, then deleted (see section 8). If you delete your account, your tickets are deleted with it.

Listing Reports

When you report a listing for moderation, we collect:

  • The listing identifier and reason category
  • Optional explanatory notes
  • Date and time
  • For logged-in users, your account ID. For logged-out users, no account is recorded, and your IP address is stored only as a one-way cryptographic hash to detect automated abuse.
  • For “Remove my listing” requests, any contact note or phone number you choose to type.

Your Location (“Near me”)

If you tap the “Near me” button in the search filters, your browser asks permission to share your device’s location. If you agree, your approximate coordinates are added to the search address so we can sort results by distance. We do not store them in your account or in saved searches. They do appear in the address of that search request, so they may appear in the logs kept by our web server and by Cloudflare. Those logs are kept under the settings of our web host and of Cloudflare, not in the application.

Anonymous Listing Activity Counters

For each listing we count, per day, how many times it was viewed and how many times the call, WhatsApp and directions buttons were tapped, and how often paid placements were shown or clicked. We store only the day, the listing and the count: no IP address, browser details, cookie or account. Owners see these totals for their own listings. The counters are deleted after 90 days by default.

Technical and Security Data

To maintain site integrity and protect against automated attacks, we process:

  • IP addresses, used for fixed-window rate limiting on login attempts, account registrations, password reset requests, listing submissions, reports, and reviews.
  • Audit log records: staff administrative and moderation actions record the acting staff member’s account and an IP address masked to the network subnet (/24 for IPv4, with the last octet zeroed) or a keyed hash.

Outbox Email Logs

Outgoing system notifications are queued in an internal application outbox capped at 200 messages that rolls over continuously. Sensitive links, including password reset URLs and email verification tokens, are excluded or redacted from stored outbox entries.

Newsletter

This applies only while the newsletter box in the footer is switched on. If you sign up, we collect your email address, the exact wording you agreed to and the time you agreed, and a one-way hash of your IP address (a code we cannot turn back into the address; it is used only to spot abuse). You are subscribed only after you click the confirmation link we email to you. We store this on our own server and, once you have confirmed, also add your email address to our mailing list at Vbout, the service we use to send the newsletter. Every newsletter carries an unsubscribe link, and you can also unsubscribe from the link in the confirmation email. To have your newsletter data deleted, write to [email protected] with “Privacy” in the subject: we delete it here and remove you from the Vbout list.

Why We Collect and Process Data

We process personal information for the following operational purposes:

  • Directory Services: To publish, format, and display business listings and classified advertisements.
  • Communications: To deliver customer booking requests, quote enquiries, and review notifications to listing owners.
  • Community Moderation: To verify listing content, enforce community standards, process ownership disputes, and prevent spam or fraudulent entries.
  • Security & Integrity: To protect members against brute-force attacks, credential stuffing, and repetitive form abuse through rate limiting.
  • Statistics: To show listing owners how many people viewed or contacted them, using the anonymous counters described in section 2.
  • Customer Support: To answer support enquiries and assist members with account administration.

Who Can See Your Information

  • Public Visitors: Approved business listings, approved classified ads, uploaded photos, and approved reviews (with first name and last initial) are visible to anyone visiting the site. This includes the phone number, WhatsApp number, email address and street address that were put in a listing.
  • Listing Owners: Booking requests and quote enquiries submitted for a listing are sent directly to that listing owner’s registered email and dashboard.
  • Site Moderators and Staff: Pending listings, owner verification requests, listing reports, ownership disputes, and support tickets are accessible only to authenticated staff members.
  • Site Administrators: Private identification and business registration documents uploaded as proof for ownership disputes are restricted strictly to administrators. Proof documents are stored in non-public storage directories outside the web server’s public document root.

Third-Party Service Providers (Data Processors)

We engage select technical service providers to maintain platform operations:

  • Email Delivery (Transactional Mail): System emails (account verification, password reset links, notification alerts) are dispatched via FluentSMTP through Amazon Simple Email Service (Amazon SES), hosted in the Singapore AWS region.
  • Network and DDoS Protection: Cloudflare provides reverse-proxy routing, edge security, SSL/TLS encryption, and distributed denial-of-service (DDoS) protection.
  • Third-Party Video Platforms: Where a listing features an external video (YouTube or Vimeo), video players are loaded using privacy-preserving embed domains (youtube-nocookie.com or player.vimeo.com) only after a visitor explicitly clicks to play the video.
  • Help Chat (Chatbase): The chat bubble (Bo, our help assistant) is provided by Chatbase. It appears on our help, pricing, safety and verification pages, on the pages for adding a business, claiming a listing and posting an ad, and, for visitors who are not signed in, on the other public pages of the site. Its script is loaded from Chatbase when such a page opens, so Chatbase receives your IP address and browser details even if you never open the chat. If you use it, what you type is sent to Chatbase to produce an answer, and the chat may keep a small identifier in your browser so the conversation continues. It does not appear on the login, registration, account or dashboard pages. Please do not type passwords, card numbers or identity documents in the chat; it is an automated assistant and cannot access your account.
  • Support Mailbox: Messages sent to our support address are received through Cloudflare, turned into a support ticket on our own server, and answered from there through Amazon SES. We keep the ticket so that we can follow up with you.
  • Maps: A listing page does not contact any map provider when it loads. The “Get directions” link opens a map service (Google Maps unless we change the setting) only when you tap it. If we switch on the embedded map, an OpenStreetMap map loads only after you tap its button. In both cases the map provider sees your IP address and the location of the listing, and handles that under its own privacy policy.
  • Newsletter (only if switched on): If you subscribe, your email address is also stored with Vbout, which sends the newsletter for us. Vbout receives only the address of people who have confirmed their subscription.
  • Exchange rates: Once a day our server fetches currency rates from ExchangeRate-API. That request carries no visitor or account information.
  • Support desk: The support desk is software running on our own server, not a separate company.
  • Visitor Statistics (Google Analytics, only if you accept): With your permission we use Google Analytics to see which pages are visited, how visitors reach us and from which countries, so we can improve the site. If you press Accept on the cookie banner, your browser loads Google’s measurement tag and sends Google your visit data (pages viewed, device and browser type, approximate location from your IP address, and an identifier stored in a cookie). Google handles this under its own privacy policy and may process it outside Brunei Darussalam. If you press Decline, or do not answer, nothing is loaded from Google and no visit data is sent. You can change your choice at any time with “Cookie settings” at the bottom of every page. Visits by people signed in to our site are never counted.
  • No Advertising Trackers: We do not load external third-party advertising networks or advertising tracking pixels.

Where your data is kept

Your data is stored on our web server. Email is sent through Amazon SES in Singapore and Cloudflare handles web traffic through its worldwide network. Our service providers, including our email delivery and security providers, may therefore process your data outside Brunei Darussalam.

Cookies and Browser Storage

We use minimal local browser storage necessary for site functionality:

  • bm_accent Cookie: Remembers your preferred site accent color choice. It stores a single color name string, expires in 1 year, and is sent with SameSite=Lax, plus Secure on https pages. The same choice is also kept in your browser’s localStorage under bm-accent.
  • Theme Preference (localStorage): Stores your selected display mode preference (bm-theme: auto, light, or dark) locally on your device.
  • Currency Preference (localStorage): Stores your selected display currency (bm_currency) locally on your device for informational price conversions.
  • Session Authentication Cookies: When you log in, standard WordPress authentication cookies (wordpress_logged_in_*, and wordpress_sec_* on secure pages) are set to keep you signed in. They last until you sign out or they expire; if you tick “Keep me logged in” they last longer.
  • Cloudflare: Cloudflare may set its own security cookie.
  • Cookie Choice (localStorage): Your answer to the cookie banner is kept in your browser’s localStorage under bm_consent (granted or declined), so we do not ask on every visit. It is not sent to us.
  • Google Analytics Cookies (only after you accept): _ga and _ga_<our measurement ID> are set by Google Analytics to tell visits apart. They last up to two years unless you clear them. They are not set unless you press Accept, and they are not used for advertising.
  • No Advertising Cookies: We do not set advertising cookies or advertising identifiers. The accent, theme and currency settings are your own display choices and are not used to identify you.

Public-Source Directory Listings and Removal

To build an initial useful directory for Borneo communities, some business listings have been imported from public business directories. These listings contain business names, phone numbers, addresses and similar details. Where a listing names a person, that person’s details are personal data too.

  • Unclaimed Designation: Imported listings that have not yet been claimed by their real-world operators are clearly designated with the note: “Unclaimed — details from public sources”.
  • No Verification Badge: Unclaimed listings never carry a verified badge.
  • Claiming a Listing: Legitimate business owners can claim their listing at any time using the “Is this your business? Claim it” link on the listing page.
  • Requesting Removal or Correction: Business owners, and anyone whose details appear in a listing they did not create, can ask us to remove or correct it. Use the “Remove my listing” form on the listing page, or email [email protected] with the address of the listing. You do not need an account. A moderator reviews every request and we aim to act on it within 3 working days; nothing is removed automatically.

Data Retention Schedule

We retain personal information only as long as necessary for platform operations and security:

  • Administrative Audit Logs: Staff activity logs and masked IP addresses are retained for 365 days by default, after which they are permanently deleted by a daily automated cleanup process.
  • Claim Proof Documents: Confidential documents uploaded to substantiate an ownership claim are deleted 30 days after a decision is recorded. A claim that is never decided has its document deleted after 90 days. Deletion runs once a day and is permanent.
  • Anonymous Listing Counters: Deleted after 90 days by default (see section 2).
  • System Outbox Queue: Outgoing email records in the application outbox are capped at 200 entries and roll over continuously.
  • Mail Delivery Logs: We keep mail delivery logs only as long as our email provider retains them.
  • Newsletter: Kept while you are subscribed. If you unsubscribe, we keep the address marked as unsubscribed, so that it is not added again by mistake, until you ask us to delete it. A sign-up that is never confirmed is deleted about 30 days after its confirmation link expires.
  • Reviews: Kept for as long as the listing they are about exists. A review is deleted together with its author’s account only when the author deletes their own account.
  • Reports and Enquiries: Listing reports, removal requests, and booking and quote enquiries are deleted 12 months after they are closed.
  • Saved Items: Kept until you remove them or delete your account.
  • Support Tickets: Deleted 24 months after the last message in the ticket, or when you delete your account if that comes first. Attachments are deleted with the ticket.
  • Inactive Accounts: An account that has not been signed in to for 24 months is treated as inactive. We email the address on the account 30 days before deleting it, and the account stays if you sign in during those 30 days. You can also ask us to delete your account at any time from your dashboard or by emailing [email protected].

Your Data Rights

Access and correction

You can ask us for the personal data we hold about you and how we have used or shared it in the past year. You can ask us to correct anything that is wrong. Write to [email protected] from the email address on your account (or, if you have no account, tell us which listing or message concerns you). We will check that you are the person concerned before we release anything, because giving someone else’s data to the wrong person is a breach. We aim to answer within 30 days and, if we need longer, to tell you when to expect the answer. We do not charge a fee for a normal request.

Your export file is prepared by our staff using the standard WordPress personal data export tool. It includes:

  • Account profile details
  • Authored reviews and ratings
  • Submitted reports and flags (not the hashed address used for abuse detection)
  • Booking and quote requests sent
  • Saved listings and saved searches
  • Authored business and classified listings

You can also change your own profile details, listings and photos yourself in your dashboard at any time.

You can withdraw your consent to us using your data at any time by writing to us. We will tell you what that means for your use of the site (for example, we cannot keep an account without an email address). We do not send marketing messages, except the newsletter if you subscribe to it. You subscribe only by ticking a box and confirming by email, and you can unsubscribe at any time.

Erasure

The law does not give a general right to have data erased, but it does require us to stop keeping personal data once we no longer need it for the reason we collected it or for legal or business reasons. We therefore let you delete your account yourself and will act on written requests. An erasure request permanently removes:

  • Your submitted reviews (the affected business rating averages and review counts are recalculated automatically)
  • Your submitted listing reports
  • Your booking and quote enquiry requests
  • Your saved listings and saved searches
  • Your support tickets and their attachments

What erasure does not remove:

  • Published listings and ads are public directory content. Standard erasure requests do not delete them. You can delete your own listings in your dashboard, or ask us in writing to remove them.
  • Staff activity records that mention your account (for example a moderator approving your listing) are kept for the audit period in section 8. After your account is deleted they show only the anonymised name deleted-<id>.
  • Listings removed from public view when you delete your account are kept in our system as unpublished drafts. The contact details you entered (such as the phone number, WhatsApp number and street address) are removed from them. Ask us in writing if you want the drafts permanently deleted.
  • When you delete a listing yourself, it may first go to a bin and be removed from there later.

Self-Service Account Deletion

You can permanently delete your account directly without contacting staff:

  1. Navigate to Dashboard > Profile > Delete my account.
  2. Enter your current account password.
  3. Type the confirmation word DELETE.
  4. Submit the request.

Upon confirmation:

  • All your reviews, reports, requests, saved items and support tickets are permanently erased.
  • Any open ownership claims are withdrawn.
  • Your listings are unpublished (moved to draft status) and the contact details in them are removed.
  • Your user account is permanently anonymized to deleted-<id>, its email is rewritten to an invalid address, all session tokens are terminated, and user capabilities are revoked.

Children

The site is for people aged 18 or over. We do not knowingly collect personal data from anyone younger. If you think a child has given us their details, write to us and we will delete them.

Data Breaches

If personal data we hold is lost or accessed without permission in a way that is likely to cause significant harm, or affects a large number of people, we will tell AITI within 3 days of deciding that it is a notifiable breach, and we will tell the people affected where the law requires it.

Changes to this Policy

We will post changes on this page.