Privacy notice

Who we are

EASY BUY 2 U STORE ENTERPRISE, Company No. 201703354884 (002720749-M), trading as RS Research, is responsible for the personal data described here. Our registered address is 1-3, Pusat Perdagangan Desa Jaya, Jalan 16, Taman Desa Jaya, 52100 Kuala Lumpur, Malaysia.

What we collect from you, and why

If you send us an enquiry

The form records what you type: your business name, website, country, industry, your name, email address, telephone number, what you want to understand, and your message. We use it to reply to you and to prepare a quotation.

It also records four things you do not type — which of our sites you used and the address of the page you submitted from, the site that referred you, and your IP address and browser user-agent string. RS Research runs two sites, one about research and one about website building; which one you wrote from decides who replies to you and what they assume you are asking. The first three tell us which parts of which site lead to a real enquiry. The IP address and user agent are kept to stop automated abuse of the form: we limit how many enquiries one address can send in an hour, and without recording it we could not.

If you use the free website check

Nothing you type into it is stored. The check reads our existing research and returns an answer; it writes nothing. The only record is a counter in your own session that limits how many checks one visitor can run.

If you become a client

We hold your contact details, the question you asked us, what was agreed, the fee, and the briefs we produced. Where we send a brief through a private link, we record who it was sent to, when, and how many times it was opened. We do not record where it was opened from or on what.

Cookies

This site sets one cookie, named NEXORASESS. It holds a session identifier and nothing else — no name, no email, nothing about you. It lets the enquiry form protect itself against cross-site request forgery, remembers which language you chose, and counts your website checks. It is marked HttpOnly and SameSite=Lax, so no script can read it and it is not sent when another site links to us.

We use no advertising, analytics or tracking cookies, and no third-party scripts that would set one. If that changes, this notice changes first.

Research about businesses, including yours

This is the part most privacy notices do not have, and for us it is the most important.

Our business is market and product research. We record what is publicly available about businesses — company details, published websites, prices and offers, and our own assessment of them — including businesses that have never contacted us. Where a company publishes a contact name, email address or telephone number, that is personal data and we hold it as part of that record.

We collect it from published sources: company registries, official trade and statistical publications, businesses' own websites and materials, and licensed data where we have permission to use it. We do not buy contact lists. We may write to a business about what we found on its own website — see the next section, which says exactly how and how to stop it.

If you are named in our research and would rather not be, write to us at the address below and say so. We will tell you what we hold, and remove personal details unless we are required to keep them. Our assessment of a public website is a comment on that website, not on a person, and we will explain the difference if it matters to your request.

If we write to you first

Sometimes we email a business about what we found on its own website, when that business has never contacted us. If you received an email from us out of the blue, this is the section that explains it.

We write to the address the business publishes on its own site, one message to one business, composed and sent by a person. We do not construct addresses from a domain name, we do not use bought lists, and we do not run campaigns or sequences. Every message says who we are, carries our company registration number, and tells you how to stop hearing from us.

To stop, reply and say so. We record it the day it arrives and we do not write to you a second time. We will also never write to the same business twice on our own initiative — if we have already introduced ourselves, any further email from us is a reply in a conversation you started.

The only thing we say about your business is what our assessment of your website already recorded, on the date it was made. We do not measure your traffic, your customers or your revenue, and an email from us will never claim to.

If you asked us to send you things

There is a box on our forms offering occasional research notes by email. It is never ticked for you, and ticking it is a separate decision from asking us a question — we answer an enquiry whether or not you asked for the notes.

We record what you agreed to, not just that you agreed. Against your address we keep the date, the page you were on, and the exact sentence that was on your screen when you ticked the box. We keep that wording even after we have changed it elsewhere, because the only honest answer to "what did I agree to?" is the words you actually saw.

The notes are sent through an external mail provider, not from this platform. We hand that provider your email address, your name and company if you gave them, and the date and wording of your consent. The provider sends the messages, handles the unsubscribe link at the bottom of each one, and keeps the list from then on.

To stop, use the unsubscribe link in any message, or write to us and we will record it here as well. An address that has asked to stop is not offered to the mail provider again, and ticking the box on a later form does not put it back — we treat a request to stop as standing until you tell us otherwise.

Who else sees it

Our website and database are hosted by our hosting provider, who stores the data on our behalf and does not use it.

We use an external AI service to help draft text. What is sent to it is the business name, the website address, the town or country, and the finding our own assessment already recorded about that website. That is all. Your email address, your telephone number and the message you sent us are never transmitted to it, and nothing it produces is sent to anyone without a person reading it first. The AI service processes the text on our instruction and does not use it for its own purposes.

We do not sell personal data. We do not share it for anyone else's marketing. The mail provider described above sends our messages on our instruction and does not use your address for anything else.

How long we keep it

We will be plain about this rather than quote a period we do not enforce. This platform has no automatic deletion. Enquiries, client records and research stay until somebody removes them by hand. We are working toward a stated retention schedule; until this notice states one, treat the answer as "indefinitely, until you ask us to delete it or we no longer need it".

You can ask us to delete your enquiry at any time and we will.

One record we keep on purpose, and permanently: the list of people who have asked us to stop writing to them. It holds the email address and nothing else. This looks like the opposite of a deletion, and it is deliberate — it is the only way we can be certain we never write to you again. Deleting it would mean forgetting that you asked. If you would rather we removed even that, say so and we will, but we will then have no record of your request.

Your rights

Under the Personal Data Protection Act 2010 you may ask us for a copy of the personal data we hold about you, ask us to correct it if it is wrong, ask us to stop using it for a particular purpose, and withdraw a consent you gave. We may charge the fee the Act permits for a data access request, and we will tell you before we do.

Write to hello@rsresearch.my. We will acknowledge within a few working days and answer within the period the Act allows.

If you are not satisfied with our answer, you may complain to the Personal Data Protection Commissioner.

Keeping it safe

Access to the platform requires an account and a password, every account has only the permissions its role needs, and administrative actions are logged. Research files are stored outside the public web directory so they cannot be reached by guessing a web address, and a document sent to a client travels on a single-use link that can be withdrawn.

No system is perfect and we will not claim otherwise. If personal data is exposed, we will tell the people affected.

Changes

If we change how we use personal data, we change this notice before we make the change, not afterwards.