Privacy Policy

1.Who we are

Sunrise Telco Sdn. Bhd. (Company No. 201201005945 (979470-P)) (“Sunrise Telco”, “we”, “us”) is a Malaysian advertising agency that plans, manages and reports on Meta (Facebook and Instagram) advertising for business clients.

This Privacy Policy explains how we collect, use, store, protect and delete information through:

• our website, sunrisetelco.com, and its sub-domains;
• our advertising management services; and
• our Meta business application (the “App”), which connects to the Meta Marketing API through a system user in our verified Meta Business Portfolio.

We handle personal data in accordance with Malaysia’s Personal Data Protection Act 2010 (as amended) (“PDPA”) and the Meta Platform Terms and Developer Policies.

2.Our role

Our role depends on whose data it is:

• Client advertising data. When we manage a client’s Meta assets, the client decides why and how that data is used. We process it only on the client’s behalf and on their instructions, as a data processor.
• Our own enquiries and customers. When you contact us or engage our services, we decide how that data is used and are responsible for it.

The App is an internal business tool. It is not offered to the public, does not offer Facebook Login to consumers, and only accesses Meta assets that a business has expressly shared with our Business Portfolio.

3.Information we access through the App

We access only the information needed to deliver the services a client has engaged us for. Depending on the services, this may include:

Business and asset information

Business Portfolio, ad account, Facebook Page, Instagram account and pixel/dataset identifiers and names, and the roles and permissions assigned to us.

Advertising and performance data

Campaigns, ad sets, ads and creatives; budgets, schedules, bidding and targeting settings; and aggregated performance insights such as impressions, reach, clicks, spend, results and cost metrics. This data is reported in aggregate and does not identify individual people.

Page information

Basic Page details and Page-level engagement needed to create and manage ads on the client’s behalf.

Lead Ads data (only where the client enables it)

Information people choose to submit through a client’s Meta Instant Form, such as name, phone number, email address and answers to form questions. We retrieve this data solely to deliver it to the client.

Conversion data (only where the client enables it)

Sales or appointment events that a client asks us to send back to Meta through the Conversions API, to measure and improve advertising performance. Customer identifiers (such as email or phone number) are converted into irreversible SHA-256 hashes before they are transmitted to Meta.

4.Information we collect through our website

• Information you give us: when you submit an enquiry form or contact us, we collect your name, phone number, email address, business name and anything you include in your message.
• Information collected automatically: our website uses the Meta Pixel and similar technologies to measure visits and the effectiveness of our own advertising. This may include your IP address, browser and device type, pages visited and the referring source. See section 11.

5.How we use information

We use information only to:

• create, manage, optimise and monitor advertising campaigns for our clients;
• prepare performance reports and identify unusual spend or delivery issues, including with automated and AI-assisted analysis tools operated on our behalf;
• deliver Lead Ads data to the client who owns it;
• send conversion events to Meta on a client’s instruction to measure advertising effectiveness;
• respond to enquiries, provide our services and manage our client relationships; and
• meet our legal, accounting and regulatory obligations.

We never use one client’s data to benefit another client, and we never use client data for our own advertising.

6.We do not sell your data

We do not sell, rent or trade personal data or client advertising data, and we never share it with third parties for their own marketing purposes.

Information is disclosed only in the following limited situations:

• To the client who owns the data, for example when we deliver leads or reports.
• To Meta Platforms, as a necessary part of running advertising on Meta’s platforms on a client’s behalf.
• To service providers acting on our behalf, such as secure cloud hosting, data storage and analysis tools. They process data only on our instructions, are bound by confidentiality obligations and may not use the data for their own purposes.
• Where required by law, or to respond to a valid request from a court, regulator or law enforcement authority.

7.Where and how we store data

Data is stored on secure cloud infrastructure provided by established service providers. Some of these providers operate servers outside Malaysia. Where data is transferred outside Malaysia, we take steps to ensure it receives a level of protection consistent with the PDPA.

We protect data with administrative, technical and physical safeguards appropriate to its sensitivity, including:

• encryption of data in transit (TLS) and, where supported, at rest;
• storing Meta access tokens in encrypted, server-side storage only — never in websites, browsers or shared documents;
• least-privilege access, limited to authorised personnel who need it to perform the services;
• two-factor authentication on accounts that can access client data;
• prompt removal of access when a staff member leaves or a client engagement ends; and
• monitoring of access and activity logs.

If a personal data breach occurs that is likely to affect you, we will notify affected clients and individuals, and the relevant authority, as required by the PDPA.

8.How long we keep data

We keep data only for as long as it is needed for the purpose it was collected, then delete it or anonymise it so it can no longer identify anyone.

9.Your rights

Under the PDPA, you may ask us to:

• access the personal data we hold about you;
• correct personal data that is inaccurate, incomplete or out of date;
• delete your personal data, where we are not required to keep it by law;
• stop or limit processing, or withdraw consent you have given; and
• provide your data in a portable format, where applicable.

Send your request to leong@sunrisetelco.com. We may need to verify your identity, and we will respond within 21 days.

If you submitted a form to one of our clients, that client is responsible for your data. Please contact them first; we will assist them in fulfilling your request and delete any copies we hold.

10.Data deletion

You can ask us to delete your data at any time. Step-by-step instructions are on our Data Deletion Instructions page.

11.Cookies and tracking

Our website uses the Meta Pixel and cookies to understand how visitors use the site and to measure our own advertising. You can block or delete cookies in your browser settings, and manage ad preferences in your Facebook and Instagram settings. Blocking cookies does not stop you from using the website.

12.Children

Our website, services and App are intended for businesses and are not directed at anyone under 18. We do not knowingly collect personal data from children.

13.Changes to this policy

We may update this Privacy Policy when our services or legal requirements change. The “last updated” date at the top of this page shows when it was last revised. Significant changes will be communicated to active clients.

14.Contact us

For questions about this policy or your personal data: