QueueUp
Legal · Privacy

Privacy Notice

How QueueUp collects, uses and protects your personal data under Malaysia's Personal Data Protection Act 2010 (PDPA).

Last updated: 8 July 2026 · Also available in Bahasa Malaysia and 简体中文.

1 Who we are

QueueUp is a virtual waitlist service operated by OmniFlow LLP PLT (SSM Reg. No. 202604001701) of Pavilion Bukit Jalil Business Park, Kuala Lumpur, Malaysia. When you join a queue at a restaurant using QueueUp, that restaurant is the data controller of your data and QueueUp acts as its data processor. For our own business contacts, QueueUp is the data controller.

2 The personal data we collect

  • Your name
  • Your mobile number
  • Party size, seating and special-request preferences you choose
  • Queue activity (ticket number, join and seating times) used to run the waitlist

We collect only what is needed to manage your place in line. We do not collect sensitive personal data (such as health, religion or biometric data).

3 Why we use it

  • To hold and manage your place in the queue
  • To notify you by WhatsApp or SMS when your table is ready and about your queue status
  • To estimate wait times
  • To produce anonymised, aggregate statistics (e.g. average wait time) that contain no personal identifiers

We use your data only for queue management. We never sell your data.

4 Our lawful basis

We process your data with your consent, which you give on the join form. You may withdraw that consent at any time (see section 9).

5 Who we share it with

  • The restaurant you are visiting, so it can seat you
  • Our messaging provider, to send WhatsApp/SMS notifications
  • Our cloud hosting provider, to store your data securely in Malaysia

These parties act as our sub-processors under contract and may use your data only on our instructions. We do not share your data with anyone else.

6 Where your data is stored

Your data is hosted in Malaysia. WhatsApp/SMS messages may pass through servers outside Malaysia operated by the messaging provider; wherever data leaves Malaysia we require appropriate safeguards consistent with the PDPA.

7 How long we keep it

We delete your name and mobile number within 30 days of your visit, or sooner. After that we keep only anonymised queue statistics, which cannot identify you.

8 How we protect it

We protect your data with encryption in transit and at rest, access controls limited to authorised staff, activity logging, and regular backups.

9 Your rights under the PDPA

At any time, you may: access the data we hold about you; correct inaccurate data; withdraw your consent; ask us to delete your data; or request a copy of your data (portability). To exercise any right, email us at [email protected]. We respond within the timeframe required by law.

10 Withdrawing consent

You can withdraw consent by replying STOP to a message, leaving the queue, or contacting us. Once you withdraw, we can no longer hold your place in line or send you notifications.

11 Children

QueueUp is not directed at children under 18. A parent or guardian should join the queue on their behalf.

12 Contact & Data Protection Officer

OmniFlow LLP PLT, Pavilion Bukit Jalil Business Park, Kuala Lumpur, Malaysia
Email: [email protected]
Our Data Protection Officer can be reached at the same address.

13 Changes to this notice

We may update this notice from time to time. The "last updated" date shows the current version, and we will highlight material changes.

14 Language

This notice is provided in English, Bahasa Malaysia and Simplified Chinese. In the event of any inconsistency, the English version prevails.