SalesCandy
SalesCandy is a Malaysian lead distribution and CRM platform that pushes new leads instantly to the right sales agent via a mobile application. It collects leads from Facebook Lead Ads, Google Forms, TikTok, web forms and call tracking numbers, and tracks contact attempts, responses and conversions. Because SalesCandy hosts data in Malaysia and APAC, and uses third party cookies, GDPR compliance requires explicit consent and a documented data transfer chain.
What does SalesCandy do?
What is SalesCandy
SalesCandy is a lead distribution and CRM platform built in Malaysia and used by real estate developers, insurance providers, banks, education and B2B service firms across South East Asia. It pushes new leads from advertising channels (Facebook Lead Ads, TikTok Lead Generation Ads, Google Forms, landing pages, web forms) instantly to the right sales agent through a mobile application, tracks every contact attempt and measures conversion in real time.
What data does SalesCandy collect
SalesCandy collects lead contact details (name, phone, email, address, custom fields), the source channel and creative, contact attempt logs (time, duration, outcome), call recordings when enabled, agent geolocation when the mobile app is active, behavioural data such as ad clicks and form completion, and conversion or sale data.
GDPR and ePrivacy implications
SalesCandy is a third party processor. Its tracking cookies are not strictly necessary and require consent under Art. 5(3) ePrivacy. Behavioural scoring and marketing automation rely on consent under Art. 6(1)(a) GDPR. Call recordings require explicit notice to both parties and a defined retention rule. Agent geolocation may trigger employee monitoring obligations under national labour law and Art. 88 GDPR.
Consent requirements
Block SalesCandy trackers behind a CMP, present a clear privacy notice on the lead forms, deliver a call recording disclosure before phone conversations, and configure granular consent for marketing follow up versus transactional updates.
Data transfers outside the EU
SalesCandy processes data in Malaysia and other APAC regions. None of these countries currently benefits from an EU adequacy decision. Operators must rely on Standard Contractual Clauses and document a Transfer Impact Assessment evaluating Malaysian and Singaporean surveillance laws.
Practical compliance steps
Sign the SalesCandy DPA and SCCs, complete a Transfer Impact Assessment, gate marketing tags behind a CMP, deploy call recording disclosure, restrict agent geolocation to working hours and the strict minimum, define retention rules for leads and recordings, and document SalesCandy in your Article 30 register.
SalesCandy and the GDPR
SalesCandy is classified as “Marketing”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.
- Legal basis
- Consent (Art. 6(1)(a) GDPR) is required for the tracking cookies and the behavioural follow up. Performance of a contract (Art. 6(1)(b)) applies once a lead is converted into a customer. Legitimate interest (Art. 6(1)(f)) is constrained for marketing automation.
- Risk level
- high
- Applicable regulations
- GDPR, ePrivacy Directive, TDDDG, LSSI CE, Malaysian Personal Data Protection Act 2010, Schrems II, Standard Contractual Clauses
Impact assessment (DPIA)
A DPIA is recommended when SalesCandy is used at scale, when it is combined with Facebook Lead Ads or TikTok Lead Generation Ads, or when call recordings and sensitive financial data are stored alongside the lead profile.
Sample text for your banner
We use SalesCandy, a Malaysian lead distribution and CRM platform, to allocate your enquiry to the right sales representative, follow up on your interest and measure conversion. This involves transferring your personal data outside the European Union under Standard Contractual Clauses.
What SalesCandy sets and contacts
- Tracking method
- Client side JavaScript snippet for lead capture, third party tracking cookies, server side API for lead distribution to agents, mobile applications for sales reps, and integrations with Facebook Lead Ads, Google Forms, TikTok and other lead sources.
- Server location
- Malaysia. SalesCandy is operated by SalesCandy Sdn Bhd from Kuala Lumpur with cloud infrastructure on AWS regions in Asia Pacific (Singapore, Mumbai), with optional US regions for global accounts.
- Data transferred outside the EU
- Personal data is transferred to Malaysia and other APAC regions, none of which currently benefits from an EU adequacy decision. Operators must rely on Standard Contractual Clauses and document a Transfer Impact Assessment that addresses Malaysian and Singaporean surveillance laws.
Cookies set (3)
| Name | Type | Duration | Purpose |
|---|---|---|---|
| sc_uid | Marketing | 1 year | SalesCandy visitor identifier used for lead attribution and journey tracking. |
| sc_session | Strictly Necessary | Session | Maintains the admin and agent session in the SalesCandy back office. |
| sc_form | Marketing | 30 days | Stores partial form submissions and UTM parameters for incoming campaigns. |
Third-party domains contacted (3)
salescandy.comapp.salescandy.comapi.salescandy.com
Frequently asked questions about SalesCandy
Can't find your question? Write to us, we answer fast.
Which cookies does SalesCandy set?
SalesCandy sets a marketing visitor identifier for lead attribution, a strictly necessary session cookie for the admin and agent back office, and a marketing cookie that stores partial form submissions and UTM parameters. The marketing cookies require prior consent.
Is consent required to deploy SalesCandy on a European website?
Yes for marketing tracking, advertising integrations and behavioural follow up. The strictly necessary session cookie is exempt. Call recording requires explicit notice to both parties before the call.
What is the legal basis for processing through SalesCandy?
Consent (Art. 6(1)(a) GDPR) for marketing tracking and behavioural follow up. Performance of a contract (Art. 6(1)(b)) once a lead becomes a customer. Legitimate interest (Art. 6(1)(f)) for fraud prevention with a balancing test. Agent geolocation often falls under Art. 88 GDPR with national specifics.
Does SalesCandy transfer data outside the European Union?
Yes. SalesCandy is operated from Malaysia and uses AWS APAC regions. Operators must rely on Standard Contractual Clauses and document a Transfer Impact Assessment evaluating Malaysian and Singaporean surveillance laws.
Is a DPIA required when integrating SalesCandy?
A DPIA is recommended when SalesCandy is combined with Facebook Lead Ads or TikTok Lead Generation Ads, when call recordings and financial data are stored, or when behavioural scoring drives automated agent allocation.
How do I implement SalesCandy in a GDPR compliant way?
Sign the SalesCandy DPA and SCCs, document a Transfer Impact Assessment, gate marketing tags through a CMP, configure call recording disclosures, restrict agent geolocation to working hours, define retention rules, and document SalesCandy in your Article 30 register.
Are there European alternatives to SalesCandy?
Yes. Salesforce Sales Cloud (in EU regions), Pipedrive (Estonia), HubSpot (with EU data residency), Zoho CRM (with EU servers) and Sellsy (France) offer comparable lead distribution and CRM features with EU data residency.
How do I update my cookie policy after enabling SalesCandy?
List sc_uid and sc_form as marketing cookies and sc_session as strictly necessary. Disclose SalesCandy Sdn Bhd as a sub processor in Malaysia, mention the APAC infrastructure and re trigger the consent banner so existing visitors can review the updated processing chain.
%22%3E%0A%20%20%20%20%20%20%20%20%3Cpath%0A%20%20%20%20%20%20%20%20%20%20%20%20d%3D%22M0%200V31.9956H31.9956V0H0ZM26.4097%206.06138L6.01028%2026.4608C5.96785%2026.5026%205.91386%2026.5307%205.85528%2026.5415C5.79669%2026.5524%205.73621%2026.5453%205.68165%2026.5214C5.6271%2026.4975%205.58097%2026.4577%205.54924%2026.4073C5.51752%2026.3569%205.50164%2026.2981%205.50368%2026.2386V5.85252C5.50368%205.77356%205.53505%205.69783%205.59089%205.64199C5.64672%205.58615%205.72245%205.55478%205.80142%205.55478H26.1986C26.2572%205.555%2026.3144%205.5725%2026.3631%205.60509C26.4118%205.63769%2026.4498%205.68392%2026.4723%205.738C26.4948%205.79209%2026.5009%205.85162%2026.4898%205.90914C26.4786%205.96667%2026.4508%206.01962%2026.4097%206.06138Z%22%0A%20%20%20%20%20%20%20%20%20%20%20%20fill%3D%22%23002B49%22%20%2F%3E%0A%20%20%20%20%3C%2Fg%3E%0A%20%20%20%20%3Cdefs%3E%0A%20%20%20%20%20%20%20%20%3CclipPath%20id%3D%22clip0_1793_61%22%3E%0A%20%20%20%20%20%20%20%20%20%20%20%20%3Crect%20width%3D%2232%22%20height%3D%2232%22%20fill%3D%22white%22%20%2F%3E%0A%20%20%20%20%20%20%20%20%3C%2FclipPath%3E%0A%20%20%20%20%3C%2Fdefs%3E%0A%3C%2Fsvg%3E)
Foleon
Foleon is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Foleon enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Foleon empowers marketing teams to achieve measurable growth.
Thrive Quiz Builder
Thrive Quiz Builder is an interactive quiz and calculator builder that helps businesses create engaging, lead-generating content for their websites. It supports branching logic, scoring systems, and personalized result pages that increase engagement. Thrive Quiz Builder integrates with email marketing and CRM platforms to capture and segment leads based on responses. With customizable designs and embeddable formats, Thrive Quiz Builder drives conversions through interactive content marketing.
e-goi
e-goi is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. e-goi provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, e-goi helps deliver the right message to the right audience at the right time.
Yeps
Yeps is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Yeps provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Yeps helps deliver the right message to the right audience at the right time.
Blueshift
Blueshift is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Blueshift provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Blueshift helps deliver the right message to the right audience at the right time.
Neon CRM
Neon CRM is a customer relationship management (CRM) platform that helps businesses organize, track, and nurture customer interactions across the entire lifecycle. It provides contact management, sales pipeline tracking, and automated workflows. Neon CRM centralizes customer data from multiple touchpoints, enabling personalized experiences, faster deal closing, and improved retention. With reporting dashboards and integrations, Neon CRM empowers data-driven relationship management.
Make your site compliant today.
Free up to 25,000 sessions a month. No credit card, no commitment.