Privacy Notice.

1. Who is who (controller vs processor)

• For your account & SaaS billing (name, email, password hash via Supabase Auth, workspace name/code, plan/status, billing profile/TIN, support tickets): timah.my operator (Schedule A, Terms) is the data controller.
• For workspace business data you enter (clients, contacts, opportunities, proposals, trainings, venues/trainers/vendors incl. IC/bank, namelists, evaluations, portals, invoices/TINs, receipts, message content): you (the customer workspace) are the principal data user / controller; timah.my is your processor acting only on your instructions (your clicks, imports, automations) and these Terms. You owe PDPA duties to your end-users; we owe processor duties to you.
• Card/bank credentials are processed by HitPay and never touch our servers. LHDN/HRD Corp filings you submit are yours; we merely transmit/store your documents.

2. What we collect

• Account & membership: name, email, password (hashed by auth provider — we never see plaintext), avatar if set, workspace name/code, role, invitation/acceptance records, PDPA consent timestamp, login/session metadata.
• Business data you supply: companies, contacts (name, email, phone, designation), opportunities/events, proposals/versions, trainings/sessions/namelists (participant name, IC, employer, email, phone), venues/trainers/vendors (incl. IC no., bank account, contact), logistics/print/HRDC trackers, T3/JD14 artefacts, evaluations/follow-ups, certificates, invoices/payments/credit notes (incl. buyer TIN, address), cost ledger, uploaded docs (docx/pptx/images/receipts), AI prompts/outputs derived from them.
• Billing (SaaS): plan, status, seats, training counts, checkout sessions, subscription/webhook events, payment history (amount/method/date — no card numbers), e-invoice profile and issued SaaS e-invoices/credit notes.
• Operational & technical: audit logs, reminder/notification/message logs (to/from/subject/sanitised status — not full card data), inbound-email/WhatsApp/Telegram metadata, rate-limit counters, error logs, IP/device/user-agent, signed-URL issuance, consent and deletion logs.
• Public submissions to your links: eval/follow-up answers, portal namelist uploads, trainer doc/claim submissions, certificate verification lookups, calendar subscriptions — tied to the token used.
• We do not intentionally collect location, biometrics or health data. If participants volunteer such data in free-text evals, it is treated as supplied by you.

3. Sensitive, children & end-user data

• Malaysian IC numbers, bank details and TINs you upload are sensitive personal data in practice — collect only what the feature needs (e.g. T3 needs IC; trainer payout needs bank), and obtain explicit consent from each individual before uploading or messaging them.
• You represent you have that consent (and parental/guardian consent for under-18 participants) and will produce evidence on request. Do not upload IC/bank data into fields that do not need it, and redact documents where possible.
• We process end-user data only as your processor: no independent marketing to your contacts, no sale of personal data, ever.

4. Purposes & consent

• Purposes: provide/maintain the service (incl. AI-assisted proposals/reports/classification where you enable them and stay within budgets); subscription, SST and e-invoice administration; transactional reminders and dunning; abuse/fraud prevention, rate-limiting and security; backups and troubleshooting; legal, tax and audit compliance and retention review; aggregated, de-identified analytics.
• Consent basis: signup PDPA tick + workspace creation stamp (server-side, transactional); invitation acceptance; portal/eval submission; continued use after notice of updates. Withdrawing consent may degrade or disable features (e.g. no AI without AI processing; no WhatsApp without number processing) and does not retroactively erase lawful processing or legal holds.
• Where you rely on contractual necessity or legitimate interests for employees’ business-contact data, you remain responsible for the basis and notices to them.

5. Sub-processors & sharing

Each receives only what its function needs, under contracts/terms requiring confidentiality and purpose limitation:

• No sale or rental of personal data. Disclosure beyond the above only: (a) on your instruction (e.g. you click Send/Submit/Share); (b) to authorities on lawful request or to meet tax/HRDC-record duties; (c) to enforce Terms or protect rights/safety; (d) on merger/acquisition with notice and same protections.
• We publish sub-processor changes in-app/notice; continued use after effective date is acceptance; your remedy is export, downgrade or workspace closure; any erasure request is reviewed separately.

6. Cross-border transfers

• Hosting, backups, email delivery, WhatsApp/Telegram and AI inference may occur outside Malaysia. By using the service you consent to such transfers as permitted under PDPA ss. 129–129B and the 2024 amendments, subject to appropriate safeguards (contracts, encryption, minimisation).
• If you require Malaysia-only residency for a dataset, do not put it into cloud features (AI, WhatsApp, portals) — keep it offline. We cannot offer per-table residency on standard plans.

7. Security & breach response

• Measures: per-tenant row-level security, TLS, private buckets with short-lived signed URLs, server-side secrets (never in member-readable settings), HMAC webhook verification, rate limiting and AI budgets, least-privilege roles (sales vs ops). See Terms §14 for your duties (passwords, offboarding, token rotation).
• Breach: on discovering a notifiable breach we will contain, assess, log, notify the Personal Data Protection Commissioner and affected individuals without undue delay as required by the amended PDPA, and inform workspace owners via account email/in-app where contactable. Our notice describes what happened, data types, steps taken and what you should do (e.g. regenerate tokens, warn your contacts).
• No system is perfectly secure. Report suspected vulnerabilities or token leaks promptly via support — do not access other tenants’ data to “test”.

8. Retention

• Active and suspended workspaces: business records are retained while the workspace exists. Non-payment does not erase the workspace. Operational messages and read notifications may be cleaned up under their configured retention rules; retained financial delivery records are kept separately.
• After workspace closure: the workspace is frozen and all its records, their relationships and uploaded files are retained, including financial records and their supporting references. A provisional seven-year retention review period applies to the archive; the final policy remains subject to documented legal and operational review and any legal hold. This is not a universal legal retention claim or an automatic deletion date. No final archive purge is currently implemented.
• Backups and hosted logs: retention depends on the configured hosting services and their policies. The deployed backup periods, log retention and disposal evidence must be verified; we do not promise a fixed 90-day expiry or immediate removal from backups when a workspace closes.
• Closure mechanics: Settings → Billing → Danger Zone requires the owner’s workspace code and password. Closure ends normal staff and public portal access, retains an archive manifest and requests recurring billing cancellation. Unconfirmed cancellation keeps the workspace frozen pending audited reconciliation; it is not reported as successful cancellation. Archive access is restricted to explicitly enrolled operators and audited with a purpose. Existing signed file links can remain usable until their issued expiry.
• Export and erasure requests: export before closure if you need your own copy. The sequential JSON export has no database snapshot, may miss concurrent edits and excludes file bytes; download needed files separately. Closure does not itself erase data. Requests for erasure or a shorter retention period require a separate documented review of obligations, supporting references and legal holds.

9. Your rights (21 days)

• Under PDPA you may request access, correction, export, processing limitation, deletion and withdraw consent. Workspace owners can self-serve export and closure and submit a separate erasure request; members via their owner; your end-users via you (forward verified requests to us and we assist as processor).
• How: use Settings → Billing for export or closure. Contact support for an erasure or other privacy request, with your tenant code, account email and requested action. We verify identity, respond within 21 days (longer if complex/lawful hold — we will explain), and may charge only what the law allows (currently no fee via self-serve).
• We may refuse or limit where the law permits: legal/tax hold, others’ privacy, disproportionate effort, or manifestly unfounded/excessive repeats. Withdrawal does not erase prior lawful processing and may end features that need the data.

10. Portals, tokens, cookies & marketing

• Capability links are secrets. Client/trainer portals, QR evals, certificate verify pages, calendar feeds and inbound-email addresses work without login by design. Anyone you forward them to may use them while the link and workspace remain active. Closing blocks new portal access; previously issued signed file links expire on their own schedule. Label them private; regenerate on staff change.
• Logs/cookies: essential session/security cookies and server logs (IP, device, pages, API use with Cache-Control: private, no-store on APIs) to operate and secure the service. No third-party ad trackers. Marketing emails (if any) are opt-in with unsubscribe; transactional messages (receipts, reminders, dunning) are service communications, not marketing.
• QR eval/portal pages show minimal branding; submissions are stored in your workspace and visible to your members per roles.

11. Contact, DPO & complaints

• Support / privacy requests: via Settings → Billing support or the email on our homepage. Include tenant code and account email. A named privacy officer / DPO appointment and a verified contact route are required launch gates; no appointment is asserted here. Support receives privacy requests until the verified contact is published.
• Complaints: contact us first (21-day response). You may also complain to the Pesuruhjaya Perlindungan Data Peribadi / Personal Data Protection Commissioner under the PDPA.
• Changes: material changes notified in-app/email at least 14 days before effect; continued use is acceptance; remedy is export, downgrade or closure; erasure requests are reviewed separately. Prior versions available on request.

12. Ringkasan Bahasa Malaysia