Privacy Policy for WazzCRM (Malaysian PDPA Compliant)

Last Updated: July 2026

This Privacy Policy ("Policy") governs the processing of personal data by WazzCRM ("the Company", "we", "us", or "our") in relation to your use of our software-as-a-service platform, website, and related WhatsApp management tools (collectively, the "Service").

This Policy is prepared in accordance with the Malaysian Personal Data Protection Act 2010 ("PDPA").

Dual-Language Notice / Notis Dwibahasa

In accordance with Section 7(3) of the PDPA, this Policy is issued in both English and Bahasa Malaysia. In the event of any conflict or inconsistency between the English version and the Bahasa Malaysia version, the English version shall prevail.

Selaras dengan Seksyen 7(3) APDP, Polisi ini dikeluarkan dalam Bahasa Inggeris dan Bahasa Malaysia. Sekiranya terdapat sebarang percanggahan atau ketidakseragaman antara versi Bahasa Inggeris dan versi Bahasa Malaysia, versi Bahasa Inggeris akan digunapakai.

1. English Version

1.1 Scope & Relationship of Parties

• As a Data Controller: We act as a Data Controller for the personal data of our direct clients (the businesses who subscribe to WazzCRM) and users of our corporate website.
• As a Data Processor: When you use WazzCRM to manage your customer communications, you are the Data Controller of your customers' data. We act strictly as a Data Processor hosting and routing that information via the Meta/WhatsApp Business API. You are solely responsible for ensuring you have obtained lawful consent from your end-customers before processing their data through our Service.

1.2 Personal Data We Collect

We collect information necessary to provide, optimize, and secure our CRM platform:

• Account Information: Name, corporate email address, business phone number, company name, billing/invoice addresses, and payment details.
• WhatsApp Platform Data: Phone numbers of your end-customers, WhatsApp display names, timestamps, chat logs, media files (images, audio, documents), and delivery statuses synced via the WhatsApp Business API.
• Technical Data: IP addresses, login logs, device specifications, browser cookies, and platform usage analytics.

1.3 Purposes of Processing

Your personal data and your customers' messaging data are processed for the following purposes:

1. To provision, maintain, and support your WazzCRM account and chat infrastructure.
2. To facilitate automated workflows, broadcasting, chat routing, and analytics dashboards.
3. To process billing, invoices, and statutory tax collections (e.g., LHDN compliance).
4. To enforce our Terms of Service and protect against fraud or unauthorized API usage.

1.4 Disclosure to Third Parties

We do not sell your data. We disclose personal data only to the following entities under strict confidentiality terms:

• Meta Platforms, Inc. / WhatsApp: To transmit and process messages through the official WhatsApp Business API.
• Cloud Service Providers: Secure cloud infrastructure companies (e.g., AWS / Google Cloud) hosting our servers.
• Regulatory & Legal Authorities: Where required by Malaysian law or court orders.

1.5 International Data Transfers

As part of our global cloud infrastructure, data may be transferred to or stored on servers located outside of Malaysia. By using the Service, you consent to such cross-border transfers, provided the destination country ensures an adequate level of data protection equivalent to the PDPA.

1.6 Data Security & Retention

• Security: We implement robust administrative and technical safeguards, including HTTPS/TLS encryption in transit and advanced database encryption at rest.
• Retention: We retain personal data for as long as your account is active. Upon termination, conversational data is securely purged or anonymized within 90 days, except for financial records which must be kept for 7 years under Malaysian tax laws.

1.7 Your Rights Under PDPA

You have the following rights regarding your personal data:

• Right of Access & Correction: Request a copy of your data or update inaccurate records.
• Right to Withdraw Consent: Opt-out of marketing communications or terminate your account processing.
• Right to Prevent Processing for Marketing: Request that we do not use your information for direct promotional campaigns.

To exercise these rights, please contact our Data Protection Officer (DPO) at:

• Email: info@kvsbsolutions.com
• Address: WazzCRM Compliance Dept, Level 12, Menara Axis, Petaling Jaya, Selangor, Malaysia.

1.13 Google User Data & Google Calendar Integration

WazzCRM offers an optional Google Calendar integration. It is never enabled automatically: a workspace administrator must explicitly connect a Google account and grant consent.

What Google data we access

• Basic profile (email address): used solely to show which Google account is connected, so an administrator can confirm or disconnect it.
• Calendar events (calendar.events): used to create an event when a customer books an appointment, to remove that event if the booking is cancelled, and to read back changes so a booking deleted or rescheduled in Google Calendar stays consistent inside WazzCRM.

How we use it

Google Calendar data is used only to keep appointment bookings synchronised between WazzCRM and the connected calendar. We do not use it for advertising, we do not sell or transfer it, and we do not use it to train generalised artificial intelligence or machine learning models.

Limited Use disclosure

WazzCRM’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Human beings do not read this data except where required for security purposes, to comply with applicable law, or where the affected user has given explicit consent.

Storage, retention and revoking access

• The Google refresh token is encrypted at rest (AES-256-GCM) and is scoped to the workspace that authorised it.
• Disconnecting Google in Settings → Register Book deletes the stored token immediately and stops all further calendar access.
• Access can also be revoked at any time from your Google Account permissions page.
• Calendar event identifiers held against a booking are deleted when the booking record is deleted, in line with our retention schedule.

2. Versi Bahasa Malaysia

2.1 Skop & Hubungan Antara Pihak

• Sebagai Pengawal Data: Kami bertindak sebagai Pengawal Data untuk data peribadi pelanggan langsung kami (perniagaan yang melanggan WazzCRM) dan pengguna laman web korporat kami.
• Sebagai Pemproses Data: Apabila anda menggunakan WazzCRM untuk menguruskan komunikasi pelanggan anda, anda adalah Pengawal Data bagi data pelanggan anda. Kami bertindak sebagai Pemproses Data yang mengehos dan menghalakan maklumat tersebut melalui Meta/WhatsApp Business API. Anda bertanggungjawab sepenuhnya untuk memastikan anda telah memperoleh persetujuan yang sah daripada pelanggan akhir anda sebelum memproses data mereka melalui Perkhidmatan kami.

2.2 Data Peribadi Yang Kami Kumpulkan

Kami mengumpul maklumat yang diperlukan untuk menyediakan, mengoptimumkan, dan melindungi platform CRM kami:

• Maklumat Akaun: Nama, alamat e-mel korporat, nombor telefon perniagaan, nama syarikat, alamat pengebilan/invois, dan butiran pembayaran.
• Data Platform WhatsApp: Nombor telefon pelanggan akhir anda, nama paparan WhatsApp, cap masa (timestamps), log sembang, fail media (gambar, audio, dokumen), dan status penghantaran yang disinkronkan melalui WhatsApp Business API.
• Data Teknikal: Alamat IP, log log masuk, spesifikasi peranti, kuki pelayar, dan analitik penggunaan platform.

2.3 Tujuan Pemprosesan

Data peribadi anda dan data mesej pelanggan anda diproses untuk tujuan berikut:

1. Untuk menyediakan, menyelenggara, dan menyokong akaun WazzCRM dan infrastruktur sembang anda.
2. Untuk memudahkan aliran kerja automatik, penyiaran (broadcasting), penghalaan sembang, dan papan pemuka analitik.
3. Untuk memproses pengebilan, invois, dan kutipan cukai berkanun (cth., pematuhan LHDN).
4. Untuk menguatkuasakan Syarat Perkhidmatan kami dan melindungi daripada penipuan atau penggunaan API yang tidak dibenarkan.

2.4 Pendedahan Kepada Pihak Ketiga

Kami tidak menjual data anda. Kami mendedahkan data peribadi hanya kepada entiti berikut di bawah syarat kerahsiaan yang ketat:

• Meta Platforms, Inc. / WhatsApp: Untuk menghantar dan memproses mesej melalui API Perniagaan WhatsApp rasmi.
• Penyedia Perkhidmatan Awan: Syarikat infrastruktur awan yang selamat (cth., AWS / Google Cloud) yang mengehos pelayan kami.
• Pihak Berkuasa Kawal Selia & Undang-undang: Jika dikehendaki oleh undang-undang Malaysia atau perintah mahkamah.

2.5 Pemindahan Data Antarabangsa

Sebagai sebahagian daripada infrastruktur awan global kami, data mungkin dipindahkan ke atau disimpan di pelayan yang terletak di luar Malaysia. Dengan menggunakan Perkhidmatan ini, anda bersetuju dengan pemindahan merentas sempadan tersebut, dengan syarat negara destinasi memastikan tahap perlindungan data yang mencukupi yang setara dengan APDP.

2.6 Keselamatan & Penyimpanan Data

• Keselamatan: Kami melaksanakan perlindungan pentadbiran dan teknikal yang teguh, termasuk penyulitan HTTPS/TLS semasa transit dan penyulitan pangkalan data lanjutan semasa rehat.
• Penyimpanan: Kami menyimpan data peribadi selama akaun anda aktif. Selepas penamatan, data perbualan akan dipadamkan dengan selamat atau dijadikan tanpa nama dalam tempoh 90 hari, kecuali rekod kewangan yang mesti disimpan selama 7 tahun di bawah undang-undang percukaian Malaysia.

2.7 Hak Anda Di Bawah APDP

Anda mempunyai hak berikut mengenai data peribadi anda:

• Hak Akses & Pembetulan: Meminta salinan data anda atau mengemas kini rekod yang tidak tepat.
• Hak Menarik Balik Persetujuan: Menarik balik persetujuan daripada komunikasi pemasaran atau menamatkan pemprosesan akaun anda.
• Hak Menghalang Pemprosesan untuk Pemasaran: Meminta kami tidak menggunakan maklumat anda untuk kempen promosi langsung.

Untuk menjalankan hak-hak ini, sila hubungi Pegawai Perlindungan Data (DPO) kami di:

• E-mel: info@kvsbsolutions.com
• Alamat: Jabatan Pematuhan WazzCRM, Aras 12, Menara Axis, Petaling Jaya, Selangor, Malaysia.