Privacy Policy & PDPA Notice Dasar Privasi & Notis PDPA

1. Data Controller Identification

The data controller responsible for your personal data is:

• Company Name: AKUREKA SDN. BHD.
• SSM Registration Number: 202601043545 (1705640-X)
• Operating Location: Malaysia
• Data Protection Officer (DPO) Contact: [email protected]

2. Categories of Personal Data We Collect

In accordance with the General Principle (Section 6) of the PDPA, we only collect personal data that is strictly necessary, adequate, and relevant for our commercial transactions and platform operations. This includes:

• Identity & Contact Data: Full name, national identity card/passport number (where legally mandated for statutory CTC e-invoice clearance), business address, email address, telephone numbers.
• Commercial & Billing Data: Company name, business registration number (SSM), LHDN Tax Identification Number (TIN), billing contacts, payment receipt references, invoice details.
• Technical & Telemetry Data: IP address, browser type and version, operating system, device identifiers, session activity timestamps, error diagnostics, and interaction logs.
• Product-Specific Data:
  • e-Invoice.my: ERP/accounting payload tokens, XML/JSON transaction metadata, LHDN CTC status logs.
  • PollPrice.com: Product search queries, location preferences, price feedback submissions.
  • AI Calorie: Uploaded food images, nutritional estimates, dietary logs (processed under strict confidentiality).
  • Email Infinite: Dispatch logs, delivery receipts, bounce reports, DKIM/SPF telemetry.

3. Purposes of Processing Personal Data (Notice Principle — Section 7)

We process your personal data for lawful purposes directly related to our business activities and SaaS provisions, including:

1. Provisioning, maintaining, operating, and securing our software platforms and APIs.
2. Fulfilling legal and regulatory requirements under Malaysian law, including Inland Revenue Board (LHDN) e-invoicing compliance, tax audits, and the Companies Act 2016.
3. Responding to inquiries, project consultations, partnerships, and technical support requests.
4. Preventing fraud, unauthorized API access, denial of service attacks, and security vulnerabilities.
5. Conducting performance analytics, capacity planning, and user experience enhancements.
6. Processing job applications and evaluating candidate profiles submitted through our Careers portal.

4. Disclosure of Personal Data (Disclosure Principle — Section 8)

We do not sell, rent, lease, or trade your personal data to data brokers or third parties for marketing purposes. We may disclose your personal data strictly on a need-to-know basis to:

• Government & Statutory Authorities: Lembaga Hasil Dalam Negeri Malaysia (LHDN), Bank Negara Malaysia, law enforcement agencies, or courts of competent jurisdiction where mandated by law.
• Trusted Cloud & Infrastructure Providers: Hostinger, Cloudflare, server infrastructure providers, and transactional SMS/email delivery rails bound by strict data processing and confidentiality agreements.
• Professional Advisors: External legal counsel, auditors, and tax consultants under professional duties of confidentiality.

5. Security of Personal Data (Security Principle — Section 9)

Akureka implements high-grade physical, technical, and organizational measures to safeguard your personal data from loss, unauthorized access, alteration, accidental destruction, or misuse. Our safeguards include:

• End-to-end TLS 1.3 encryption in transit and AES-256 encryption for sensitive data at rest.
• Strict role-based access control (RBAC) and multi-factor authentication (MFA) for administrative tools.
• Cryptographic signing and tokenized authentication for all API endpoints.
• Regular automated security auditing, vulnerability patching, and dependency monitoring.

6. Data Retention (Retention Principle — Section 10)

We retain personal data only for as long as necessary to fulfill the operational purposes for which it was collected, or to comply with statutory legal, accounting, tax, and auditing requirements under Malaysian law (typically up to seven (7) years for accounting and tax records under the Income Tax Act 1967). When personal data is no longer required, it is irreversibly destroyed or permanently anonymized.

7. Data Integrity (Data Integrity Principle — Section 11)

We take all reasonable steps to ensure that personal data processed by us is accurate, complete, not misleading, and kept up-to-date. You are encouraged to notify us of any changes to your personal details.

8. Your Rights under the PDPA (Access Principle — Section 12)

As a data subject in Malaysia, you are entitled under the PDPA to exercise the following rights:

• Right of Access (Section 30): Request a copy of the personal data we hold about you.
• Right of Correction (Section 34): Request the correction or updating of inaccurate, incomplete, or outdated personal data.
• Right to Withdraw Consent (Section 38): Withdraw your consent to our processing of your personal data at any time (subject to contractual or legal obligations).
• Right to Prevent Processing for Direct Marketing (Section 43): Instruct us to stop using your personal data for direct marketing purposes.
• Right to Prevent Distress (Section 42): Request that we cease processing data in a manner that causes unwarranted substantial damage or distress.

9. Cross-Border Transfers of Personal Data (Section 129)

Where our cloud infrastructure or security delivery partners require personal data to be processed or stored outside of Malaysia, we ensure that such transfers comply with Section 129 of the PDPA. We ensure that recipient jurisdictions offer an equivalent standard of protection, or that transfers are executed under binding contractual clauses ensuring PDPA-level safeguards.

10. Inquiries and DPO Contact Information

To exercise your rights, submit a data access request, or inquire regarding our data practices, please address our Data Protection Officer:

1. Pengenalan Pengguna Data

Pengguna data yang bertanggungjawab terhadap pemprosesan data peribadi anda ialah:

• Nama Syarikat: AKUREKA SDN. BHD.
• Nombor Pendaftaran SSM: 202601043545 (1705640-X)
• Lokasi Operasi: Malaysia
• Pegawai Perlindungan Data (DPO): [email protected]

2. Kategori Data Peribadi Yang Kami Kumpul

Selaras dengan Prinsip Am (Seksyen 6) APDP, kami hanya mengumpul data peribadi yang perlu, mencukupi, dan relevan bagi transaksi komersial dan operasi platform kami, termasuk:

• Data Pengenalan & Perhubungan: Nama penuh, nombor kad pengenalan/pasport (jika diperlukan secara mandatori undang-undang bagi pelepasan e-Invois CTC LHDN), alamat perniagaan, alamat e-mel, dan nombor telefon.
• Data Komersial & Pengebilan: Nama syarikat, nombor pendaftaran perniagaan (SSM), Nombor Pengenalan Cukai (TIN) LHDN, butiran perhubungan kewangan, dan rekod transaksi invois.
• Data Teknikal & Telemetri: Alamat IP, jenis dan versi pelayar web, sistem operasi, pengecam peranti, cap masa sesi capaian, dan log interaksi sistem.
• Data Khusus Produk:
  • e-Invoice.my: Token API/muatan ERP, metadata transaksi XML/JSON, dan status pematuhan LHDN CTC.
  • PollPrice.com: Carian produk pengguna, pilihan cawangan pasar raya, dan maklum balas harga.
  • AI Calorie: Foto makanan yang dimuat naik, anggaran nutrisi, dan diari pemakanan (diproses di bawah kerahsiaan ketat).
  • Email Infinite: Log penghantaran e-mel, resit penghantaran, laporan lantunan, dan telemetri DKIM/SPF.

3. Tujuan Pemprosesan Data Peribadi (Prinsip Notis — Seksyen 7)

Data peribadi anda diproses untuk tujuan-tujuan yang sah dan berkaitan secara langsung dengan perniagaan kami, termasuk:

1. Menyediakan, menyelenggara, mengendalikan, dan mengukuhkan keselamatan platform perisian dan API kami.
2. Mematuhi obligasi undang-undang dan peraturan Malaysia, termasuk pematuhan e-Invois Lembaga Hasil Dalam Negeri (LHDN), audit percukaian, dan Akta Syarikat 2016.
3. Menjawab pertanyaan, permohonan kerjasama pintar, perundingan teknologi, dan bantuan sokongan teknikal.
4. Mencegah penipuan, cubaan penggodaman, serangan penafian perkhidmatan (DoS), dan pencerobohan keselamatan.
5. Menjalankan analisis prestasi sistem, perancangan kapasiti infrastruktur, dan penambahbaikan pengalaman pengguna.
6. Memproses permohonan pekerjaan dan menyaring profil calon yang dikemukakan melalui portal Kerjaya kami.

4. Pendedahan Data Peribadi (Prinsip Pendedahan — Seksyen 8)

Kami tidak menjual, menyewa, atau memajakkan data peribadi anda kepada pihak ketiga untuk tujuan pemasaran luaran. Kami hanya mendedahkan data peribadi berdasarkan keperluan khusus kepada:

• Pihak Berkuasa Kerajaan & Berkanun: Lembaga Hasil Dalam Negeri Malaysia (LHDN), Bank Negara Malaysia, agensi penguatkuasaan undang-undang, atau mahkamah yang berbidang kuasa sekiranya diperintahkan oleh undang-undang.
• Pembekal Awan & Infrastruktur Dipercayai: Hostinger, Cloudflare, pembekal pelayan data, dan gerbang SMS/e-mel transaksional yang terikat dengan perjanjian pemprosesan data yang ketat.
• Penasihat Profesional: Peguam luar, juruaudit bertauliah, dan perunding cukai di bawah obligasi kerahsiaan profesional.

5. Keselamatan Data Peribadi (Prinsip Keselamatan — Seksyen 9)

Akureka mengambil langkah-langkah teknikal dan organisasi berstandard tinggi bagi memelihara data peribadi anda daripada sebarang kehilangan, salah guna, pengubahsuaian, capaian tanpa izin, atau pemusnahan tidak sengaja:

• Penyulitan data penuh TLS 1.3 semasa transit dan AES-256 untuk data sensitif yang disimpan.
• Kawalan capaian berasaskan peranan (RBAC) yang ketat serta pengesahan pelbagai faktor (MFA).
• Penandatanganan kriptografi dan token berkeselamatan bagi semua integrasi API.
• Audit keselamatan berkala dan pemantauan kerentanan perisian berterusan.

6. Penyimpanan Data (Prinsip Penyimpanan — Seksyen 10)

Data peribadi hanya akan disimpan selama mana yang diperlukan bagi memenuhi tujuan pemprosesannya, atau bagi mematuhi ketetapan undang-undang berkanun, perakaunan, dan percukaian Malaysia (lazimnya sehingga tujuh (7) tahun menurut Akta Cukai Pendapatan 1967). Data yang tidak lagi diperlukan akan dimusnahkan atau dinyahnamakan secara kekal.

7. Integriti Data (Prinsip Integriti Data — Seksyen 11)

Kami mengambil segala langkah yang munasabah untuk memastikan data peribadi yang diproses adalah tepat, lengkap, tidak mengelirukan, dan sentiasa dikemas kini.

8. Hak-Hak Anda di Bawah APDP (Prinsip Akses — Seksyen 12)

Sebagai subjek data di Malaysia, anda berhak menggunakan hak-hak berikut di bawah APDP:

• Hak Akses (Seksyen 30): Memohon salinan data peribadi anda yang disimpan oleh kami.
• Hak Pembetulan (Seksyen 34): Memohon pembetulan data peribadi yang tidak tepat, tidak lengkap, atau ketinggalan zaman.
• Hak Menarik Balik Keizinan (Seksyen 38): Menarik balik keizinan pemprosesan data peribadi pada bila-bila masa (tertakluk kepada syarat kontrak dan undang-undang).
• Hak Mencegah Pemasaran Langsung (Seksyen 43): Meminta kami menghentikan pemprosesan data bagi tujuan pemasaran langsung.
• Hak Mencegah Kerosakan atau Kesusahan (Seksyen 42): Menghalang pemprosesan yang berkemungkinan mendatangkan kerosakan atau kesusahan yang tidak wajar.

9. Hubungi Pegawai Perlindungan Data (DPO)

Untuk melaksanakan hak anda, mengemukakan permohonan akses data, atau mengajukan pertanyaan berkaitan dasar privasi kami, sila hubungi: