Notis Privasi

Notis ini disediakan dalam Bahasa Melayu dan Bahasa Inggeris selaras dengan Seksyen 7(3) PDPA. Ia menerangkan bagaimana OMNITEK RESOURCES (No. SSM: 202503311365 (NS0315993-M)) ("kami"), yang mengendalikan platform kad perniagaan digital Myooo, memproses data peribadi.

1. Peranan kami

Data	Siapa pengawal data	Peranan kami
Akaun admin syarikat (Owner/Admin), maklumat pendaftaran & langganan	OMNITEK RESOURCES	Pengawal data
Profil staf, kad, statistik dan lead yang diterima melalui profil staf	Syarikat pelanggan yang melanggan Myooo	Pemproses data — kami memproses data ini hanya atas arahan syarikat tersebut

Jika anda staf syarikat pelanggan, atau orang yang menghantar maklumat melalui borang "Kongsi kenalan anda", pertanyaan mengenai data anda patut dihantar terlebih dahulu kepada syarikat berkenaan. Kami akan membantu syarikat tersebut memenuhi permintaan anda.

2. Data yang dikumpul

Kategori	Contoh
Akaun admin	Nama, e-mel kerja, no. telefon semasa pendaftaran, kata laluan (disimpan sebagai hash), tetapan pengesahan dua langkah (disulitkan)
Syarikat	Nama syarikat, logo, warna jenama, laman web, tetapan akaun
Profil staf (dimasukkan oleh syarikat atau staf)	Nama, jawatan, jabatan, e-mel kerja, no. telefon & WhatsApp, foto, bio ringkas, pautan media sosial
Lead (borang "Kongsi kenalan anda")	Nama, no. telefon, e-mel (pilihan), mesej (pilihan), tanda persetujuan dan masa dihantar
Statistik penggunaan	Kiraan paparan profil, tap/imbas kad dan simpan kenalan, sumber (NFC/QR/pautan) dan masa. Tidak menyimpan alamat IP atau identiti orang yang membuka profil
Data teknikal	Sesi log masuk pengguna panel dan Portal Staf (termasuk alamat IP dan jenis pelayar untuk keselamatan sesi), log audit tindakan admin

3. Tujuan

Menyediakan perkhidmatan Myooo: memaparkan profil kad perniagaan digital, fail kenalan (vCard) dan kod QR;
Membolehkan syarikat mengurus staf, kad NFC/QR dan melihat statistik penggunaan;
Menghantar lead kepada staf dan syarikat berkenaan, atas persetujuan pelawat;
Menghantar e-mel perkhidmatan (pengesahan akaun, jemputan, pautan log masuk Portal Staf, notifikasi lead dan kad hilang);
Keselamatan akaun, pencegahan penyalahgunaan dan log audit;
Sokongan pelanggan, pengurusan langganan dan pengebilan;
Menghubungi admin syarikat mengenai akaun, percubaan percuma atau perubahan perkhidmatan.

Kami tidak menjual, menyewa atau berkongsi data peribadi untuk tujuan pemasaran pihak ketiga.

4. Pendedahan kepada pihak ketiga

Data didedahkan hanya setakat perlu untuk mengendalikan perkhidmatan:

Pihak	Tujuan
Penyedia pengehosan pelayan	Menyimpan aplikasi, pangkalan data, foto dan sandaran
Penyedia penghantaran e-mel	Menghantar e-mel perkhidmatan
Google Fonts	Memuatkan fon laman web. Pelayar anda menghubungi pelayan Google, yang mungkin menerima alamat IP anda
Penyedia pembayaran (apabila digunakan)	Memproses bayaran langganan. Kami tidak menyimpan maklumat kad atau perbankan
Pihak berkuasa	Jika dikehendaki oleh undang-undang Malaysia

Sebahagian penyedia ini mungkin memproses data di luar Malaysia. Dalam keadaan itu, kami memilih penyedia yang mempunyai langkah perlindungan data yang munasabah, selaras dengan Seksyen 129 PDPA.

5. Keselamatan

Data setiap syarikat diasingkan — pengguna syarikat lain tidak boleh mengakses data anda;
Sambungan dilindungi HTTPS; kata laluan disimpan sebagai hash dan tidak boleh dibaca sesiapa, termasuk kami;
Pengesahan dua langkah (2FA) tersedia untuk Owner dan Admin;
Tindakan penting direkod dalam log audit; akses kakitangan kami kepada data adalah terhad atas dasar keperluan;
Pangkalan data dan fail disandarkan setiap hari.

Jika berlaku pelanggaran data peribadi, kami akan memaklumkan syarikat pelanggan yang terjejas tanpa kelewatan yang tidak wajar, dan bekerjasama dalam pemberitahuan yang dikehendaki oleh PDPA.

Butiran lanjut: Keselamatan & Privasi.

6. Pengekalan & pemadaman

Data disimpan selama akaun syarikat aktif;
Staf yang berhenti dinyahaktifkan, bukan dipadam, supaya sejarah dan log audit kekal untuk syarikat. Profil awam mereka tidak lagi dipaparkan;
Selepas percubaan atau langganan tamat, data tidak dipadam secara automatik; panel menjadi baca sahaja;
Syarikat boleh memohon pemadaman kekal secara bertulis. Pemadaman dilaksanakan dalam tempoh 30 hari selepas pengesahan;
Salinan sandaran disimpan selama 14 hari, kemudian dipadam secara automatik;
Rekod tertentu (cth. invois) mungkin disimpan lebih lama jika dikehendaki undang-undang.

7. Hak anda

Tertakluk kepada PDPA, anda berhak untuk:

Mengakses data peribadi anda dan membetulkan data yang tidak tepat;
Menarik balik persetujuan, atau meminta kami menghentikan pemprosesan yang tidak perlu;
Memohon salinan data anda dalam format yang boleh dipindahkan (syarikat boleh mengeksport data staf ke CSV pada bila-bila masa);
Memohon pemadaman data anda.

Staf boleh mengemas kini sebahagian maklumat sendiri melalui Portal Staf. Untuk permintaan lain, hubungi kami di alamat di bawah. Kami mungkin meminta pengesahan identiti sebelum bertindak.

8. Kuki & storan pelayar

Kami hanya menggunakan kuki yang diperlukan: kuki sesi log masuk, perlindungan CSRF dan pilihan "kekal log masuk" Portal Staf (30 hari). Storan pelayar digunakan untuk tetapan paparan seperti tema panel. Kami tidak menggunakan kuki pengiklanan atau penjejakan pihak ketiga.

9. Pindaan

Kami mungkin meminda notis ini dari semasa ke semasa. Tarikh berkuat kuasa di atas akan dikemas kini, dan perubahan ketara dimaklumkan kepada admin syarikat melalui e-mel atau panel.

10. Hubungi kami

OMNITEK RESOURCES (No. SSM: 202503311365 (NS0315993-M))
No.12824/1, Kelisa 7, Taman Tropika, 43000 Kajang, Selangor, Malaysia
WhatsApp: hubungi kami

This notice is provided in Bahasa Melayu and English in accordance with Section 7(3) of the PDPA. It explains how OMNITEK RESOURCES (SSM No.: 202503311365 (NS0315993-M)) ("we"), operator of the Myooo digital business card platform, processes personal data. If there is any inconsistency, the Bahasa Melayu version prevails.

1. Our role

Data	Data controller	Our role
Company admin accounts (Owner/Admin), registration & subscription details	OMNITEK RESOURCES	Data controller
Staff profiles, cards, statistics and leads received through staff profiles	The customer company subscribing to Myooo	Data processor — we process this data only on that company's instructions

If you are an employee of a customer company, or someone who submitted details through a "Share your contact" form, please direct questions about your data to that company first. We will help the company fulfil your request.

2. Data we collect

Category	Examples
Admin accounts	Name, work email, phone number given at registration, password (stored as a hash), two-factor authentication settings (encrypted)
Company	Company name, logo, brand colour, website, account settings
Staff profiles (entered by the company or the staff member)	Name, job title, department, work email, phone & WhatsApp, photo, short bio, social media links
Leads ("Share your contact" form)	Name, phone number, email (optional), message (optional), consent and time submitted
Usage statistics	Counts of profile views, card taps/scans and contact saves, source (NFC/QR/link) and time. No IP address or identity of the person viewing a profile is stored
Technical data	Login sessions for panel and Staff Portal users (including IP address and browser type for session security), audit log of admin actions

3. Purposes

To provide the Myooo service: displaying digital business card profiles, contact files (vCard) and QR codes;
To let companies manage staff and NFC/QR cards and view usage statistics;
To deliver leads to the relevant staff member and company, with the visitor's consent;
To send service emails (account verification, invitations, Staff Portal login links, lead and lost-card notifications);
Account security, abuse prevention and audit logging;
Customer support, subscription management and billing;
To contact company admins about their account, free trial or service changes.

We do not sell, rent or share personal data for third-party marketing.

4. Disclosure to third parties

Data is disclosed only as needed to operate the service:

Party	Purpose
Server hosting provider	Storing the application, database, photos and backups
Email delivery provider	Sending service emails
Google Fonts	Loading website fonts. Your browser contacts Google's servers, which may receive your IP address
Payment provider (when used)	Processing subscription payments. We do not store card or banking details
Authorities	Where required by Malaysian law

Some of these providers may process data outside Malaysia. Where that happens, we choose providers with reasonable data protection measures, in line with Section 129 of the PDPA.

5. Security

Each company's data is segregated — users of other companies cannot access your data;
Connections are protected by HTTPS; passwords are stored as hashes and cannot be read by anyone, including us;
Two-factor authentication (2FA) is available for Owners and Admins;
Important actions are recorded in an audit log; our staff's access to data is limited on a need-to-know basis;
The database and files are backed up daily.

If a personal data breach occurs, we will notify affected customer companies without undue delay and cooperate on any notification required under the PDPA.

More details: Security & Privacy.

6. Retention & deletion

Data is kept while the company account is active;
Staff who leave are deactivated, not deleted, so the company's history and audit log remain. Their public profile is no longer shown;
When a trial or subscription ends, data is not deleted automatically; the panel becomes read-only;
A company may request permanent deletion in writing. Deletion is carried out within 30 days of confirmation;
Backup copies are kept for 14 days and then deleted automatically;
Certain records (e.g. invoices) may be kept longer where required by law.

7. Your rights

Subject to the PDPA, you have the right to:

Access your personal data and correct inaccurate data;
Withdraw consent, or ask us to stop processing that is not necessary;
Request a copy of your data in a portable format (companies can export staff data to CSV at any time);
Request deletion of your data.

Staff can update some of their own details through the Staff Portal. For other requests, contact us at the address below. We may ask you to verify your identity before acting.

8. Cookies & browser storage

We only use essential cookies: login session cookies, CSRF protection and the Staff Portal "stay signed in" option (30 days). Browser storage is used for display preferences such as the panel theme. We do not use third-party advertising or tracking cookies.

9. Changes

We may amend this notice from time to time. The effective date above will be updated, and material changes will be communicated to company admins by email or in the panel.

10. Contact us

OMNITEK RESOURCES (SSM No.: 202503311365 (NS0315993-M))
No.12824/1, Kelisa 7, Taman Tropika, 43000 Kajang, Selangor, Malaysia
WhatsApp: message us