Privacy Policy 🔒

1. Introduction

Craftec Systems Solution (NS0297531-H) ("Craftec", "we", "us", "our") is committed to protecting your personal data in accordance with the Personal Data Protection Act 2010 (PDPA) of Malaysia. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI automation services.

2. Data Controller Information

3. Personal Data We Collect

In accordance with Section 7 of the PDPA, we collect the following categories of personal data:

3.1 From Clients (Businesses)

• Business name and registration details
• Contact person name, phone number, and email
• Business address
• Payment and billing information
• Business content for AI training (FAQs, pricing, policies)

3.2 From End Users (Your Customers)

• Name and contact details provided during chat
• Chat messages and conversation history
• Appointment/booking information
• Enquiry details and preferences

3.3 Automatically Collected Data

• Device and browser information
• IP address and location data (country/region level)
• Usage analytics and interaction patterns

4. Purpose of Data Processing

Under Section 6 of the PDPA, we process personal data for the following purposes:

• Service Delivery: To provide, operate, and maintain our AI automation services
• Communication: To respond to enquiries, provide support, and send service updates
• AI Training: To train and improve AI responses using provided business information
• Billing: To process payments and maintain financial records
• Improvement: To analyse usage patterns and improve our Services
• Legal Compliance: To comply with applicable Malaysian laws and regulations

5. Consent

5.1. By using our Services, you consent to the collection and processing of personal data as described in this Policy.

5.2. For End Users, consent is obtained when they initiate communication through Client's AI-powered channels.

5.3. You may withdraw consent at any time by contacting us. Withdrawal may affect our ability to provide Services.

6. Disclosure of Personal Data

We may disclose personal data to:

• Service Providers: Third-party vendors who assist in delivering our Services (cloud hosting, payment processors), bound by confidentiality agreements
• Clients: End User data is shared with the respective Client whose AI system they interacted with
• Legal Requirements: When required by Malaysian law, court order, or regulatory authority
• Business Transfer: In connection with any merger, acquisition, or sale of assets

We do NOT sell personal data to third parties for marketing purposes.

7. Data Security

In accordance with Section 9 of the PDPA, we implement appropriate security measures including:

• Encryption of data in transit and at rest
• Secure access controls and authentication
• Regular security assessments and updates
• Staff training on data protection
• Incident response procedures

8. Data Retention

8.1. Client data is retained for the duration of the subscription plus 1 year for legal and accounting purposes.

8.2. End User chat data is retained for 12 months unless the Client requests earlier deletion.

8.3. Upon request, we will delete or anonymise personal data within 30 days, subject to legal retention requirements.

9. Your Rights Under PDPA

Under the PDPA, you have the right to:

• Access: Request access to your personal data held by us (Section 12)
• Correction: Request correction of inaccurate or incomplete data (Section 34)
• Withdraw Consent: Withdraw consent for data processing
• Deletion: Request deletion of your personal data, subject to legal requirements
• Complaint: Lodge a complaint with the Personal Data Protection Commissioner

To exercise these rights, contact us at info@craftec.ai. We will respond within 21 days.

10. Cross-Border Data Transfer

10.1. Our Services may involve data processing in servers located outside Malaysia (e.g., Singapore, United States for cloud services).

10.2. In accordance with Section 129 of the PDPA, we ensure that any transfer outside Malaysia maintains an adequate level of data protection.

11. Cookies & Tracking

Our website uses cookies and similar technologies for:

• Essential website functionality
• Analytics and performance monitoring
• User preference storage

You can manage cookie preferences through your browser settings.

12. Client Responsibilities

Clients using our Services are responsible for:

• Providing their own privacy notice to End Users
• Obtaining necessary consents for data collection through AI channels
• Complying with PDPA in their handling of End User data
• Ensuring accuracy of business information used for AI training

13. Changes to This Policy

We may update this Privacy Policy periodically. Changes will be posted on this page with an updated revision date. For significant changes, we will notify Clients via email.

14. Contact & Complaints

For privacy-related enquiries or to exercise your rights:

If you are unsatisfied with our response, you may lodge a complaint with: