Legal information

Privacy Policy

Last updated:

Ajak.my ("we", "us", or "the platform") is committed to protecting personal data. This Privacy Policy explains what we collect, why we process it, who receives it, how long we retain it, and the choices available when you use our website, merchant portal, WhatsApp loyalty tools, automation, OCR, integrations, and related services.

1. Scope and Data Roles

This Policy applies to personal data processed in commercial transactions under Malaysia’s Personal Data Protection Act 2010 ("PDPA"), including applicable amendments and requirements. Ajak.my generally acts as data controller for merchant account, billing, support, security, and website data. For a merchant’s customer, prospect, or staff data processed only to provide the subscribed service on that merchant’s instructions ("Merchant Personal Data"), the merchant acts as data controller and Ajak.my acts as data processor to the extent those roles apply.

2. Information We Collect

a) Merchants and account users

  • Name, business name and type, contact details, account role, and subscription information
  • Billing, invoice, payment status, acceptance, cancellation, and support records
  • Password hash and authentication, login, device, IP, security, and activity records
  • Configuration and integration data, including WhatsApp identifiers or credentials you submit

b) Loyalty members and other merchant contacts

  • WhatsApp phone number and, where supplied, name, email, and date of birth
  • Points, purchases, referrals, rewards, redemptions, messages, form responses, receipts, and transaction history
  • Other data a merchant lawfully submits or instructs us to process through enabled features

c) Website and technical data

  • Server logs, IP address, browser, device, timestamps, referring page, and requested pages
  • Session, security, preference, and consent-cookie information
  • Diagnostic, webhook, integration, and error records needed to operate and protect the service

3. How and Why We Use Data

  • To register, authenticate, administer, bill, support, and communicate with account users
  • To operate loyalty points, rewards, messaging, analytics, automation, OCR, and integrations
  • To follow merchant instructions concerning Merchant Personal Data
  • To secure the platform, detect abuse and fraud, investigate incidents, and enforce our Terms
  • To improve reliability and features using aggregated or de-identified insights
  • To maintain accounting, tax, contract, consent, audit, dispute, and legal records
  • To comply with lawful requests and obligations under Malaysian law

Where information is marked as required, failure to provide it may prevent registration, payment, integration, support, or delivery of the relevant feature. Optional information may be left blank unless it becomes necessary for a feature you choose.

4. Disclosure and Service Providers

We do not sell personal data. We may disclose only what is reasonably necessary to:

  • Meta / WhatsApp: deliver messages and operate connected WhatsApp features, subject to the WhatsApp Privacy Policy
  • Hosting, email, payment, analytics, support, security, and AI providers: operate the functions for which they are engaged
  • The relevant merchant: administer that merchant’s loyalty programme and customer relationship
  • Professional advisers, transaction counterparties, and authorities: protect legal rights, complete a corporate transaction, or comply with law

Service providers that process personal data for us are required to protect it under appropriate written obligations.

5. Overseas Processing

Some providers, including Meta/WhatsApp and infrastructure or support providers, may process data outside Malaysia. Where section 129 of the PDPA applies, we use a permitted transfer condition or appropriate safeguard and take reasonable steps to require protection consistent with applicable law.

6. Security

We maintain reasonable technical and organisational safeguards appropriate to the data and risk, which may include HTTPS, password hashing, access controls, restricted credential access, logging, backups, webhook verification, vulnerability management, staff confidentiality, and incident-response procedures. No internet service can guarantee absolute security. Merchants remain responsible for secure account configuration, least-privilege access, protected devices and credentials, and promptly removing former users.

7. Personal Data Breaches

We assess suspected personal data breaches, take reasonable containment and remediation steps, and notify the Personal Data Protection Commissioner and affected data subjects where required by applicable law. Merchants must notify us promptly of suspected compromise involving their account or Merchant Personal Data and cooperate with investigations and legally required notifications.

8. Retention, Account Closure, and Deletion

We retain personal data only as long as reasonably needed for the purposes described, an active account, security and backup integrity, fraud prevention, accounting and tax duties, dispute handling, or other legal requirements. Merchants should export required data before access ends. After termination, Merchant Personal Data may be removed from active systems and then deleted or rendered inaccessible through the ordinary backup-retention cycle. Billing, acceptance, security, audit, and dispute records may be retained longer where reasonably required by law or legitimate legal purposes.

A deletion request does not require deletion of information that must or may lawfully be retained, has been irreversibly de-identified, belongs to another controller, or is needed to establish, exercise, or defend legal rights.

9. Your Rights and Choices

Subject to the PDPA and verification of identity, you may ask whether we process your data, request access or correction, withdraw consent where processing depends on consent, object to direct marketing, or make a deletion or restriction request for consideration under applicable law. If your data belongs to a merchant’s loyalty programme, contact that merchant first because it normally controls that data. We may forward the request to the relevant merchant.

Send requests to support@ajak.my. We may request information necessary to verify identity and locate the relevant records.

10. Cookies and Analytics

Essential cookies support login, security, preferences, and consent records. Optional visitor analytics is activated only after the applicable consent choice and is used to understand and improve the service. You may change browser settings or withdraw optional-cookie consent, but disabling essential cookies may prevent the portal from working correctly.

11. Merchant Responsibilities

Merchants are responsible for providing required privacy notices, obtaining valid consent or another lawful basis, honouring data-subject requests, limiting collection to necessary data, configuring suitable retention, and using messaging lawfully. Merchants must not submit sensitive, financial-credential, identity-document, health, or children’s data unless its use is lawful, necessary for the subscribed feature, and expressly agreed with Ajak.my.

12. Changes to This Policy

We may update this Policy for legal, security, operational, or service changes. We will change the date above and provide reasonable notice of material changes. Any consent required by law will be obtained separately.

13. Contact Us

For privacy questions, requests, or complaints, contact: