PDPA Compliance

1. Introduction to PDPA Compliance

The Personal Data Protection Act 2010 (Act 709), as amended by the Personal Data Protection (Amendment) Act 2024, is the primary legislation in Malaysia governing the processing of personal data in commercial transactions. It establishes seven core principles that data controllers must observe, and — following the 2024 amendments — imposes direct obligations on data processors (including the Security Principle). EzFlow, as a software platform used by Malaysian businesses to manage their operations, handles personal data in two distinct capacities:

• As a Data Controller (formerly "data user" under the pre-2024 PDPA) — when we collect and process personal data of our subscribers (business owners and their authorised staff) for the purpose of providing the EzFlow platform.
• As a Data Processor — when our subscribers use EzFlow to store and manage personal data of their own customers and employees. In this capacity, we act on the instructions of the subscriber (who is the Data Controller) and are directly bound by the PDPA's requirements applicable to data processors.

Our compliance obligations are comprehensive and apply to both capacities. In line with the 2024 amendments, the Company has appointed a Data Protection Officer to oversee PDPA compliance and handle data-related inquiries, and has notified the appointment to the Personal Data Protection Commissioner as required (see Section 7).

2. The Seven PDPA Principles

We structure our data processing practices around the seven principles set out in the PDPA. Below we describe how each principle is applied within EzFlow.

2.1 General Principle

Personal data shall not be processed unless the data subject has given consent, or processing is necessary for a contractual obligation, legal obligation, vital interest, administration of justice, or the exercise of functions conferred by any written law.

EzFlow collects personal data only when a user creates an account and explicitly agrees to our Privacy Policy and EULA. We do not process personal data for any purpose that a subscriber has not consented to or that is not required for the lawful delivery of our services.

2.2 Notice and Choice Principle

A data subject must be informed of the purposes for which their personal data is collected and processed. They must be given a choice whether to provide that personal data.

We fulfil this principle by:

• Presenting our Privacy Policy and EULA before account creation — no account may be created without acknowledgement
• Clearly stating the purposes of data collection at each point of collection
• Providing opt-in consent mechanisms for non-essential data processing (e.g., marketing emails)
• Allowing subscribers to manage their communication preferences at any time within their account settings

2.3 Disclosure Principle

Personal data shall not be disclosed to any third party without the consent of the data subject, except where disclosure is permitted by the PDPA or required by law.

We never sell, rent, or trade personal data. We disclose personal data only to:

• Authorised sub-processors (Vultr for server infrastructure hosting; Stripe for subscription payment processing; Billplz for split-payment collections; Anthropic/Claude for AI document text extraction (OCR); Resend for transactional email delivery; Twilio for WhatsApp/SMS delivery and phone verification; Meta/WhatsApp for automation features) who are contractually bound to PDPA-equivalent standards
• Legal and regulatory authorities where required by Malaysian law or a valid court order
• The data subject themselves, upon a valid access request

All third-party sub-processors are listed in our Privacy Policy with the nature of data disclosed and processing locations.

2.4 Security Principle

Practical steps must be taken to protect personal data from any loss, misuse, modification, unauthorised or accidental access, disclosure, alteration, or destruction.

Our security measures include:

• Encryption of all data in transit using TLS/SSL and encryption at rest (AES-256) on our self-managed infrastructure
• Row-Level Security (RLS) policies ensuring that each subscriber can only access their own data, and subscribers' customer data is logically isolated
• Multi-factor authentication and role-based access controls for internal systems
• Regular security audits and vulnerability assessments
• Heightened, risk-commensurate safeguards for any sensitive personal data (including biometric or NRIC data)
• Incident response procedures with breach notification to the Commissioner as soon as practicable, and to affected data subjects without unnecessary delay where significant harm is likely (see Section 7.2)
• Passwords are never stored in plain text — industry-standard cryptographic hashing is applied via EzFlow's first-party authentication system

2.5 Retention Principle

Personal data shall not be kept longer than is necessary for the fulfilment of the purpose for which it was collected.

Our retention schedule:

• Active accounts: Data is retained for the duration of the active subscription to support service continuity
• Post-termination: Data is retained for 30 days to allow the subscriber to export their business records, after which it is permanently deleted
• Financial records: Invoice and transaction records may be retained for up to 7 years as required by Malaysian tax law (Income Tax Act 1967 and related regulations)
• Deleted data: Upon a valid deletion request, personal data is removed from active systems and from backups within 90 days

2.6 Data Integrity Principle

Personal data shall be accurate, complete, not misleading, and kept up to date by having regard to the purpose, including any directly related purpose, for which the personal data was collected and further processed.

We maintain data integrity by:

• Providing subscribers with the ability to review, update, and correct their own account information at any time within their account settings
• Applying database-level validation and constraints to prevent malformed or corrupt records
• Offering a correction request process via privacy@ezflowlabz.com for data that cannot be self-corrected
• Logging data modification events for auditability

2.7 Access Principle

A data subject shall be given access to their personal data and be able to correct that personal data where it is inaccurate, incomplete, misleading, or not up-to-date.

We honour access rights by:

• Providing an in-platform data export feature allowing subscribers to download their own business data at any time
• Processing formal access requests submitted to privacy@ezflowlabz.com within 21 calendar days as required by the PDPA
• Responding to correction requests within 21 calendar days
• Providing a written explanation if an access or correction request is refused, including the grounds for refusal

3. What Personal Data We Collect

The categories of personal data we collect and process depend on the relationship between the data subject and EzFlow.

3.1 Subscriber Data (Business Owners and Staff)

• Full name of the authorised business representative
• Business name and Malaysian SSM registration number
• Email address and Malaysian mobile phone number
• Password (cryptographically hashed — never in plain text)
• Subscription and billing information (processed by Stripe — EzFlow does not receive raw card data)
• Platform usage and activity logs
• IP address, device type, and browser information

3.2 Customer Data (Processed on Behalf of Subscribers)

When subscribers use EzFlow to manage their own customers, the following categories of data may be stored. The subscriber is the Data User for this data; EzFlow is the Data Processor.

• Customer names and contact information (mobile number, email)
• Appointment and booking history
• Invoice and transaction records
• WhatsApp message logs (where the subscriber uses the WhatsApp automation feature)
• Google review data linked to the subscriber's business

3.3 Uploaded Documents, OCR, and Sensitive Personal Data

Where a subscriber uses features that extract data from uploaded documents or images (optical character recognition, or "OCR"), the document content is processed by our AI sub-processor Anthropic (Claude) solely to return the extraction result. Under Anthropic's commercial API terms, submitted inputs and outputs are not used to train Anthropic's models.

Following the Personal Data Protection (Amendment) Act 2024, "sensitive personal data" expressly includes biometric data (in addition to data on health, political opinions, religious beliefs, and the commission of offences). A document a subscriber uploads may contain sensitive personal data — for example an identity document, or a record bearing a Malaysian identity card (NRIC) number, photograph, or signature.

We do not require sensitive personal data to deliver our core Services. Where sensitive personal data is processed, we do so only on the basis of the explicit consent of the data subject and apply heightened security measures commensurate with the risk. We do not use sensitive personal data to train or improve AI or machine-learning models.

4. How We Use Personal Data

All processing is limited to purposes disclosed at the time of collection. We do not process personal data for any undisclosed secondary purpose.

4.1 Primary Purposes

• Account creation, authentication, and management
• Delivery of all subscribed platform features (appointments, scheduling, invoicing, WhatsApp automation, Google review management, analytics)
• Processing subscription payments via Stripe
• Sending transactional notifications (booking confirmations, payment receipts, one-time passwords)
• Providing customer support and responding to inquiries

4.2 Secondary Purposes (Consent Required)

• Sending marketing communications about EzFlow features, promotions, or updates — only with explicit opt-in consent
• Conducting user research and feedback surveys

4.3 AI and Service Improvement

With the consent obtained at registration, we use personal data relating to a subscriber's account and platform usage to operate, secure, analyse, and improve the Services, including to develop and train EzFlow's own features and AI/machine-learning models for internal purposes. We prioritise aggregated and de-identified data for this purpose; we do not use sensitive personal data for model training; and customer data we hold as a data processor is not used to train our models except in aggregated or de-identified form. Subscribers may opt out of the use of their identifiable personal data for model training by contacting our Data Protection Officer. Full details are set out in Section 4.5 of our Privacy Policy.

4.4 What We Will Never Do

• Sell, rent, or trade personal data to any third party for their own commercial purposes
• Use subscriber data or subscriber customer data for profiling unrelated to service delivery
• Use sensitive personal data (including biometric or NRIC data) to train or improve AI models
• Process personal data for any purpose not disclosed in this statement or our Privacy Policy without obtaining fresh explicit consent

5. Your Rights as a Data Subject

Under the PDPA, every data subject has enforceable rights with respect to their personal data. All requests should be submitted to privacy@ezflowlabz.com. We will acknowledge receipt within 5 business days and respond substantively within 21 calendar days unless the PDPA permits a longer period.

5.1 Right of Access

You may request a copy of all personal data we hold about you, together with a description of the purposes for which it is processed, the categories of data held, and the third parties to whom it may have been disclosed. We may charge a reasonable administrative fee as permitted by the PDPA.

5.2 Right to Correction

You may request correction of any personal data that is inaccurate, incomplete, misleading, or out of date. Subscribers can update most account data directly within the EzFlow platform. For data that cannot be self-corrected, submit a request to our Data Protection Officer.

5.3 Right to Withdraw Consent

Where processing is based on your consent, you may withdraw it at any time by contacting privacy@ezflowlabz.com. Please note that withdrawal of consent for processing that is necessary for the delivery of our services will result in the termination of those services. Withdrawal does not affect the lawfulness of processing that occurred before withdrawal.

5.4 Right to Request Deletion

You may request that we delete your personal data. We will comply within 30 days, subject to any legal retention obligations (e.g., financial records required under Malaysian tax law). We will notify you of any data we are legally required to retain and the basis for retention.

5.5 Right to Lodge a Complaint

If you are not satisfied with how we have handled your personal data, you may lodge a complaint with the Personal Data Protection Commissioner of Malaysia:

5.6 Right to Data Portability

Following the Personal Data Protection (Amendment) Act 2024, you may request a copy of your personal data in a structured, commonly used, machine-readable format and, where technically feasible and the data format is compatible, request that we transmit it directly to another data controller. Submit requests to privacy@ezflowlabz.com.

6. Cross-Border Data Transfers

Section 129 of the PDPA governs transfers of personal data outside Malaysia. Following the Personal Data Protection (Amendment) Act 2024 and the 2025 Cross-Border Personal Data Transfer Guidelines, the former "whitelist" approach has been replaced by a risk-based framework: a transfer is permitted where the destination provides a law substantially similar to the PDPA or an adequate level of protection, or where another lawful basis applies (including the data subject's consent, contractual necessity, or appropriate contractual safeguards / binding corporate rules).

EzFlow relies on these bases for the following transfers, in each case limited to the minimum data necessary and protected by encryption and contractual data-processing terms:

7. Data Protection Officer & Data Breach Notification

7.1 Data Protection Officer

In line with the Personal Data Protection (Amendment) Act 2024, the Company has appointed a Data Protection Officer (DPO) accountable for our compliance with the PDPA, and has notified the appointment to the Personal Data Protection Commissioner as required. The DPO is the primary point of contact for data subjects and the Commissioner and can be reached at privacy@ezflowlabz.com.

7.2 Data Breach Notification

Consistent with the 2024 amendments, our incident-response procedures provide that:

• Where we have reason to believe a personal data breach has occurred, we will notify the Personal Data Protection Commissioner as soon as practicable
• Where the breach is likely to cause significant harm to affected data subjects, we will notify those data subjects without unnecessary delay
• We maintain records of personal data breaches and the remedial steps taken

8. Contact Our Data Protection Officer

For any questions, concerns, access requests, correction requests, or complaints relating to the processing of your personal data by EzFlow, please contact our Data Protection Officer:

This PDPA Compliance Statement is reviewed annually or whenever there is a material change to our data processing practices. The version number and effective date at the top of this page reflect the most current revision.