DRAFT — this document has not been approved by the product owner and is not yet in force.

Sistem Tempahan Privacy Policy

This policy explains how Sasa Teguh processes personal data in Sistem Tempahan, in line with Malaysia's Personal Data Protection Act 2010 (PDPA) and its amendments.

1. Our role

For the data of administrators and account owners (name, email, sign-in), we are the data user.
For the data your organisation enters about people who book (name, staff/student number, phone, group, bookings), your organisation decides its purpose and we process it on your organisation's behalf only.

2. Data we collect

Account: name, email, password (stored as a hash that cannot be read), preferred language, last sign-in time.
Payer: name, email, phone, address, TIN/registration number (for invoices).
Bookings: the information your organisation's booking form asks for.
Demo / contact requests from the home page: the name, organisation, email, phone and message you enter — used only to get back to you, and deleted when no longer needed.
Technical: IP address and security logs (sign-in attempts, audit log of administrator actions).

3. Purposes

Providing the booking service, sending transactional emails (verification, invoices, receipts, subscription alerts), preventing abuse, supporting customers and meeting legal obligations (financial records).

4. Disclosure

We do not sell personal data. Data is only disclosed to suppliers needed for the service: server hosting, email delivery, the payment gateway (to process payments) and, if your organisation turns it on, Telegram (notifications). These suppliers are bound to protect the data.

5. Location and security

Data is stored on servers in Malaysia. Connections are encrypted (HTTPS), passwords and PINs are stored as hashes, and each organisation's data is kept separate. If a data breach affects you, we will notify you and the authorities as the law requires.

6. Retention

Data is kept while the account is active. After an account is closed, data is deleted after the cooling-off period shown in Settings → Data. Financial records are kept for the period tax law requires.

7. Your rights

You have the right to access, correct and request deletion of your personal data, and to withdraw consent. Organisation administrators can export all data from Settings → Data. People who book can contact the organisation they booked with first; requests to us are answered within the time the law sets.

8. Cookies and site statistics

We only use necessary cookies (sign-in session, language and security protection). There are no advertising cookies.

The product home page and the sign-in/sign-up pages use Umami, a statistics tool we host ourselves, to count visits, pages viewed and where visitors came from (for example an ad campaign). It uses no cookies, does not store your IP address, respects your browser's "Do Not Track" setting, and its data is not shared with advertising platforms. Organisations' booking pages and admin screens are not tracked.

9. Contact us

Questions or requests about personal data: Sasa Teguh