Legal

Privacy Policy

OTOMA TECHNOLOGY (SSM 202603181536 (003868751-D))
Last updated: [DATE]

1. Who this policy applies to

This policy explains how OTOMA TECHNOLOGY ("we", "us", "our") handles personal data in line with Malaysia's Personal Data Protection Act 2010 ("PDPA"). It applies to:

• Our clients: businesses that use our services, and the people at those businesses who contact or work with us.
• Our clients' customers: people who chat with a WhatsApp assistant, or receive messages from an automation, that we build and operate on behalf of a client.
• Visitors to this website and anyone who contacts us directly.

When we operate an assistant for a client, the client business decides why and how its customers' data is used, and we process that data on the client's behalf and on its instructions. If you are a customer of one of our clients, the client's own privacy notice also applies to you, and you can contact either the client or us about your data.

2. What we collect

We collect only what is needed to provide the service. Depending on the service, this may include:

• Contact details: name, phone number, WhatsApp profile name and email address.
• Messages: the content of chats with an assistant, including text, images, voice notes and documents you choose to send.
• Booking and enquiry details: for example appointment dates, the service you are interested in, or answers to questions the assistant asks.
• Consent records: when and how you agreed to receive messages, and any opt-out requests.
• Basic technical data: message timestamps and delivery status, and, for this website, standard server logs kept by our hosting provider.
• Client business information: business contact details and the information a client gives us to set up its assistant.

We do not ask for sensitive personal data (such as health, religious or financial account details) unless a client's service genuinely requires it and you have given explicit consent. Please do not send such information to an assistant unless you are asked to and are comfortable doing so.

3. How we use it

We use personal data only to:

• answer questions and respond to enquiries;
• book, reschedule, cancel and remind you about appointments;
• pass your enquiry to the right person at the client business;
• send follow-ups and reminders you have agreed to receive;
• process documents you send, for the purpose you sent them;
• keep services secure, fix problems and improve the quality of answers for that client; and
• meet our legal obligations.

We do not sell personal data, and we do not use one client's customer data for another client.

4. Consent and opting out

By starting a chat with an assistant, or by agreeing to receive messages from a client business, you consent to your personal data being processed as described in this policy. Assistants only start conversations with people who have agreed to be contacted.

You can opt out at any time by replying STOP to any message. We will stop sending you follow-ups, reminders and promotional messages, and record your opt-out. You can also withdraw consent by contacting us or the client business directly. Withdrawing consent may mean an assistant can no longer help you with some requests.

5. Who we share it with

We share personal data only as needed to provide the service, with:

• The client business you are chatting with, which receives your enquiries, bookings and chat history.
• Meta (WhatsApp Business Platform), which carries WhatsApp messages. Meta's own terms and privacy policy apply to your use of WhatsApp.
• AI processing providers, which process message content to help the assistant understand questions and write replies. Where the provider offers it, we use settings that stop this data being used to train their models.
• Hosting and cloud providers, which run the servers and databases our services use.
• Google tools, such as Google Sheets, Calendar, Drive and Gmail, where a client uses them to store bookings, records or messages.
• Authorities, where we are required to by law.

Some of these providers may store or process data outside Malaysia. When this happens, we take reasonable steps to make sure the data is protected to a standard comparable to the PDPA.

6. Storage and security

• Wherever possible, data is stored in accounts that the client business owns and controls, such as its own WhatsApp Business account and Google account.
• Access is limited to the people who need it to provide and support the service.
• We use encrypted connections, access controls and reputable providers to protect data from loss, misuse and unauthorised access.
• If a data breach occurs that is likely to affect you, we will notify the affected client and, where required, the Personal Data Protection Commissioner and affected individuals.

No system is completely secure, but we work to keep the risk as low as reasonably possible.

7. How long we keep it

We keep personal data only for as long as it is needed for the purposes above. Chat records are kept for [RETENTION PERIOD, e.g. 12 months] unless the client business instructs otherwise or the law requires longer. When a client stops using our services, we return or delete its data as agreed with that client.

8. Your rights

Under the PDPA, you can:

• Access the personal data we hold about you;
• Correct personal data that is inaccurate, incomplete or out of date;
• Delete your data or withdraw consent to its processing;
• Limit how your data is used, including for direct marketing.

To make a request, contact us using the details below. We may need to confirm your identity first. We will respond within 21 days, as required by the PDPA. If your request concerns data we hold for a client business, we may work with that client to complete it.

9. Changes to this policy

We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated at the top.

10. Contact us

For any question or request about your personal data, please contact: