Personal Data Protection Notice (PDPA 2010)

This Personal Data Protection Notice ("PDPA Notice") is issued pursuant to the requirements of the Personal Data Protection Act 2010 (Act 709) ("PDPA") of Malaysia. It informs you ("Data Subject") of how Akureka SDN BHD ("we", "us", or "our"), as the Data User, collects, records, holds, stores, uses, discloses, and processes your personal data in connection with your use of e-Invoice.my (https://e-invoice.my).

This Notice applies to all registered subscribers, business operators, freelancers, authorized team members, and commercial transactors whose personal and business data is processed across e-Invoice.my.

We collect and process personal data directly provided by you or generated during service utilization:

• Identity & Business Data: Full name, national identity card number (NRIC) or passport number (where statutory required), business name, Companies Commission of Malaysia (SSM) registration number, and Tax Identification Number (TIN).
• Contact Details: Official billing address, registered office address, email addresses, and phone numbers.
• Financial & Transactional Records: Invoices, quotations, receipts, itemized billing amounts, bank account numbers, currency preferences, and payment transaction metadata.
• System & Technical Identifiers: IP addresses, login timestamps, device metadata, and session cookies strictly necessary to provide the platform.

Note on Unregistered Guests: Guests generating one-off documents without an account process data entirely within local browser memory; no personal data payload is transmitted or stored on our servers.

Your personal data is processed for the following commercial and statutory purposes:

1. Service Provision: To generate, calculate, deliver, and export invoices, quotations, and financial receipts requested by you.
2. Statutory Tax Compliance: To validate, structure, and enable compliance with Inland Revenue Board of Malaysia (LHDN) e-Invoicing guidelines and Sales & Service Tax (SST) legislation.
3. Account & Workspace Administration: Managing your authentication, subscription renewals, team workspace roles, and multi-user access permissions.
4. Payment Facilitation: Communicating transaction statuses with licensed payment gateways (such as Billplz FPX, Stripe Express, and PayPal).
5. Auditing & Dispute Resolution: Maintaining commercial transaction logs required by Malaysian corporate and tax recordkeeping laws (Companies Act 2016).
6. Customer Communications: Responding to customer inquiries, technical troubleshooting, and notifying you of significant platform or regulatory updates.

Personal data processed by us is collected directly from you when you register an account, configure your business profile, create documents, or communicate with our support personnel.

We do not sell, rent, or trade your personal data. Your personal data may be disclosed to the following categories of third parties strictly on a need-to-know basis:

• Statutory & Government Authorities: Lembaga Hasil Dalam Negeri Malaysia (LHDN), Royal Malaysian Customs Department (JKDM), or law enforcement agencies when mandated by written law.
• Payment & Financial Processors: Billplz Sdn Bhd (FPX online banking), Stripe, Inc., and PayPal Pte Ltd to execute approved payment transfers.
• Cloud & Technology Infrastructure Providers: Trusted server hosting and database providers operating under strict confidentiality and security terms.
• Professional Advisors: Legal advisors, statutory auditors, and tax consultants acting on behalf of Akureka SDN BHD.

Akureka SDN BHD strictly complies with the seven statutory principles under Act 709:

1. General Principle: Personal data is processed solely with your consent or as strictly necessary for contractual fulfillment and legal obligations.
2. Notice and Choice Principle: You are provided with written notice of our processing activities and given choice over voluntary data attributes.
3. Disclosure Principle: Data is never disclosed for unauthorized collateral purposes without prior consent.
4. Security Principle: Technical, physical, and organizational safeguards are implemented to prevent unauthorized access, accidental loss, alteration, or destruction.
5. Retention Principle: Personal data is retained only for as long as necessary to fulfill commercial purposes and statutory Malaysian retention obligations (e.g., minimum 7 years for tax accounting records).
6. Data Integrity Principle: Reasonable steps are taken to ensure personal data is accurate, complete, not misleading, and kept up to date.
7. Access Principle: You have the statutory right to request access to and correction of your personal data.

Under Act 709, you are entitled to:

• Right to Access: Request a copy of your personal data held in our systems.
• Right to Correction: Request the rectification of incorrect, incomplete, or out-of-date personal data.
• Right to Withdraw Consent: Withdraw consent previously granted for optional processing (subject to legal or contractual limitations).
• Right to Limit Processing: Restrict or limit processing of personal data where applicable.

To exercise any of your statutory rights, submit feedback, or raise an inquiry regarding this PDPA Notice, please contact our designated Data Protection Officer:

Attn: Data Protection Officer (DPO)
Operating Entity: Akureka SDN BHD
Platform: e-Invoice.my (https://e-invoice.my)
Email Address: [email protected]
Jurisdiction: Malaysia (Act 709)

In the event of any conflict or inconsistency between the English version and the Bahasa Melayu version of this PDPA Notice, the terms shall be construed in accordance with the Malaysian Personal Data Protection Act 2010.