Privacy Policy

1. Who is responsible for your personal data

Tangkas Digital PLT is responsible for personal data we collect about our own website visitors, prospective customers, account contacts, billing contacts and support users.

When a workshop or other business uses Tangkas to manage its own customers, bookings, vehicles, transactions, communications or invoices, that business generally decides why and how the personal data is used. In that context, the business is the relevant data controller and Tangkas acts on its instructions as a service provider/processor. If you are that business’s customer, please contact the business first for requests about data it holds.

2. Personal data we collect

Depending on how you interact with Tangkas, we may collect:

• identity and contact information, such as name, business name, role, email address, phone number and account credentials;
• business account and billing information, such as subscription plan, invoices, tax details, payment status and payment-provider references (not full payment-card details);
• service and technical information, such as login records, IP address, device/browser information, approximate location derived from IP, pages/features used, activity logs, error reports and support records;
• content you provide to us, including communications, feedback, quotations and support tickets; and
• Customer Data that a business uploads or creates in Tangkas, which may include customer names, phone numbers, email addresses, booking details, vehicle details, transaction and invoice records, communications and other information chosen by that business.

3. Why we use personal data

We use personal data only where we have a lawful basis and for the following purposes:

• to create, administer, secure and provide Tangkas accounts and the Services;
• to process payments, manage subscriptions, prevent fraud and keep financial records;
• to respond to questions, provide support, investigate incidents and communicate service notices;
• to monitor performance, troubleshoot errors, protect Tangkas and our users, and improve features using aggregated or de-identified insights where practicable;
• to comply with legal obligations and enforce our terms; and
• with appropriate consent or a permitted lawful basis, to send relevant product updates or marketing communications. You can opt out of marketing at any time.

4. Customer Data and our role

A Tangkas business customer is responsible for the Customer Data it places in Tangkas, including ensuring it has an appropriate legal basis to collect and use that data, giving its customers any required privacy notice, setting user permissions, and responding to data-subject requests. Tangkas processes Customer Data only to provide, secure, support and improve the Services, comply with law, and follow the customer’s documented instructions.

5. AI-enabled features

Tangkas may offer optional AI-enabled features, for example to assist with workflow, communications, classification or recommendations. Where enabled by the Customer, the feature may process the relevant Customer Data or account content needed to return the requested result. We will provide a feature-specific notice where the processing materially differs from this Policy.

Tangkas does not use identifiable Customer Data to train a general-purpose or shared AI model. The Customer should not enable an AI feature for data it is not authorised to process. AI outputs may be inaccurate and should be reviewed by a responsible person before being relied on.

6. Who we share personal data with

We may disclose personal data only as necessary to:

• our carefully selected service providers that help us provide Tangkas, such as cloud hosting, security, email, analytics, customer support, payment and communications providers, under appropriate contractual safeguards;
• third-party services or integrations that a Customer chooses to enable, at the Customer’s direction;
• professional advisers, insurers, auditors, financiers or prospective business purchasers, subject to appropriate confidentiality obligations;
• authorities, regulators, courts or other parties where required by law or reasonably necessary to protect rights, safety, security or property; and
• another entity in connection with a merger, reorganisation, financing, sale of assets or similar transaction, subject to this Policy or notice where required.

7. International transfers

Our providers or systems may process personal data outside Malaysia. Where this occurs, we will take reasonable steps to ensure the transfer is permitted under applicable law and protected by appropriate safeguards, including contractual, technical and organisational measures.

8. Security

We use reasonable technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration or disclosure. These measures include access controls, credential protection, least-privilege practices and activity logging where appropriate. Access to production Customer Data is restricted to authorised personnel who need it for operations, security or support.

No online service is completely secure. You are responsible for maintaining secure User credentials, using suitable permissions and promptly notifying us of suspected unauthorised access. We will manage personal data breaches in accordance with applicable law, including notifications where required.

9. Retention and deletion

We keep personal data only for as long as necessary for the purposes described in this Policy, to meet legal or accounting obligations, resolve disputes and enforce agreements. We may retain de-identified or aggregated information for longer.

For Customer Data, the Customer can export data during an active subscription. Following account closure or a valid deletion request, we will delete Customer Data from active systems within 30 days unless retention is required by law, needed to resolve a dispute or requested otherwise by the Customer. Residual copies may remain in backups until overwritten in the ordinary backup cycle.

10. Your choices and rights

Subject to applicable law, you may request access to, correction of, or information about personal data we hold about you, withdraw consent where processing relies on consent, object to or limit certain processing, and ask us to stop direct marketing.

If you are dissatisfied with how we handle your personal data, please contact us first. You may also have the right to make a complaint to the relevant Malaysian data-protection authority.

11. Cookies and similar technologies

Our websites and Services may use cookies, local storage and similar technologies to keep you signed in, remember preferences, protect security, understand usage and improve performance. You can manage cookies through browser settings, but disabling some may affect functionality.

12. Children

Tangkas is intended for business users and is not directed to children. We do not knowingly collect personal data directly from children except where a Customer lawfully enters such data in the Services and is responsible for doing so.

13. Changes to this Policy

We may update this Policy from time to time. We will post the updated version with a new effective date and, where a change is material, provide reasonable notice through the Services or by email. Your continued use after the effective date is subject to the updated Policy.