Contents
- Introduction
- Who We Are
- Scope of This Policy
- Personal Data We Collect
- How We Collect Data
- Why We Use Personal Data
- Our Legal Basis for Processing
- Data in Client Systems We Build
- Cookies and Website Technology
- Sharing with Third Parties
- International Transfers
- How Long We Keep Data
- Security Measures
- Your Rights
- Privacy for Children
- Marketing and Communication
- Automated Decisions and Profiling
- Data Breach Response
- Third Party Links and Services
- Changes to This Policy
- Complaints and Escalation
- How to Contact Us
1. Introduction
This Privacy Policy describes how APPSTOLOGY SDN. BHD. handles personal data in the course of running a computer integrated systems design practice from its riverfront office in Sibu, Sarawak, Malaysia. The Company designs, builds, tests and hands over business systems for organisations in several sectors, and in doing so it comes into contact with a wide range of personal information belonging to clients, their staff, their customers and visitors to this website. We take that contact seriously. Personal data is not a by-product of the work; it is part of the work, and it deserves the same care as any other deliverable.
The developer known as Appstology builds and maintains the websites and applications described on this site, and the Company acts as the responsible organisation for the personal data processed through those products on its own behalf. Where the Company builds a system for a client, the client usually remains the organisation responsible for the personal data held inside that system, and the Company acts on the client instructions as a processor. The distinction matters, and this policy explains it in plain terms in the sections that follow.
We have written this policy so that a reader can understand exactly what happens to personal data at every stage: when it is collected, why it is needed, who may see it, how long it is kept and what a person can ask us to do about it. If anything here is unclear, please write to frontoffice@appstology.com and we will explain it further. The policy applies to this website and to the general business activities of the Company. It does not replace the specific privacy terms that may govern an individual client system, which are set out in the relevant engagement documents.
By using this website or by engaging the Company for a project, you acknowledge that you have had the opportunity to read this policy. You are not required to consent to every activity described here in order to browse the public pages of the site. Where consent is the basis for a particular activity, that basis is identified clearly in the relevant section.
2. Who We Are
The Company is APPSTOLOGY SDN. BHD., a company registered in Malaysia with its office at No 19, 1st Floor Lorong Wong King Huo 5, (Lot 4053 Block 7 Sibu Town District), Sibu - 96000, Malaysia (MY). The practice works in the field of computer integrated systems design, which sits within the professional, scientific and technical services sector. In everyday language, we help organisations replace scattered tools and manual habits with one coherent system that people can operate confidently.
The Company is the controller of the personal data described in this policy where it determines the purposes and means of processing. This includes data collected through enquiries, correspondence, contracts, invoicing, recruitment and the operation of this website. Where the Company processes personal data on behalf of a client inside a system it has built, the client is normally the controller and the Company is the processor, bound by the client written instructions and by the relevant data processing terms in the engagement agreement.
Questions about this policy, about the role of the Company in a particular engagement, or about the exercise of any right described below can be directed to the contact details in the final section. We aim to answer every enquiry within one working day, and to resolve substantive requests within one calendar month unless a longer period is permitted by law and is genuinely required by the complexity of the request.
3. Scope of This Policy
This policy covers personal data processed by the Company in connection with this website, with prospective and existing client relationships, with suppliers and professional advisers, with job applicants, and with the general operation of the practice. It also explains in general terms how the Company approaches personal data when building systems for clients, although the detailed rules for any such system are set out in the engagement documents for that project.
The policy does not apply to websites or services operated by other organisations, even where those organisations are mentioned here or are linked from this site. It also does not apply to personal data that a client holds independently of the Company, including data stored in the client own internal systems before a project begins. Where a client system is hosted or maintained by the Company, the policy of the client governs the rights of the individuals whose data is held in that system, and the Company supports the client in responding to those individuals.
Some engagements involve regulated data, such as financial records or health information. In those cases the Company works to the additional controls required by the client sector, and the specific handling rules are recorded in a written data processing schedule rather than assumed. If you are unsure whether a particular activity falls within the scope of this policy, please ask before sharing personal data with us.
4. Personal Data We Collect
The Company collects only the personal data it needs for a clear purpose. The categories below describe what is typically collected, and the list should be read as an outline rather than an exhaustive catalogue of every field in every circumstance.
Identity and contact data
Name, job title, organisation, email address, telephone number, postal address and any preferred form of address. This data is collected when you write to the studio, submit an enquiry through the website, sign a contract or attend a meeting.
Correspondence data
The content of emails, notes from calls, meeting minutes, briefs, feedback and any documents shared during an engagement. This material is retained so that decisions can be traced and so that later questions can be answered accurately.
Commercial data
Purchase orders, invoices, payment records, tax identifiers and banking references needed to administer a contract. We do not store full payment card numbers on our own systems, and card details are handled by the relevant payment provider where card payment is offered.
Technical data
Internet protocol address, browser type, device type, approximate location derived from the network, pages visited and the time of the visit. This data is used to keep the website reliable and secure, and it is processed in a way that limits the amount of information gathered to what is genuinely useful.
Recruitment data
Curriculum vitae, references, portfolio material and interview notes supplied by applicants. Recruitment data is kept separate from client data and is accessible only to the people involved in the hiring decision and to the administrators who manage the records.
Project data
Where the Company builds or tests a system, project data may include test accounts, sample records and diagnostic logs. We prefer to work with synthetic or anonymised test data, and we ask clients to provide test material that does not contain real personal data unless the purpose of the test genuinely requires it.
We do not deliberately collect special categories of personal data, such as information about health, religion or political opinion, through this website. If such information is shared with us in the course of a project, it is handled under the specific controls recorded for that project and only for as long as the purpose requires.
5. How We Collect Data
Most personal data reaches us directly from the person concerned. You may write an email, complete the contact form, call the office, attend a meeting or submit a document. In each case the data is provided knowingly, and we use it only for the purpose for which it was given or for a closely related purpose that a reasonable person would expect.
Some data is collected automatically when you visit this website. Standard server logs record the request, the time, the response status and a limited set of technical details. These logs are used for security monitoring, fault diagnosis and performance analysis. They are not used to build a profile of individual visitors, and they are not combined with other sources to identify a person unless a security incident requires investigation.
A small amount of data arrives from third parties. For example, a client may refer a colleague by email, a supplier may provide the contact details of an account manager, or a job applicant may be introduced by an agency. Where data arrives from a third party, we ask the source to confirm that it has a lawful basis for sharing it. If you learn that the Company holds data about you that you did not provide, you may contact us at any time and we will explain its origin or delete it where appropriate.
The contact form on this website works by opening the mail application on your own device. The message is sent by you, through your own email provider, to frontoffice@appstology.com. The Company does not operate a separate form database for that message, and the content of the message is held in the same way as any other email sent to the studio.
6. Why We Use Personal Data
Personal data is used for a limited set of purposes, each of which is described below together with the reason it exists. We do not use personal data for a new purpose without first considering whether that purpose is compatible with the original one and, where necessary, informing the person concerned.
Responding to enquiries
To read your message, decide whether the Company can help, and reply with a useful answer. This is the most common reason personal data is held, and it normally involves only a name, an email address and the content of the message.
Delivering engagements
To plan and carry out a project, to communicate with the client team, to record decisions, to manage changes of scope, and to hand over a complete system at the end of the engagement. This includes the build sheet bays, release note runs, client brief desks, test flight windows, store review rounds and handover sittings described on the services page.
Administering contracts
To issue invoices, receive payments, maintain accounting records, meet tax obligations and manage insurance and legal requirements. Records in this category are kept in accordance with statutory retention periods.
Keeping the website secure
To detect and prevent abuse, to monitor availability, to diagnose faults and to protect the integrity of the site. Security monitoring is a legitimate operational activity and is carried out with the minimum data necessary.
Improving the service
To review how engagements have gone, to identify recurring problems and to improve the working methods of the practice. Where possible this is done with aggregated or anonymised information rather than with identifiable records.
Recruitment
To assess applications for roles at the Company, to arrange interviews and to keep a record of the hiring decision. Unsolicited applications are kept only for as long as a genuine recruitment purpose exists.
Legal obligations
To comply with applicable law, to respond to a lawful request from a competent authority, to enforce the Company rights and to defend against a legal claim. This purpose is pursued only where it is genuinely necessary and is limited to what the law or the claim requires.
7. Our Legal Basis for Processing
The Company processes personal data on one of the lawful bases recognised by applicable data protection law. The basis chosen depends on the activity and on the relationship between the Company and the person concerned.
Contract. Where a person is a party to an engagement, or where steps are taken at that person request before an engagement is formed, processing is necessary for the performance of the contract. This covers most of the data used to deliver a project and to administer the associated commercial relationship.
Legitimate interests. Where an enquiry has not yet become a contract, and for security monitoring, service improvement and the general operation of the practice, the Company relies on its legitimate interests in running a professional business. A legitimate interest is only relied on after considering whether the processing is proportionate and whether the rights of the person concerned outweigh it.
Legal obligation. Certain records must be kept, and certain disclosures must be made, because the law requires it. Examples include tax records and responses to a valid legal request from an authority with jurisdiction over the Company.
Consent. Where consent is the chosen basis, it is requested clearly and separately, and it can be withdrawn at any time without affecting the lawfulness of the processing that took place before the withdrawal. Consent is used sparingly, because a clear legitimate interest or a contractual need is usually a better fit for a professional services relationship.
If you believe the Company has relied on the wrong basis for an activity that affects you, you may raise the question with us directly. We will explain the reasoning and, where the reasoning is wrong, correct the record.
8. Data in Client Systems We Build
A large part of the Company work involves building systems that hold personal data belonging to a client organisation. In those projects the client is normally the controller, because the client decides who is in the system, what the records mean and how long they are kept. The Company is the processor, acting on the documented instructions of the client and bound by the confidentiality and security terms of the engagement.
When acting as a processor, the Company accesses personal data only to the extent needed to build, test, maintain or support the client system. Access is limited to named engineers, is logged where the platform permits it, and is removed when the engagement ends. Test environments are populated with synthetic or anonymised data wherever possible, and any use of production data in a test process is recorded and approved in advance.
If you are an individual whose data is held inside a system built by the Company, the fastest way to exercise your rights is usually to contact the organisation that operates the system. That organisation knows what the system is used for and has the direct relationship with you. If you contact the Company instead, we will pass your request to the client without delay and will support the client in responding, unless the law requires us to act directly.
Where the Company provides hosting, maintenance or support after handover, the same processor role applies. We do not use client data for our own purposes, we do not sell it, and we do not move it between clients. Where a client system must integrate with a third party service, the relevant data flows are described in the engagement documents before the integration is built.
11. International Transfers
The Company is based in Malaysia, and most personal data is processed within Malaysia. Some service providers, however, operate infrastructure in other countries, and a transfer outside Malaysia may therefore occur when a provider stores or backs up data in a different region.
Where personal data is transferred outside Malaysia, the Company takes steps to ensure that the transfer is lawful and that the data remains protected. These steps may include contractual terms with the recipient, a review of the recipient security posture, and a preference for providers that allow the storage region to be selected. The Company does not transfer personal data to a jurisdiction where it cannot obtain adequate assurances.
If you would like to know whether a particular activity involves an international transfer, you may ask the Company using the contact details at the end of this policy. We will identify the relevant provider and the safeguard in place. Where a transfer is not necessary for the service you have requested, we will avoid it.
12. How Long We Keep Data
Personal data is kept only for as long as it is needed for the purpose for which it was collected, or for as long as the law requires. Different categories of data have different natural lifetimes, and the Company applies a retention schedule rather than keeping everything indefinitely.
Enquiry correspondence that does not lead to an engagement is normally deleted within twenty four months, unless a longer period is justified by an ongoing conversation or a legal requirement. Contract and project records are kept for the duration of the engagement and for a further period that reflects statutory limitation and tax obligations, typically seven years after the final invoice. Security logs are kept for a short rolling period unless an incident requires them to be preserved. Recruitment records for unsuccessful applicants are kept for a limited period and then deleted unless the applicant has asked to be considered for future roles.
When a retention period ends, personal data is deleted or irreversibly anonymised. Where deletion is technically complex, for example because the data sits inside an encrypted backup cycle, the data is placed beyond ordinary use and is removed when the backup cycle completes. The Company reviews its retention schedule periodically so that the periods remain appropriate to the way the practice actually works.
13. Security Measures
The Company protects personal data with a combination of technical, organisational and physical measures. No system is perfectly secure, and the Company does not claim otherwise, but the measures in place are chosen to make unauthorised access difficult and to make any incident detectable and containable.
Technical measures include encryption in transit for communications and for data moving between services, encryption at rest for stored records where the platform supports it, strong authentication for administrative access, prompt removal of access when a person leaves a project, and regular updates to the software used in the practice. Project environments are separated from one another so that a problem in one engagement does not spread to another.
Organisational measures include written confidentiality obligations, a least privilege approach to access, a clear incident response procedure, and a habit of reviewing what each person can see. Physical measures include controlled access to the Sibu office, secure storage for paper records and a policy of not leaving devices unattended in public spaces.
The Company also designs security into the systems it builds for clients. This includes input validation, sensible default permissions, audit trails for sensitive actions, and a habit of explaining the security model to the client team at the handover sitting. Security that nobody understands tends to be disabled by the first person who finds it inconvenient, so clarity is treated as part of the control.
14. Your Rights
Applicable data protection law gives individuals a set of rights over their personal data. The Company honours these rights and has a simple process for handling requests. A request may be made by email to frontoffice@appstology.com or by post to the address given in the final section, and it will normally be answered within one calendar month.
Right of access
You may ask whether the Company holds personal data about you and, if so, receive a copy together with an explanation of why it is held. We will verify your identity before releasing data, because releasing it to the wrong person would itself be a breach.
Right to correction
You may ask the Company to correct inaccurate personal data. Where the record is incomplete and the missing part matters, you may ask us to complete it, and we will consider whether that is appropriate.
Right to deletion
You may ask the Company to delete personal data that is no longer needed for the purpose for which it was collected. Deletion is not absolute: records required by law, or needed to defend a legal claim, may be retained for the required period, and we will explain the reason if a request cannot be fully granted.
Right to restrict processing
You may ask the Company to pause the use of your data while a question about its accuracy or lawfulness is resolved. During a restriction the data is stored but not actively used, apart from what is needed to answer your request.
Right to object
You may object to processing based on legitimate interests. The Company will stop the processing unless it can demonstrate compelling grounds that override your objection, or unless the processing is needed for a legal claim.
Right to portability
Where processing is based on consent or contract and is carried out by automated means, you may ask for a copy of the data in a structured, commonly used format. Where technically feasible, the Company will send it directly to another organisation at your request.
Right to withdraw consent
Where consent is the basis for an activity, you may withdraw it at any time. Withdrawal does not affect the lawfulness of earlier processing, and it does not end activities that rely on a different lawful basis.
The Company does not charge a fee for handling a reasonable request. Where a request is manifestly unfounded or excessive, for example because it is repeated without good reason, the Company may refuse it and explain the reason, and you may then raise the matter with the relevant authority.
15. Privacy for Children
This website is intended for adults acting in a professional capacity, and the Company does not knowingly collect personal data from children through it. The services of the Company are business services, and there is no reason for a child to submit personal information through the site.
If the Company learns that personal data belonging to a child has been collected through this website without appropriate authorisation, the data will be deleted promptly. A parent or guardian who believes that a child has provided personal data to the Company may contact frontoffice@appstology.com and the matter will be investigated without delay.
Some client systems built by the Company may serve a younger audience, for example a booking system for a school or a learning application. In those engagements the client is responsible for obtaining any consent required for the processing of children data, and the Company builds the system with controls that reflect the sensitivity of that data. The specific arrangements are recorded in the engagement documents for the project.
16. Marketing and Communication
The Company does not send bulk marketing email to people who have not asked to hear from it. Where a client or a contact has expressed a genuine interest in hearing about the practice, occasional updates may be sent. Every such message includes a clear way to stop receiving further messages, and a request to stop is honoured promptly and recorded so that the address is not used again.
Enquiries made through this website are treated as a request for a reply, not as consent to receive marketing material. If you write to us about a project, we will reply about that project. We will not add you to a mailing list without asking first.
The Company does not use personal data to build advertising audiences, and it does not share contact lists with advertising platforms. Where a client engagement requires a communication to that client customers, the communication is sent by the client or by the Company strictly on the client instructions, and the relevant consent and opt-out arrangements are the responsibility of the client.
17. Automated Decisions and Profiling
The Company does not make decisions about individuals using automated processing that produces legal effects or similarly significant effects. Enquiries are read by a person, projects are planned by a person, and hiring decisions are made by a person. Automated tools may help with routine tasks such as sorting email or checking a document for spelling, but they do not decide the outcome of a matter that affects an individual rights.
Some systems built for clients may include rules that route a request, flag an unusual record or prioritise a queue. Where such a system is part of an engagement, the behaviour is described to the client team at the handover sitting, and the system provides a way for a person to review and override the automated outcome. The Company does not build opaque scoring systems that decide a person fate without a human check.
If this position changes for a particular activity, this policy will be updated before the change takes effect, and the new section will explain the logic involved and the way to request a human review.
18. Data Breach Response
The Company maintains a written procedure for responding to a personal data breach. The procedure covers detection, containment, assessment, notification and review. Any member of the team who suspects a breach is expected to report it immediately, without waiting to confirm the details, because early reporting is the single most effective way to limit harm.
Once a suspected breach is reported, the response lead records the facts, isolates affected systems where necessary, and assesses the likely risk to the individuals concerned. Where the breach is likely to result in a risk to the rights and freedoms of individuals, the relevant authority is notified within the period required by law. Where the risk is high, the affected individuals are informed directly, in clear language, with practical advice on what they can do to protect themselves.
After containment, the Company reviews what happened, why it happened and what should change. The review is written down, and the resulting changes are tracked to completion. Where the breach occurred inside a client system, the client is informed without undue delay and is supported in meeting its own notification obligations. The Company does not conceal a breach to protect its reputation; a concealed breach always damages trust more than an honest account.
19. Third Party Links and Services
This website may link to other websites, for example the site of a professional body, a partner organisation or a software provider. Those websites are operated by other organisations with their own privacy practices. The Company does not control them and is not responsible for the way they handle personal data. A link is not an endorsement of every practice on the destination site.
Where an engagement involves a third party service, such as a cloud platform or a payment provider, the client is told which provider is involved and what data will be shared with it. The Company prefers providers with clear documentation and strong default privacy settings, and it avoids integrations that require the creation of unnecessary data copies.
If you follow a link from this site and are asked for personal data by the destination site, please review that site policy before providing it. If you believe a link on this site points to a misleading or unsafe destination, please tell us at frontoffice@appstology.com and we will review it.
20. Changes to This Policy
The Company reviews this policy periodically and updates it when the way it works changes, when the law changes, or when a reader feedback shows that a section is unclear. The date at the top of the page records the most recent update. Substantive changes are described in a short note at the top of the page for a reasonable period so that returning readers can see what has moved.
Where a change materially affects the rights of individuals, the Company will take reasonable steps to bring it to the attention of those who are likely to be affected, for example by a notice on the website or by a direct message to active clients. A change will not be applied retrospectively to processing that took place under an earlier version of the policy.
Continuing to use this website after a change takes effect indicates that you have had the opportunity to read the updated policy. If you do not accept a change, you may contact the Company to discuss it, and you may stop using the website or the related service.
21. Complaints and Escalation
The Company would rather hear about a problem early than learn about it through a formal complaint. If something about the way personal data has been handled feels wrong, please tell us first at frontoffice@appstology.com. We will acknowledge the message, investigate the facts, and reply with an explanation and, where appropriate, a remedy.
If the reply does not resolve the matter, you may ask for the complaint to be escalated to a senior person at the Company. The escalation is tracked with the original reference so that the full history is available to the person reviewing it. The Company aims to close an escalated complaint within one calendar month, and to explain any delay if a longer period is genuinely needed.
You also have the right to complain to the data protection authority in your jurisdiction. In Malaysia, this is the Department of Personal Data Protection. If you are located elsewhere, the relevant authority is normally the one in the country where you live or work. The Company will cooperate fully with a regulator that is investigating a complaint.
22. How to Contact Us
All questions, requests and complaints about this policy or about personal data handled by the Company should be directed to the front office. Please include enough detail for us to understand the matter and, where you are exercising a right, enough information to verify your identity.
Company: APPSTOLOGY SDN. BHD.
Address: No 19, 1st Floor Lorong Wong King Huo 5, (Lot 4053 Block 7 Sibu Town District), Sibu - 96000, Malaysia (MY)
Email: frontoffice@appstology.com
Telephone: +19843315423
We answer written enquiries within one working day, and substantive requests within one calendar month unless a longer period is permitted by law. If you need to speak to a person rather than write, the telephone line is answered during the business hours of the Sibu office. The same people answer both channels, so there is no need to send a message twice.
Thank you for taking the time to read this policy. It exists because the Company believes that clear, honest handling of personal data is part of what it means to build systems that people can trust.