Privacy Policy

We may collect the following categories of personal data:

• Identity data — full name, MyKad/passport number (where required by law)
• Contact data — email address, phone number, WhatsApp number, mailing address
• Business data — business name, SSM registration number, business address, industry type
• Account data — username, password hash, account preferences, access roles
• Transaction data — sales records, inventory movements, payment method type (amount only; we do not store full card numbers)
• Device & usage data — IP address, browser/app type, device identifiers, pages visited, crash logs
• Communication data — messages sent to our WhatsApp, email, or support channels

We collect this data directly from you (registration, support enquiries), automatically (app telemetry, logs), and from third-party platforms (Google Play, app stores) where permitted.

We process your personal data for the following purposes:

• Providing, maintaining, and improving the Astana POS software and Astana Biz services
• Processing subscriptions, renewals, and billing via WhatsApp or authorised resellers
• Sending service-related communications (account alerts, system updates, downtime notices)
• Responding to support requests and enquiries
• Sending promotional communications — only with your consent, and you may opt out at any time
• Complying with legal obligations under Malaysian law, including LHDN e-Invoice (MyInvois) requirements
• Detecting and preventing fraud, unauthorised access, and security incidents
• Conducting internal analytics to improve our products

Under the PDPA 2010, we process your personal data on the following bases:

• Consent — you have given explicit consent (e.g., subscribing to marketing)
• Contract — processing is necessary to perform our services agreement with you
• Legal obligation — we are required to process certain data under Malaysian law
• Legitimate interests — improving our services and preventing fraud, where your rights are not overridden

We do not sell your personal data. We may share it with:

• Service providers — cloud hosting providers, payment processors, email/SMS platforms, analytics tools — bound by confidentiality obligations
• Authorised resellers & partners — Astana Biz dealers and MCBIZ hardware partners, only as necessary to fulfil services you have requested
• Regulatory authorities — LHDN, SSM, or other Malaysian authorities where required by law
• Successors — in the event of a merger, acquisition, or asset sale, with notice to you

Our cloud infrastructure may process data in servers located outside Malaysia (e.g., Singapore, US). Where such transfers occur, we ensure equivalent levels of data protection through contractual safeguards consistent with the PDPA.

We retain personal data for as long as necessary to fulfil the purposes outlined in this policy, or as required by law. Account data is retained for the duration of your subscription and up to 7 years thereafter for legal and financial record-keeping purposes. You may request earlier deletion — see Section 8.

We implement industry-standard technical and organisational measures to protect your data, including encrypted data transmission (TLS), access controls, and regular security reviews. No method of transmission over the internet is 100% secure; we cannot guarantee absolute security but will notify you without undue delay in the event of a material breach affecting your data.

As a data subject, you have the right to:

• Access — request a copy of personal data we hold about you
• Correction — request correction of inaccurate or incomplete data
• Withdrawal of consent — withdraw consent for marketing communications at any time
• Limit processing — request that we limit how we use your data in certain circumstances

To exercise any of these rights, contact our Data Protection Officer at [email protected] or +603 3396 5656. We will respond within 21 days.

Our website and web app use cookies and similar technologies to maintain sessions, remember preferences, and collect aggregate usage statistics. You may control cookie settings through your browser; disabling cookies may affect some features.

We may use third-party analytics tools (e.g., Google Analytics, Meta Pixel) to understand how users interact with our site. These tools may set their own cookies subject to their respective privacy policies.

Our services may contain links to third-party websites or platforms (e.g., Google Play Store, WhatsApp). We are not responsible for the privacy practices of those platforms and encourage you to review their policies.

Our services are not directed at children under 18 years of age. We do not knowingly collect personal data from minors. If you believe we have collected such data, please contact us immediately.

We may update this Privacy Policy from time to time. Material changes will be notified via in-app notice or email at least 14 days before taking effect. Continued use of our services after the effective date constitutes acceptance of the updated policy.

For any questions, data access requests, or complaints regarding this Privacy Policy, please contact: