TechnoNet Sdn Bhd (SSM Registration No. 198901005373), incorporated in Malaysia, is the data user and data controller for personal data collected through our websites and platforms.
Where TechnoNet processes personal data on behalf of a customer — for example, scanning a customer's codebase with AuditCore or processing queries through KnowledgeCore — TechnoNet acts as a data processor under PDPA s.9 (as amended in 2024) and is directly liable for breaches — fine up to RM 1,000,000.
This policy applies to all personal data collected through:
Each product has specific data handling notes in Section 3 below.
TechnoNet applies the data minimisation principle — only the minimum data necessary for each purpose is collected (PDPA 2010 s.6 — Necessity Principle).
| Category | Data | Purpose | Legal basis |
|---|---|---|---|
| Account data | Email address, hashed password | Authentication, account management | Contract |
| Billing data | Stripe customer ID, subscription status | Payment processing | Contract |
| Usage data | Scan job IDs, project paths, scan results, API call logs | Service delivery, audit trail | Contract |
| Technical data | IP address, session token | Security, rate limiting | Legitimate interest |
| Enquiry data | Name, email, message content | Responding to contact and demo requests | Consent |
We do not collect payment card details (handled entirely by Stripe), health data, financial account data, racial or ethnic origin, religious beliefs, or any other special category data.
Personal data is processed for the following specific purposes only:
We will not use your personal data for any purpose not listed above without first obtaining your explicit, separate consent.
By accepting our Terms of Service at signup, customers enter into a Data Processing Agreement with TechnoNet Sdn Bhd. This DPA governs how we process personal data on your behalf and documents TechnoNet's obligations as a data processor under PDPA s.9 (as amended in 2024).
Key terms of the DPA:
A full DPA document is available on request: [email protected]
| Sub-processor | Service | Data processed | Location |
|---|---|---|---|
| Stripe Inc. | Payment processing | Billing data, card details (Stripe direct — never touches TechnoNet servers) | USA (PCI-DSS L1) |
| Cloudflare Inc. | Network / CDN / tunnel | Network metadata only — no payload inspection | USA (ISO 27001) |
| Qdrant (self-hosted) | Vector database | Regulatory document corpus only — no personal data | Malaysia (on-premises) |
All AI inference (compliance analysis, knowledge queries, decision explanations) runs on TechnoNet's on-premises hardware in Malaysia. No customer data is transmitted to any external AI provider.
This sub-processor list is reviewed quarterly. Last reviewed: June 2026.
Stripe and Cloudflare are located outside Malaysia. Transfers are governed by their respective standard contractual clauses and certifications (PCI-DSS L1 and ISO 27001 respectively). These transfers comply with PDPA 2010 s.129.
Personal data transferred to these processors is limited to billing identifiers (Stripe) and network metadata (Cloudflare). No scan content, document content, or AI query payloads leave Malaysia.
| Data | Retention period | Deletion |
|---|---|---|
| Account data | Duration of account + 12 months | On request or account deletion |
| Scan results (AuditCore) | 90 days | Auto-purged after 90 days, or earlier on account deletion |
| Uploaded / scanned files (AuditCore) | Duration of scan only | Deleted immediately after scan completes |
| API call logs (DecisionCore) | Retained | Decision records form the ADMT audit trail that explainability regulation requires, so there is no automated purge. Request erasure at [email protected]. |
| Session tokens | 30 days (or logout) | Auto-expired |
| Enquiry and contact data | 3 years from last interaction | On request or end of retention period |
| Billing records | 7 years | Required by Malaysian tax law (Income Tax Act 1967) |
| Breach register | 5 years | Required by PDPC Advisory on Breach Notification 2024 |
As a data subject, you have the following rights:
To exercise any of these rights, submit a written request to our Data Protection Officer at [email protected]. We will respond within 21 days.
Our websites use Umami Analytics — a self-hosted, privacy-first analytics tool operated on TechnoNet's own infrastructure. Umami collects only anonymised, aggregated usage statistics (page views, referrers, device types). It does not use cookies, does not track individuals across sessions, and does not transmit any data to third-party analytics providers.
No cookie consent banner is required because we use no tracking cookies and no personal data is collected through analytics. If you have JavaScript disabled, no analytics data is collected at all.
We do not use advertising pixels, social media tracking, or any other third-party tracking technology.
(PDPA s.12B, inserted in 2024)
An internal Breach Register is maintained by the Data Protection Officer and retained for 5 years.
TechnoNet implements appropriate technical and organisational measures to protect personal data:
AuditCore delivers Compliance Visibility — a scored report on every technical gap between your files and Malaysian regulatory requirements. Scan results do not constitute legal advice. Your legal team and compliance officer determine whether any identified gap constitutes a violation and the appropriate remediation steps. TechnoNet accepts no liability for decisions made on the basis of scan results without appropriate legal review.
We may update this policy to reflect changes in law or our practices. Material changes will be notified by email to registered users at least 14 days before taking effect. The version date at the top of this page indicates the most recent revision. Continued use of our services after notification of material changes constitutes acceptance of the updated policy.