Privacy Notice

This notice explains how Legasiku handles personal data, as section 7 of the Personal Data Protection Act 2010 requires. It has six parts. This part covers your account on Legasiku. It also says who we are, what your rights are and how to reach us, and those apply to every part.

(a) Who we are, and who is responsible for your data. Legasiku is operated by WEBISCOPIC SDN. BHD., Registration No. 202301024302 (1518225-U), at https://legasiku.arifhusaini.com. It is called "we" in this notice. We are responsible for the data in your account: we are the data controller (the Act called this a data user before its 2024 amendment) under the Personal Data Protection Act 2010. A company you work for or deal with is not responsible for the account itself.

(b) What we collect, and where it comes from. When you sign up you give us your name, your email address and a password. We keep the password only in a scrambled form that cannot be turned back into the password. You also declare "I am 18 or over" in a box that you tick yourself, and we keep that declaration with its time. We keep your choice of language. When you use your account we keep a record of each sign-in and of each sign-in attempt, as one-way codes and not as your address, so that we can see abuse. If you turn on two-step sign-in, which uses an authenticator app on your phone, we keep, encrypted, the secret it needs and your recovery codes. If you choose "Continue with Google", we keep a one-way code of Google's identifier for your account, not the identifier itself. When a company adds you as a member of its staff, we get your email address and job title from the company, not from you, and we keep the link between you and the company with the date you started. If you sign an order form for your company, we keep the name, capacity, email address, phone number and address written on it, and we keep the bills and payments of your company's subscription; where your company is a sole trader or a partnership, these are about you. If you agree to show your name and photo on your company's card, we keep your agreement with the version of the face notice you agreed under, and the name, photo and headline you choose. The face notice is a separate notice: we show it to you where your photo is taken or added, before you agree. If you ask for a copy of your data, we keep the request and, for 7 days, the file we make. If we list your name before you join, for example as someone who may hold a Seat in a Chapter, we have not collected it from you: the list holds the name as shown, initials, a photo, a job title and the reason we listed you. We tell you about this notice when we first contact you, and you can ask us at any time to remove the listing; we remove it at once.

(c) Whether you must give it. Your name, email address, password and the declaration that you are 18 or over are needed to open an account; without them we cannot open it. Your language, photo, headline and two-step sign-in are your choice, and so is signing in with Google.

(d) What we use it for. We use it to open and run your account; to keep it safe, for example by limiting repeated sign-in attempts and by refusing a password known to have leaked; to check that you are 18 or over; to send you the messages you need about your account, such as the one that confirms your email address or lets you reset your password; to bill your company for its subscription, where you sign for it; to answer your requests about your data; and to keep the records the law makes us keep.

(e) Rules that run by themselves. Some decisions about your account are made by rules, without a person deciding each case: limits on how many times one person or one address can sign in, ask for a code or repeat another action in a period, and the refusal of a password known to have leaked. The other parts of this notice say which rules apply to requests, jobs and networks. You can ask, through our single contact point named at the end of this part, for a person to review a decision made by any of these rules.

(f) Small files in your browser (cookies). Legasiku sets a cookie that keeps you signed in during your visit (the session cookie) and a cookie that protects the forms you send against misuse. Both are strictly necessary for the site to work and are not used for anything else. Two small cookies remember display choices you make, such as light or dark appearance and whether the side menu is open; they hold no personal data. Cookies that are set only when you take a first step are explained in the parts that use them. We do not use advertising or tracking cookies.

(g) Age. You must be 18 or over to have an account, and we do not knowingly deal with anyone under 18. If we learn that an account belongs to someone under 18, that account can no longer send a request, give a price offer, join a network or confirm a job; we close it and delete its data, except what the law makes us keep.

(h) Consent is kept apart from terms. Creating an account is not accepting any terms, and this notice is a statement, not a consent. Where we need your consent for something, we ask for it in a step of its own and keep it as its own record.

(i) Who receives it. Only these kinds of people and companies receive data from your account: our own staff who need it for their work; the service providers that run Legasiku for us and may only follow our instructions, which are the hosting of the server and its backups and the sending of email; the company you work for, which sees your name, email address and job title as its staff member; Google, only if you choose to sign in with it; and the authorities, where the law requires it.

(j) Whether your data goes outside Malaysia. Yes. Legasiku and its data are hosted by DigitalOcean, LLC, a company of the United States, on servers in Singapore. Our backups, a copy of uploaded files and our logs are encrypted on our own server before they are stored with DigitalOcean in Singapore. DigitalOcean uses other companies to provide its services; for all of its services it names Amazon Web Services (United States) for back-ups and other infrastructure, Cloudflare (United States) for platform security, and Traversal (United States) for troubleshooting and support. The emails Legasiku sends, with your email address and the words of the message, go through Mailgun Technologies, Inc., a company of the United States, on its servers in the European Union. Each of these receivers is bound by contract, directly with us or through DigitalOcean's contract with us, to protect your data to a standard at least equal to the Personal Data Protection Act 2010; that is the ground on which section 129 of the Act, as amended in 2024, allows us to send it outside Malaysia. We add a receiver to this notice before it receives your data.

If you choose "Continue with Google", Google LLC, a company of the United States, learns that you are signing in to Legasiku, and Google sends us your email address and Google's identifier for your account. This happens only because you choose it, and Google handles that sign-in under its own privacy policy.

When you choose a password, our server sends only the first five characters of a one-way code (a SHA-1 hash) of it to the Have I Been Pwned password range service, so that we can refuse a password known to have leaked. Those five characters are not personal data: they cannot be traced to you or turned back into your password, and nothing else about you is sent.

(k) How long we keep it. We keep your data no longer than we need it for the purpose we collected it for. Your account stays until you close it. You can close it in your account settings: when you do, we remove at once your name, email address, password, two-step sign-in, photo and headline, and end every sign-in session. What the law makes us keep stays, each record for its own period, and is then deleted: the record that you accepted terms or agreed to a notice for 7 years; order forms, bills and payments, which are records of account and tax records, for 7 years; and security records for at least 2 years, kept as one-way codes. Sign-in sessions end by themselves when you stop using them, a code that confirms an email address or resets a password lasts up to 60 minutes, and the file of a copy of your data is kept for 7 days. A listing made before you joined is removed at once when you ask, and otherwise 30 days after your own profile takes its place.

(l) Your rights. You may ask to see the data we hold about you and to have a copy of it; ask us to correct it if it is wrong, incomplete or out of date; withdraw a consent you gave, in writing, at any time, which does not undo what was done before you withdrew it; ask us to stop using your data in a way that is likely to cause you damage or distress; and ask us to send the data you gave us to another organisation you choose, where it is technically possible, as the 2024 amendment to the Act provides (data portability). In your account settings you can see and correct your name and email address, ask for a copy of your data and close your account. For any other request, write to our single contact point named at the end of this part. We answer a request within 21 days. If you decline to give data that is required, we may not be able to open or keep the account, request or job that needs it. If you are not satisfied with our answer, you may complain to the Personal Data Protection Commissioner Malaysia.

(m) If a breach happens. If a breach of personal data happens, we notify the Personal Data Protection Commissioner, and the people affected, as the Act requires.

(n) Changes to this notice. Each version of this notice is published with the date it takes effect, and earlier versions can still be read on the same page.

(o) Who to contact. Our data protection officer is NUR ARIF HUSAINI BIN NORWAZA, at webiscopic.com@gmail.com. Requests and questions about your data go to one place, our single contact point: WEBISCOPIC SDN. BHD., by email to webiscopic.com@gmail.com, or by post to NO 110, JALAN LAPANGAN TERBANG, 31350 IPOH, PERAK, MALAYSIA. Where a request concerns data that we are responsible for together with a company or a network owner, we answer it or pass it to them, and we tell you which we did.

This part covers the requests you send on Legasiku, the price offers you receive and the jobs that follow.

(a) Who is responsible for your data. We, WEBISCOPIC SDN. BHD., the operator of Legasiku, and the company you send your request to are responsible for this data together, which the law calls being responsible "in common". The company's name is shown on the page where you send your request and on every offer and job. You deal with that company for the work; we run the place where you ask for it, and we do not supply the work.

(b) What we collect, and where it comes from. From you: what you write in a request (what you need, the district, your budget, and your answers to the questions the Classification asks), whether you buy for yourself or for a company (and the company's SSM number), who told you about the company if you say so, and the details you choose to share with the company when you accept its offer. Before you have an account, a draft you start is kept under a secret code held in a small file (a cookie) in your browser, for up to 90 days; the cookie is set only when you take a first step, never when you only look at a page. If you type your name on a company's card, we keep that name only, with the version of this notice you were shown, for 90 days. From the company: its price offers and any note it adds, who it names to do the work, and each change to the job. From you and the company: that the work was done, a cancellation, and a complaint about a job. We also keep the records that show what you agreed to and when.

(c) Whether you must give it. To send a request we need a description of the work, and before you give the work to a company we need a verified email address. Your name and phone number reach the company only if you choose to share them when you accept its offer.

(d) What we use it for. To show your request to the company, and to the other companies that match it where a request goes to more than one; to let companies send you price offers; to give the work to the company you choose and to record the job from start to finish; to keep the records the law makes us keep; to deal with complaints and disputes; and to keep Legasiku safe, for example by limiting how many requests one person can send and by detecting abuse.

(e) Rules that run by themselves. Some decisions are made by rules, without a person deciding each case: which companies match a request; the limit on how many requests one person can send in a period; the holding or refusing of a request that looks like abuse; and the refusal of a note or message that carries an email address, a phone number or a WhatsApp link where contact details may not be passed on. You can ask, through our single contact point, for a person to review a decision made by any of these rules.

(f) Sensitive information, and your separate consent. Some requests reveal sensitive information about you. They are requests about religion, for example estate planning under faraid, hibah or wasiat, and will-writing; about offences, for example criminal cases, investigations and detective work; about health, for example medical, dental and care services, and life and disability insurance; and about biometric data, for example face-matching security. Before you send such a request we ask for your explicit consent, in a step of its own, in the name of Legasiku and not through the company. The step names who will receive the information: the company you send the request to, Legasiku, and, where part of the work is sub-contracted, the registered companies named to you before they attend. If you do not agree, we do not send the request. You can withdraw your consent in writing at any time. The words you are asked to agree to are these, one for each of the four kinds. Religion. I agree that Legasiku and the company named on this page may use what I write in this request about my religion or religious practice, which is sensitive personal data, to deal with my request. Offences. I agree that Legasiku and the company named on this page may use what I write in this request about an offence or an investigation, which is sensitive personal data, to deal with my request. Health. I agree that Legasiku and the company named on this page may use what I write in this request about my health, which is sensitive personal data, to deal with my request. Biometric data. I agree that Legasiku and the company named on this page may use what I write in this request about my biometric data, which is sensitive personal data, to deal with my request.

(g) Your details are shared in a step of their own. When you give the work to a company, your name and contact details go to that company only after a separate step in which you agree. That agreement is its own record and is never part of accepting terms.

(h) Who receives it. The company you send the request to; the other companies that match it, who see the request without your name or contact details; the company you give the work to, which sees your name and contact details only after your separate agreement; the sub-contracting companies that may be given part of the work, as the part headed "Work passed to another company" says; the network owner and the member who introduced you, if you came through a network link, as the part headed "Networks and credit" says; your own organisation, where you act for it; our own staff who need it for their work; the service providers that run Legasiku for us and may only follow our instructions, which are the hosting of the server and its backups and the sending of email; and the authorities, where the law requires it.

(i) Whether your data goes outside Malaysia. Yes. Legasiku and its data are hosted by DigitalOcean, LLC, a company of the United States, on servers in Singapore. Our backups, a copy of uploaded files and our logs are encrypted on our own server before they are stored with DigitalOcean in Singapore. DigitalOcean uses other companies to provide its services; for all of its services it names Amazon Web Services (United States) for back-ups and other infrastructure, Cloudflare (United States) for platform security, and Traversal (United States) for troubleshooting and support. The emails Legasiku sends, with your email address and the words of the message, go through Mailgun Technologies, Inc., a company of the United States, on its servers in the European Union. Each of these receivers is bound by contract, directly with us or through DigitalOcean's contract with us, to protect your data to a standard at least equal to the Personal Data Protection Act 2010; that is the ground on which section 129 of the Act, as amended in 2024, allows us to send it outside Malaysia. We add a receiver to this notice before it receives your data.

(j) How long we keep it. We keep your data no longer than we need it for the purpose we collected it for, and records the law makes us keep for the period it sets, then delete them. We keep the records of a request, a price offer, a job and a complaint for 6 years, because the law makes us keep them as records of a sale; the record of your consent and of what you accepted for 7 years; a draft you did not send until its secret code expires, after up to 90 days; a name typed on a company's card for 90 days; and the file of a copy of your data for 7 days.

(k) Your choices and rights. You have the rights set out in the part headed "Your account with Legasiku": to see and have a copy of your data, to correct it, to withdraw a consent, to ask us to stop using it in a way that is likely to cause you damage or distress, to ask us to send it to another organisation, and to complain to the Personal Data Protection Commissioner Malaysia. We answer a request within 21 days. If you decline to give data that is required, we may not be able to send the request or keep the job that needs it. Because the company and we are responsible for this data together, we are your single contact point for it: send any request about it to us, and we answer it or pass it to the company, and tell you which we did.

(l) Who to contact. Our data protection officer is NUR ARIF HUSAINI BIN NORWAZA, at webiscopic.com@gmail.com. Requests and questions about your data go to one place, our single contact point: WEBISCOPIC SDN. BHD., by email to webiscopic.com@gmail.com, or by post to NO 110, JALAN LAPANGAN TERBANG, 31350 IPOH, PERAK, MALAYSIA. We pass on to the company whatever concerns it.

This part covers the checks we make, the complaints and reports we receive and the records that keep Legasiku safe.

(a) Who is responsible. We, WEBISCOPIC SDN. BHD., are responsible for these records. Where a record is about a company, such as a check we made on it, the company is a party to it, but we keep it for our own purposes.

(b) What we keep, and where it comes from. Records we make: what we checked about a company before it could sell (its registration, its email, its phone and its trade address), who checked it, the source and the result, kept as the company's supplier record, which for a sole trader or a partnership may include the owner's name and bank account; a record of what each person and company did on Legasiku (who, what and when, never the words or the amounts); records of sign-in attempts and other security events, kept as one-way codes; the list of what we have told to whom, as the law requires; and a register of every data breach. From you: a complaint, a report that something a company said is false, and your answers; if you report without signing in, the email address you leave. From a company: its answer to a complaint. We also keep integrity records, such as how many requests a person or a company has sent, and signals that suggest fraud.

(c) Whether you must give it. A complaint needs a description and a way to reach you; a report from a person who is not signed in needs an email address. Nothing else in this part comes from you.

(d) What we use it for. To check companies before they sell and again every year; to deal with complaints and reports; to keep Legasiku safe and to stop abuse and fraud; to tell the authorities and the people affected when there is a data breach; and to keep the records the law makes us keep.

(e) Rules that run by themselves. Limits on how many requests or other actions one person or one address can make in a period, and signals that suggest fraud, work without a person looking at each case. A request or action that a limit or a fraud signal holds or refuses is held or refused by that rule. You can ask, through our single contact point, for a person to review a decision made by any of these rules.

(f) Who receives it. The company a complaint is about, which sees what it needs to answer; the authorities, where the law requires it, including the Personal Data Protection Commissioner when there is a breach; our own staff who need it for their work; and the service providers that run Legasiku for us and may only follow our instructions, which are the hosting of the server and its backups and the sending of email.

(g) Whether your data goes outside Malaysia. Yes. Legasiku and its data are hosted by DigitalOcean, LLC, a company of the United States, on servers in Singapore. Our backups, a copy of uploaded files and our logs are encrypted on our own server before they are stored with DigitalOcean in Singapore. DigitalOcean uses other companies to provide its services; for all of its services it names Amazon Web Services (United States) for back-ups and other infrastructure, Cloudflare (United States) for platform security, and Traversal (United States) for troubleshooting and support. The emails Legasiku sends, with your email address and the words of the message, go through Mailgun Technologies, Inc., a company of the United States, on its servers in the European Union. Each of these receivers is bound by contract, directly with us or through DigitalOcean's contract with us, to protect your data to a standard at least equal to the Personal Data Protection Act 2010; that is the ground on which section 129 of the Act, as amended in 2024, allows us to send it outside Malaysia. We add a receiver to this notice before it receives your data.

(h) How long we keep it. We keep these records no longer than we need them, and for the period the law sets, then delete them: complaint and report records for 6 years; the supplier record and the checks, which are records of account, for 7 years; the record of what each person and company did for 6 years; the list of what we have told to whom for 7 years; and security records and the register of data breaches for at least 2 years.

(i) Your choices and rights. You have the rights set out in the part headed "Your account with Legasiku": to see and have a copy of your data, to correct it, to withdraw a consent, to ask us to stop using it in a way that is likely to cause you damage or distress, to ask us to send it to another organisation, and to complain to the Personal Data Protection Commissioner Malaysia. We answer a request within 21 days. If you decline to give data that is required, we may not be able to deal with the complaint or report that needs it.

(j) Who to contact. Our data protection officer is NUR ARIF HUSAINI BIN NORWAZA, at webiscopic.com@gmail.com. Requests and questions about your data go to one place, our single contact point: WEBISCOPIC SDN. BHD., by email to webiscopic.com@gmail.com, or by post to NO 110, JALAN LAPANGAN TERBANG, 31350 IPOH, PERAK, MALAYSIA. We pass on to the company whatever concerns it.

This part covers referral networks on Legasiku, the credit a member earns and the links members share.

(a) Who is responsible for your data. The company that runs a network (the network owner, whose name is shown on the network's page) and we, WEBISCOPIC SDN. BHD., are responsible for this data together, "in common". Legasiku does not run or fund any network. A separate member notice says who sees you in a network.

(b) What we collect, and where it comes from. From you when you join a network: the name you choose to show (an alias), who invited you, when you joined or left, whether you are in a regulated profession if you tell us, and your agreement about who sees you, with the version of the member notice you agreed under. When you follow a member's link and take a first step, we record the link, the network, the member and the time, tied to your account or to the secret code in your browser, so that credit goes to the right member. When a customer you introduced confirms that a job is done, we write a recognition credit for you: it is a record, with no cash value. When a customer sends a request and keeps the "Referred by" line, we record that link against that request.

(c) Whether you must give it. Joining a network is free and your choice. To join we need your alias. Your agreement about who sees you can be withdrawn in writing at any time; after that, others see "a member" instead of your name. Using Legasiku does not depend on joining a network.

(d) What we use it for. To run the network (the network owner's purpose); to decide which member, if any, introduced a customer and to write the credit (the purpose of the network owner and of ours); to stop the same customer being credited in two networks and to count links that were removed; and to detect fraud.

(e) A small file, and rules. The secret code that links your first step to your later request is held in a cookie in your browser, set only after you take a first step, for up to 90 days. Rules, not people, decide whether a link counts and which member is credited, and signals that suggest fraud work without a person looking at each case. You can ask, through our single contact point, for a person to review a decision made by any of these rules.

(f) Your agreement is its own step. Your agreement about who sees you in a network is a step of its own and its own record, and is never part of accepting terms.

(g) Who receives it. The member who invited you, who sees the name you chose and when you joined or left; the members you invite, who see the name you chose; the network owner, who sees the name you chose, when you joined or left, who invited you, and the customers you introduced to its companies; our own staff who need it for their work; the service providers that run Legasiku for us and may only follow our instructions, which are the hosting of the server and its backups and the sending of email; and the authorities, where the law requires it. Nobody else sees you in a network.

(h) Whether your data goes outside Malaysia. Yes. Legasiku and its data are hosted by DigitalOcean, LLC, a company of the United States, on servers in Singapore. Our backups, a copy of uploaded files and our logs are encrypted on our own server before they are stored with DigitalOcean in Singapore. DigitalOcean uses other companies to provide its services; for all of its services it names Amazon Web Services (United States) for back-ups and other infrastructure, Cloudflare (United States) for platform security, and Traversal (United States) for troubleshooting and support. The emails Legasiku sends, with your email address and the words of the message, go through Mailgun Technologies, Inc., a company of the United States, on its servers in the European Union. Each of these receivers is bound by contract, directly with us or through DigitalOcean's contract with us, to protect your data to a standard at least equal to the Personal Data Protection Act 2010; that is the ground on which section 129 of the Act, as amended in 2024, allows us to send it outside Malaysia. We add a receiver to this notice before it receives your data.

(i) How long we keep it. Network records, credits and links are kept for as long as the network exists, because a network must be able to be rebuilt from them; no end date is set for them today. Before any end date applies, we will tell the members. The record of your agreement about who sees you is kept for 7 years, then deleted.

(j) Your choices and rights. You have the rights set out in the part headed "Your account with Legasiku": to see and have a copy of your data, to correct it, to withdraw a consent, to ask us to stop using it in a way that is likely to cause you damage or distress, to ask us to send it to another organisation, and to complain to the Personal Data Protection Commissioner Malaysia. We answer a request within 21 days. Because the network owner and we are responsible for this data together, we are your single contact point for it: send any request about it to us, and we answer it or pass it to the network owner, and tell you which we did.

(k) Who to contact. Our data protection officer is NUR ARIF HUSAINI BIN NORWAZA, at webiscopic.com@gmail.com. Requests and questions about your data go to one place, our single contact point: WEBISCOPIC SDN. BHD., by email to webiscopic.com@gmail.com, or by post to NO 110, JALAN LAPANGAN TERBANG, 31350 IPOH, PERAK, MALAYSIA. We pass on to the network owner whatever concerns it.

This part covers the records a company keeps on Legasiku for its own back office.

(a) Who is responsible for the data. For the records a company keeps for its own back office, the company is responsible, not we (WEBISCOPIC SDN. BHD.). We only handle them for the company, under our Processing Terms, and follow the company's instructions. The company's own notice to its staff and customers applies to them.

(b) What this covers, and where it comes from. The role names a company makes and which roles each of its staff holds, and other back-office records that none of our own processes reads. The company puts them in; we do not collect them from you. We do not use them for our own purposes.

(c) What we use it for. Only to run the company's workspace on Legasiku as the company instructs.

(d) Who receives it. Whoever the company lets see it, and the service providers that run Legasiku for us and may only follow our instructions, which are the hosting of the server and its backups and the sending of email.

(e) Whether your data goes outside Malaysia. Yes. Legasiku and its data are hosted by DigitalOcean, LLC, a company of the United States, on servers in Singapore. Our backups, a copy of uploaded files and our logs are encrypted on our own server before they are stored with DigitalOcean in Singapore. DigitalOcean uses other companies to provide its services; for all of its services it names Amazon Web Services (United States) for back-ups and other infrastructure, Cloudflare (United States) for platform security, and Traversal (United States) for troubleshooting and support. The emails Legasiku sends, with your email address and the words of the message, go through Mailgun Technologies, Inc., a company of the United States, on its servers in the European Union. Each of these receivers is bound by contract, directly with us or through DigitalOcean's contract with us, to protect your data to a standard at least equal to the Personal Data Protection Act 2010; that is the ground on which section 129 of the Act, as amended in 2024, allows us to send it outside Malaysia. We add a receiver to this notice before it receives your data.

(f) How long we keep it. When a company stops using Legasiku it has 30 days to export its records; we then delete them within 30 days after that, and we keep a record of what was deleted. Data we handle for a company that has been inactive for 24 months is disposed of, unless the company tells us in writing that it is still needed or the law requires us to keep it.

(g) Your choices and rights. A request about these records goes to the company, which is responsible for them. If you send it to us, we pass it to the company within 7 days, so that the company can answer within 21 days, and we tell you that we have passed it on.

(h) Who to contact. Our data protection officer is NUR ARIF HUSAINI BIN NORWAZA, at webiscopic.com@gmail.com. Requests and questions about your data go to one place, our single contact point: WEBISCOPIC SDN. BHD., by email to webiscopic.com@gmail.com, or by post to NO 110, JALAN LAPANGAN TERBANG, 31350 IPOH, PERAK, MALAYSIA. We pass on to the company whatever concerns it.

This part covers companies that may do part of a job you give to a company on Legasiku.

(a) Who is responsible for your data. The company you give a job to and we, WEBISCOPIC SDN. BHD., are responsible together, "in common", for what this part describes. The company's name is shown on every offer and job.

(b) What this is about. A sub-contracting company is a company that the company you gave your job to engages to do part of that job for you. This part applies to every job on Legasiku, whether or not the company does this, and it is in the first notice you see on every job. Today no job on Legasiku can be passed in part to another company; this part says what applies when that changes. If a company gives none of the work to another company, none of your data goes to another company under this part. What a sub-contracting company receives is only what it needs for its part of the work: a description of that part, the district and the price. A company that has to attend gets the street address and a way to reach you that Legasiku passes on, never your phone number or email address itself. Every other company gets a description of its part and nothing that identifies you.

(c) Whether you must give it. Nothing in this part is collected from you for it; it is part of the data of your job, which the part headed "Requests, price offers and jobs" describes. If you do not want part of your job given to another company, tell the company before you give it the work.

(d) What we use it for. So that the company can give part of the work to another registered company, and so that you are told who does it before they attend; so that we can keep the record of who received what; and so that we can deal with complaints about the job.

(e) Who receives it. This kind of receiver: registered Malaysian companies sub-contracted to perform part of your job, each named to you before it attends, and listed on your job page. Besides them: our own staff who need it for their work; the service providers that run Legasiku for us and may only follow our instructions, which are the hosting of the server and its backups and the sending of email; and the authorities, where the law requires it.

(f) Whether your data goes outside Malaysia. Yes. Legasiku and its data are hosted by DigitalOcean, LLC, a company of the United States, on servers in Singapore. Our backups, a copy of uploaded files and our logs are encrypted on our own server before they are stored with DigitalOcean in Singapore. DigitalOcean uses other companies to provide its services; for all of its services it names Amazon Web Services (United States) for back-ups and other infrastructure, Cloudflare (United States) for platform security, and Traversal (United States) for troubleshooting and support. The emails Legasiku sends, with your email address and the words of the message, go through Mailgun Technologies, Inc., a company of the United States, on its servers in the European Union. Each of these receivers is bound by contract, directly with us or through DigitalOcean's contract with us, to protect your data to a standard at least equal to the Personal Data Protection Act 2010; that is the ground on which section 129 of the Act, as amended in 2024, allows us to send it outside Malaysia. We add a receiver to this notice before it receives your data.

(g) How long we keep it. We keep the records of who received which part of a job for 6 years with the record of the job, then delete them.

(h) Your choices and rights. You have the rights set out in the part headed "Your account with Legasiku": to see and have a copy of your data, to correct it, to withdraw a consent, to ask us to stop using it in a way that is likely to cause you damage or distress, to ask us to send it to another organisation, and to complain to the Personal Data Protection Commissioner Malaysia. We answer a request within 21 days. Because the company you gave the job to and we are responsible for this data together, we are your single contact point for it: send any request about it to us, and we answer it or pass it to the company, and tell you which we did.

(i) Who to contact. Our data protection officer is NUR ARIF HUSAINI BIN NORWAZA, at webiscopic.com@gmail.com. Requests and questions about your data go to one place, our single contact point: WEBISCOPIC SDN. BHD., by email to webiscopic.com@gmail.com, or by post to NO 110, JALAN LAPANGAN TERBANG, 31350 IPOH, PERAK, MALAYSIA. We pass on to the company whatever concerns it.