Processing Terms

1. Who these terms are between. These Processing Terms are between WEBISCOPIC SDN. BHD., Registration No. 202301024302 (1518225-U), whose registered address is NO 110, JALAN LAPANGAN TERBANG, 31350 IPOH, PERAK, MALAYSIA, the operator of Legasiku, called "we", and the company that accepts them, called "your company". They cover the personal data that Legasiku processes for your company, or together with it. They are a separate document from the Company Terms. The person who signs for your company accepts both in one step, and each document is recorded as accepted on its own, with that person's name, the capacity in which they sign and the version accepted. If these terms and the Company Terms differ on how personal data is processed, these terms apply.

2. Words used. "Personal data", "processing", "data controller", "data processor", "data subject" and "personal data breach" have the meanings that the Personal Data Protection Act 2010, as amended by the Personal Data Protection (Amendment) Act 2024 (the "Act"), gives them. In short: a data controller decides why and how personal data is processed; a data processor processes it for a data controller and not for its own purposes; a data subject is the person the data is about; and a personal data breach (a "breach") is any breach, loss or misuse of personal data, or unauthorised access to it. "The Commissioner" is the Personal Data Protection Commissioner. "The Standard" is the Personal Data Protection Standard 2015. A "receiver" is anyone outside us that can receive personal data from Legasiku; clause 7 lists them. An "add-on" is a separate part of Legasiku, built or run by someone other than us, that your company chooses to install. "In writing" includes email.

3. The three roles. Every kind of record on Legasiku has exactly one of these three roles, and our records catalogue states the role of each. (a) Our own records. We alone are the data controller of our own records: the catalogue of categories and districts, our rules, the legal texts and who accepted them, our registers, the checks we make on companies, the limits and fraud signals that keep Legasiku safe, the matching rules and the Chapter's own records. We do not share control of them with any company. (b) Records in common. We and your company are data controllers in common of the records the marketplace creates between a customer and your company: requests, price offers, the giving of the work, the job and its changes, completion, cancellation, complaints and reports of mistakes, the details a customer agrees to share with your company, your company's pages and offers, and the membership of your staff in your company. Where your company runs or joins a referral network, the network's records are held in common by us and the network owner, as the network's member agreement says. (c) Records we hold for you. We are your company's data processor only for its back-office records that no process of ours reads for our own purposes: today, the roles your company names and which of its staff holds each role. We never read them for our own purposes. We give your company the current list of kinds of record, each with its role, when it asks. For the records in (a) and (b) we decide our own purposes, and we tell people about them in our privacy notice. Clauses 6 to 12, 17 and 18 apply to every kind of record, because they describe how Legasiku runs. Clauses 4, 15 and 16 apply to the records in (c). Clauses 13 and 14 apply to the records in (b) and (c).

4. What we do as your processor. For the records in clause 3(c) we: (a) process them only to provide Legasiku to your company, on your company's instructions, which are these terms and your company's use of Legasiku's features; (b) do not use them for our own purposes, and do not sell, rent or disclose them except as these terms say or the law requires; where the law requires a disclosure, we tell your company first unless the law forbids it; (c) keep them confidential, and let only our people who need them for their work reach them, each bound to keep them confidential; (d) tell your company without delay if we believe that an instruction of yours would break the Act; (e) keep to the Security Principle of the Act, which binds us directly as a data processor, and to the Standard, as clause 6 says; (f) return them to your company and delete them as clause 15 says.

5. Only your company decides. Only your company decides how its data is processed, and it does so through the person who signs for it or the staff it gives that permission. These acts are done in your company's own workspace and are recorded with the name of the person who did them: accepting these terms; installing an add-on, when add-ons are offered; and giving staff their roles. A person who acts for another company, even one owned in common with yours, can reach your company's records only as a member of your company's own staff, after an invitation your company sends, shown in your company's records, and your company can end that access at any time. When anyone acting for another company tries to do one of these acts for your company, or to export your company's records, Legasiku refuses and records the refusal. Nothing is exported from your company's workspace to another company.

6. Security. We protect personal data with the technical and organisational measures that the Security Principle of the Act and the Standard require, for electronic processing, non-electronic processing, retention and data integrity. We keep a control map that sets out, for each numbered item of the Standard, the evidence that the control is in place, or shows the item as a gap with its reason. Annex A (clause 23) explains it. We give your company the current control map, with every gap, when it asks. We do not store your company's personal data on removable media, such as a USB drive or a portable disk, without the written approval of our top management. Every copy of records that leaves our server for backup is encrypted on our server first, with a key that we hold and our hosting provider does not.

7. Receiver schedule. These are the receivers Legasiku uses today, and what each can receive. Clause 9 says how each is assessed and bound. R1. DigitalOcean, LLC (United States): the server that runs Legasiku, in Singapore (region sgp1). It can receive every kind of record Legasiku holds, because the database, the uploaded files and the logs are on it. R2. DigitalOcean, LLC (United States): Spaces storage in Singapore (region sgp1), for backups and logs. It receives only copies that we have encrypted on our server first: database backups, a copy of uploaded files, and logs. DigitalOcean does not hold the key. R3. Amazon Web Services (United States): named by DigitalOcean as a sub-processor for all of its services, for back-ups and other infrastructure services. DigitalOcean has not told us which of our data, if any, it can reach. We do not use DigitalOcean's own server back-ups or snapshots, and what we store in Spaces is encrypted as R2 says. R4. Cloudflare (United States): named by DigitalOcean as a sub-processor for all of its services, for platform security. DigitalOcean has not told us which of our data, if any, it can reach. R5. Traversal (United States): named by DigitalOcean as a sub-processor for all of its services, for troubleshooting and support. DigitalOcean has not told us which of our data, if any, it can reach. R6. DigitalOcean's other listed sub-processors. DigitalOcean lists others for services that Legasiku does not use, and none of those receives our data. Three are listed for storage services (Oracle, VAST and Wasabi), and DigitalOcean has not yet told us whether its Spaces storage uses them; anything we store in Spaces is encrypted as R2 says. If one of them can receive our data, it gets a row of its own. R7. Mailgun Technologies, Inc. (United States): the sending of email, on its servers in the European Union. Every email Legasiku sends passes through it. It receives the email address of each person we write to and the words of the message, which may include a person's name, your company's name and details of a request or a job. It receives no other records. R8, R9 and R10 are kept for an SMS provider, the hosts of add-ons and an accounting system. Legasiku uses none of them today: no SMS code is sent, no add-on is run by a host, and no accounting system receives our records. None of them receives any data. If one is ever used, its row is added under clause 8 before it receives anything. R11. GitHub, Inc. (United States): the container registry ghcr.io, from which our server takes the Legasiku software. It receives none of your company's records and no personal data; it sees only our server's network address. R12. The Have I Been Pwned password range service (api.pwnedpasswords.com): when someone sets a password on Legasiku, our server sends it the first five characters of a one-way code (a SHA-1 hash) of the password, so that a password known to have leaked can be refused. Nothing else is sent. Those five characters are not personal data: they cannot identify anyone or be turned back into the password. R13. Google LLC (United States): Google sign-in ("Continue with Google"), used only when a person chooses it. Google learns that the person is signing in to Legasiku, and sends us Google's identifier for the person's account and their email address. It receives none of your company's records. A new receiver takes the next number, and a number is never reused.

8. Changes to receivers. We keep clause 7 up to date. We tell your company in writing at least 30 days before a new receiver can receive your company's personal data, or before a receiver starts to receive a kind of it that it did not receive before. When our hosting provider tells us of a change in its own sub-processors, which it does 30 days ahead, we pass that notice to your company without delay. Your company may object in writing within the notice period, giving its reasons. If we cannot meet the objection, your company may stop using Legasiku and take its records under clause 15. A new receiver is assessed under clause 9 before it receives your company's records, and your company adopts that assessment under clause 10. An add-on built or run by someone other than us is not our sub-processor: its operator is your company's own data processor under a direct contract, which your company accepts when it installs the add-on. We do not pass your company's records to that operator.

9. Hosting outside Malaysia. Legasiku runs on servers in Singapore, and some receivers are elsewhere (clause 7), so using Legasiku transfers personal data out of Malaysia. Section 129 of the Act governs that transfer, and the Commissioner's guideline on cross-border personal data transfer says how it is done. We say in our privacy notice that the data goes outside Malaysia. For every receiver that can receive your company's personal data: (a) We assess the receiver under that guideline, and find that the protection there is at least equal to the protection the Act gives, before it receives your company's records. Each assessment lasts at most 3 years, and we do it again sooner if something significant changes. We never rely on a transfer being necessary for a contract, or on consent alone. (b) We keep your company's records only with receivers whose assessment is complete and in date. If an assessment of our hosting provider cannot be completed with evidence, we do not keep your company's records with it: we run Legasiku for your company from a host in Malaysia instead or, if we cannot, we tell your company, and it may take its records and leave under clause 15. (c) The receiver is bound by a contract, made with us or through our hosting provider's contract with us, that governs how it processes the data, including the security measures that give protection at least equal to the protection the Act gives. (d) We guarantee that the personal data we transfer for your company is processed in line with the Act. (e) We take all reasonable precautions to make sure that each receiver keeps to the terms that bind it. If we find that a receiver has broken them, we stop transferring personal data to it until it puts the breach right, and we tell your company without delay. (f) For each receiver we keep a record of its name, its company registration number if it has one, the contact of its data protection officer or other contact person, the country the data goes to, the kinds of personal data transferred and the purpose. We give your company that record under clause 10.

10. Your company adopts each assessment. (a) Before your company accepts these terms, we give it the assessment of each receiver that can receive its records (clause 9), with the evidence each assessment rests on. (b) Your company adopts each assessment in full, as its own finding, and consents to its data being stored in the cloud and transferred under clause 9, in a written statement made for your company by an officer whom its top management has authorised. We record the officer's name, position and the date. (c) We give your company its receiver record (clause 9(f)) and a record of its consent to cloud storage and transfer. (d) We do not ask your company to accept these terms, and it cannot start using Legasiku, until we have that statement. (e) Before a new receiver receives your company's records, and whenever an assessment is renewed, your company adopts the new assessment in the same way. If an assessment expires before your company has adopted the renewed one, we pause your company's new transactions on Legasiku until it does. Records already on Legasiku stay protected as these terms say.

11. Breach notice times. (a) If we become aware of a suspected breach that affects your company's personal data, in records we hold for it or in records in common, we do not wait until it is confirmed. Within 1 hour of our becoming aware, we record it in our breach register and tell your company, by email to the person who signs for it, that its data may be affected, before we have finished finding out what happened. (b) We require every add-on, whoever runs it, to tell us within 12 hours of becoming aware of a suspected incident, not after confirming it. This is a condition of installing any add-on. (c) We then give your company, as soon as we can and well within 72 hours of our becoming aware, a draft of its notice to the Commissioner, filled in from our register as far as we know, and all reasonable and necessary help to complete and file it. (d) The Act requires notice to the Commissioner as soon as practicable, and the Commissioner's guideline sets 72 hours. We count those 72 hours from the moment we first became aware of the suspected breach, not from when it was confirmed, and we work to that time. For records where your company is the data controller, the guideline counts your company's 72 hours from when we tell it, or from when it has clear evidence of the breach itself, if that is earlier. (e) Our register records when each step became aware and when it acted. If a notice is late, we give your company the reasons and the evidence from those records, for the Commissioner. (f) If the breach happens at one of our receivers, our awareness, and so every time in this clause, starts when that receiver tells us. Our hosting provider has promised only to tell us "without undue delay", and we cannot shorten that step. (g) Whether the people affected must be told depends only on whether the breach causes, or is likely to cause, them significant harm. Where it does, they are told without unnecessary delay and within 7 days after the notice to the Commissioner. For records where your company is the data controller, your company tells them, and we give it the facts and the help it needs.

12. Breach register and closing an incident. (a) For every breach we record, we prepare a draft notice to the Commissioner for each data controller affected, whether or not the people affected must be told. (b) We file the notice for every record where we are the data controller. For a record where your company is the data controller, our incident stays open until we record either the reference of the notice your company filed or your company's recorded reason for not filing one. (c) Our breach register can only be added to. Nothing in it is changed, and a mistake is corrected by a new entry beside the first. We keep each entry for at least 2 years from the date of the breach, including breaches that were not notified. (d) We keep the register in electronic and in physical form, as the Commissioner requires, and we give it to the Commissioner when directed. (e) Each draft notice has a place to name any other authority told of the same breach.

13. Help with your data protection impact assessment. When your company carries out an assessment of the effect of its processing on data protection, and Legasiku is part of that processing, we give it all reasonable and necessary help. We tell your company what we do with the data, how and where, and who receives it, and we give it the parts of our own assessments, including the receiver assessments in clause 9, that concern its records. Your company asks at the contact point in clause 22.

14. Help with requests from people. (a) If a person asks your company to see or correct their personal data, to stop its use, to withdraw their consent, or to have their data sent to another organisation, and the data is in records Legasiku holds for your company or in common with it, we give your company the help it needs within 7 days of its asking, so that it can answer within the 21 days the Act allows. (b) If a person writes to us about records we hold for your company (clause 3(c)), we pass the request to your company without delay and within 7 days, tell the person that we have done so, and do not answer it ourselves unless your company tells us to. (c) For records in common (clause 3(b)), we answer for our own part, and we tell your company within 7 days of any request that concerns its part. (d) Requests reach us at the single contact point in clause 22.

15. Export window, then deletion, with a disposal record. (a) While your company uses Legasiku, and for 30 days after its use ends, your company may ask for an export of its records. The 30 days start on the day your company's access ends, or on the day we tell it in writing that its access has ended, whichever is later. Its use ends when it leaves Legasiku or when its access is ended under the Company Terms. (b) The export holds every record that your company's own workspace can read on Legasiku, including its advertisement versions and transaction records, in a file a computer can read. Passwords and other secrets are left out. We give it to the person who signs for your company, by a safe route, within 30 days of the request, and we delete our copy of the file within 7 days after your company has received it. (c) We do not delete the records we hold for your company (clause 3(c)) before we have given it an export it asked for within the 30 days. After the 30 days, or after that export if it comes later, we delete those records within 30 days. (d) We write a disposal record of what was deleted, when and how. We keep it, give it to your company when it asks, and give it to the Commissioner when directed. (e) Records in common and our own records are not deleted under this clause: each is kept for its own period under clause 17 and then deleted.

16. Disposal schedule for inactive data. We keep a disposal schedule for the records we hold for your company (clause 3(c)) that are inactive. A record is inactive when it has not been created, changed or used in your company's workspace for 24 months, such as a role that no current member of your company's staff holds. When a record has been inactive for 24 months, it goes on the schedule. We tell your company at least 30 days before we dispose of it, and we dispose of it unless your company tells us in writing that it is still needed or the law requires us to keep it. We record each disposal in the disposal record (clause 15(d)), and we keep the schedule up to date.

17. Records that keep their own period. Some records stay after clauses 15 and 16, each only for as long as its own reason lasts, and each is used for no other purpose while it is kept: (a) these terms, the Company Terms and the record of who accepted each version, and when: 7 years after these terms end between us; (b) the records the law requires about suppliers, their advertisements and their transactions, such as advertisement versions, price offers and jobs: 6 years after each closes; (c) records of account, such as order forms, invoices and payments: 7 years; (d) the breach register: at least 2 years from the date of each breach (clause 12); (e) anything under a legal hold, for as long as the hold lasts: a legal hold pauses every deletion. We record the reason for each period. When a period ends, the record is deleted, unless the law requires us to keep it longer.

18. Information and checks. (a) We give your company the information it reasonably needs to show that we keep to these terms, including the receiver schedule, the assessments and receiver records in clauses 9 and 10, the control map and our disposal records. (b) Once a year, and at any time after a breach that affects your company's data, your company may send us written questions about how we process its data, and we answer them in writing within 30 days. (c) Where a receiver publishes independent audit reports or certifications, we tell your company where to find them, or give them to it where the receiver's terms allow. (d) We cooperate with any inspection or direction of the Commissioner.

19. Our liability under these terms. Our liability for breaking these terms, or for a failure of security, is limited by the separate, higher limit that clause 11(b) of the Company Terms sets for that purpose, not by the general limit. Nothing in these terms limits or excludes any liability that the law does not allow to be limited or excluded, or any duty the Act places on us directly.

20. Changes to these terms. (a) A change to these terms is a new version, never an edit of the version your company accepted. We keep every version, and the version your company accepted stays readable on Legasiku. (b) We publish each new version on Legasiku with its number and the day it takes effect, and we send it by email to the person who signs for your company at least 30 days before that day. (c) A change is material if it reduces your company's rights or the protection of personal data, or adds to your company's duties. A material change binds your company only once the person who signs for it accepts the new version. Until then, the version your company accepted keeps applying to it, and your company may instead stop using Legasiku and take its records under clause 15. (d) A change that is not material, such as a correction of wording, a new contact detail or added protection, takes effect on its day without a new acceptance. (e) A change to the receivers follows clause 8, not this clause.

21. Law and courts. These terms are governed by the laws of Malaysia. The courts of Malaysia may hear a dispute about them, including the High Court in Sabah and Sarawak where your company's registered office is in Sabah or Sarawak. Nothing in these terms takes away a right or remedy that the law gives your company or a data subject, or any power of the Commissioner.

22. Contact and language. The single contact point for requests and notices under these terms is WEBISCOPIC SDN. BHD., by email to webiscopic.com@gmail.com, or by post to NO 110, JALAN LAPANGAN TERBANG, 31350 IPOH, PERAK, MALAYSIA. Our data protection officer, for our role as a data controller and our role as your company's data processor, is NUR ARIF HUSAINI BIN NORWAZA, at webiscopic.com@gmail.com. We send notices under these terms to the email address of the person who signs for your company, and your company keeps that address current. These terms are published in English and Bahasa Melayu. Both texts carry equal weight; if they differ, the meaning that gives personal data more protection applies.

23. Annex A. Security controls and the control map. A1. The control map is a file in our records with one entry for each numbered item of the Standard, in its four parts: the security of electronic processing, the security of non-electronic processing, retention, and data integrity. A2. Each entry is named by its part and its item: PDPS-4-01 to PDPS-4-14 for the security of electronic processing, PDPS-5-01 to PDPS-5-09 for the security of non-electronic processing, PDPS-6-01 to PDPS-6-07 for retention, and PDPS-7-01 to PDPS-7-04 for data integrity. A3. Each entry either names one piece of evidence we keep that proves the whole item, such as a test, a runbook or a deployment check, or shows the item as partly proved or as a gap, with the reason and what would close it. A4. A gap, or the part of an entry that is not proved, is never described as met. A5. We give your company the current control map when it asks, and the Commissioner when directed.