Personal Data Protection Notice (Malaysia PDPA 2010)

1. Scope

This Personal Data Protection Notice explains how MumuWorks handles personal data in accordance with the Personal Data Protection Act 2010 of Malaysia, or PDPA. It applies to personal data collected from customers, prospects, users, business contacts, support requestors, and other individuals whose information is processed in connection with MumuWorks services.

2. Personal data collected

Depending on the service interaction, MumuWorks may collect and process personal data such as:

• Name, work email address, phone number, job title, and other account or contact details.
• Company information, tenant identifiers, onboarding details, and billing contacts.
• Billing information, subscription records, payment references, and invoice details.
• WhatsApp-related data, conversation metadata, connected account identifiers, and customer messages processed through authorized integrations.
• Support requests, product feedback, security reports, and related communications.

3. Purpose of collection

MumuWorks collects and uses personal data for legitimate business and service-delivery purposes, including:

• Account management, tenant setup, and user authentication.
• Service delivery, AI workflow execution, knowledge-base handling, and channel integrations.
• Customer support, onboarding, troubleshooting, and product communications.
• Security monitoring, audit review, fraud prevention, and service integrity protection.
• Billing, subscription administration, financial recordkeeping, and product improvements.

4. Disclosure of personal data

MumuWorks may disclose personal data to service providers, cloud and storage providers, AI and messaging providers, payment providers, professional advisers, and regulatory or enforcement authorities where disclosure is necessary to operate the service, protect legitimate interests, or comply with law.

Where third-party providers are used, MumuWorks expects them to handle personal data only for authorized operational purposes and with appropriate security and confidentiality controls.

5. Rights under PDPA

Subject to the PDPA and applicable exceptions, individuals may request access to personal data, ask for correction of inaccurate or incomplete records, and withdraw consent for processing where consent is the basis relied upon. Withdrawal of consent may affect MumuWorks' ability to continue providing some services or features.

6. Data protection measures

MumuWorks maintains reasonable technical and organizational safeguards designed to protect personal data, including encryption in transit where supported, access controls, operational monitoring, logging, and internal handling procedures appropriate to the sensitivity and use of the data.

7. Contact information

Questions, access requests, correction requests, or consent withdrawal requests may be directed to [email protected].