Privacy Policy

Last Updated: June 3, 2026

This
Privacy Policy describes our policies and procedures on the collection, use, and disclosure of your information
when you use our website and services. We comply with the Malaysian Personal Data Protection Act 2010 (PDPA) as
well as applicable international privacy standards. By using the Service, you agree to this policy.

1. Definitions & Legal Basis

Company (“We”, “Us”, “Our”) refers to Edocpos Sdn.Bhd (Registration Number: 202101017564), Lot
1 & 2, 1st Floor, Block P, One Avenue, 9, Bandar Utama, 90000 Sandakan, Sabah, Malaysia.
Service refers to our website and all related functionalities.
You means the user or visitor.

The legal bases for processing your personal data include:

• Your explicit consent (e.g., receiving marketing communications);
• Performance of a contract with you (e.g., processing orders);
• Our legitimate interests (e.g., improving services, preventing fraud);
• Compliance with legal obligations (e.g., tax records).

2. What Personal Data We Collect

2.1 Information You Provide

• Name, email address, phone number, mailing address;
• Account login information (username, encrypted password);
• Any information you submit via contact forms, customer service, or orders.

2.2 Automatically Collected Information (Usage Data)

• IP address, browser type, operating system, access time, referring pages;
• Device information (mobile device model, unique device identifiers);
• Browsing behavior (clicks, dwell time, scroll depth).

3. How We Use Your Personal Data

• Provide, maintain, and improve our Service;
• Process your orders, payments, and deliveries;
• Send order status, security notifications, and service updates;
• Respond to your inquiries and customer support requests;
• Analyze usage trends to optimize user experience;
• (Only with your consent) Send you promotions, offers, and newsletters;
• Detect and prevent fraud, abuse, or illegal activities.

4. Cookies and Similar Tracking Technologies

We use cookies to enhance your experience. When you first visit, you will see a cookie consent popup where you can
accept or reject non-essential cookies.

• Essential Cookies: Cannot be disabled. Used for login, shopping cart, security.
• Functional Cookies: Remember your preferences (language, region).
• Analytics/Performance Cookies: Help us understand visitor behavior (e.g., Google
  Analytics).
• Advertising Cookies: Used to display relevant advertisements only with your consent.

You may withdraw your consent at any time through your browser settings or the “Cookie Preferences” link in our
website footer.

5. How We Share Your Personal Data

We share your data only when necessary in the following circumstances:

• Service Providers: Payment processors, logistics companies, cloud storage services (all
  bound by confidentiality agreements);
• Legal Requirements: In response to courts, law enforcement, or regulatory authorities;
• Business Transfers: If the Company is acquired, merged, or reorganized, your data will be
  transferred to the new entity;
• With Your Explicit Consent: For other purposes you authorize separately.

We do not sell your personal data.

6. Data Retention Period

• Account Information: For as long as your account exists and up to 7 years after closure (to comply with tax
  and legal requirements);
• Order Records: 7 years;
• Customer Service Communications: 3 years;
• Usage Data (anonymized): Up to 26 months;
• Marketing Consent Records: Until you withdraw your consent.

7. Your Privacy Rights

Depending on your location (Malaysia, EU, or California), you may have some or all of the following rights:

• Right to Access: Obtain a copy of your personal data we hold;
• Right to Rectification: Correct inaccurate or incomplete data;
• Right to Erasure (“Right to be Forgotten”): Request deletion of your data when no legal
  retention obligation exists;
• Right to Restriction of Processing: Suspend processing of your data in certain
  circumstances;
• Right to Data Portability: Receive your data in a structured, commonly used format;
• Right to Withdraw Consent: Withdraw consent for marketing or non-essential cookies at any
  time;
• Right to Object: Object to automated processing based on legitimate interests.

To exercise your rights, please submit a request through the contact information below. We will respond within 30
days. We may charge a reasonable fee or refuse requests that are manifestly unfounded or excessive.

8. Cross-Border Data Transfer

Our servers are located in Malaysia. When you use our Service, your data may be transferred to and stored within
Malaysia. If we use service providers located outside Malaysia (e.g., cloud services in the US or Singapore), we
will ensure that:

• The country has received an adequacy decision from the EU/Malaysia; or
• We sign Standard Contractual Clauses (SCCs); or
• We obtain your explicit consent (for non-essential transfers).

You may contact us to request a copy of these cross-border transfer safeguard measures.

9. Account Deletion Policy and Request Process

1. How to Request Account Deletion:

To ensure the security of corporate data, employees cannot permanently delete their accounts directly from the mobile application. If you wish to delete your Arkcloudant account and associated personal data, you must follow either of these steps:

• Contact your direct supervisor or your company’s upper management to initiate the request.
• Reach out directly to your company’s Human Resources (HR) department, as they hold the sole authorization and administrative access to execute account deletions from the system.
• For further technical assistance regarding this process, you or your HR department may contact our support team at developer@arkcloudant.com.

2. Data Retention and Recovery Period:
Upon receiving authorization from your company’s HR department, your account will be deactivated and removed from the active system. However, to prevent accidental loss of employment records and to ensure data recovery options remain available for compliance purposes, your data will not be deleted permanently right away.

Arkcloudant enforces a mandatory data retention period of at least three (3) months (90 days) from the date of deactivation. During this window, the data can be recovered upon official request by your employer. Once this 3-month period expires, all associated data will be permanently and irreversibly purged from our servers

10. Children’s Privacy

Our Service is generally intended for users aged 18 and above. If you are under 18, you must use the Service with
the consent of a parent or guardian. We do not knowingly collect personal data from children under 13. If we become
aware of such collection, we will delete it immediately.

11. Data Security

We implement TLS 1.3 encryption, regular security scans, access controls, and employee training. However, no
transmission over the Internet is 100% secure, and you are also responsible for protecting your own login
credentials.

12. External Links

Our Service may contain links to third-party websites. We are not responsible for the privacy practices of those
websites. Please read their independent privacy policies.

13. Changes to This Privacy Policy

We may update this policy from time to time. Material changes (such as changes to the purposes of data processing)
will be notified to you at least 30 days in advance via email or a prominent notice on our website. Your continued
use of the Service after the changes become effective constitutes your acceptance of the updated policy.

14. Contact Us

If you have any questions about this policy or your privacy rights, please contact our Data Protection Officer (DPO)
using the information below:

• 📧 Email: inquiry@edocpos.com
• 📞 Phone: 601110684558
• ✉️ Mailing Address: Edocpos Sdn.Bhd, Lot 1 & 2, 1st Floor, Block P, One
  Avenue, 9, Bandar Utama, 90000 Sandakan, Sabah, Malaysia.

If you believe we have not properly addressed your privacy concern, you have the right to file a complaint with the
Malaysian Personal Data Protection Department (JPDP) or the data protection authority in your country.