Privacy policy and PDPA notice

Version 1.1. Effective 26 September 2026.

Version history: 1.1, 26 September 2026, adds attendance, expense claims and the project secrets register. 1.0, 4 September 2026, the first published version.

Notis ini dalam Bahasa Malaysia.

Who we are

Certainty HelpDesk is a product of DigiHwy Certainty. The data controller for the personal data described here is TQ Infotech (Malaysia) Sdn Bhd, trading as DigiHwy Certainty, of Jalan SS 15/4, SS 15, 47500 Subang Jaya, Selangor, Malaysia. Our Singapore affiliate, Hyron Infotech Pte Ltd, is part of the same practice and works with the same customers.

For anything in this notice, write to privacy@dhcertainty.com. If that address bounces, use partnerships@dhcertainty.com and put the word Privacy in the subject line.

Which law this notice is written under

Malaysia's Personal Data Protection Act 2010, as amended by the Personal Data Protection (Amendment) Act 2024. Where a customer or a user is in Singapore, Singapore's Personal Data Protection Act 2012 is relevant too, and there is a section on that below. Nothing in this notice takes away a right either Act gives you.

Controller for some data, processor for the rest

The split matters, because it decides who you ask for what.

• We are the controller for account records, sign-in security data, billing contacts, demo requests and technical error logs. Those exist because we run the service, and we decide what happens to them.
• We are the processor for the content your organisation puts into the product: tickets, requests, comments, files, chat messages, meeting records, recordings, transcripts and summaries, and the attendance records, leave requests, expense claims and project secrets register described below. Your organisation decides what goes in, who can see it and when it is deleted. If you are a member or a client of one of our customers, ask them first, and we will help them answer you.

What we collect

Accounts are created by your organisation or by us on its instruction. There is no public sign-up.

• Account details. Your name, email address, phone number if you give one, a profile picture if you upload one, and which office you belong to.
• Sign-in and security data. The IP address you sign in from, your browser, operating system and device details, a device fingerprint, an approximate location derived from the connection, a flag when a sign-in looks unusual, failed attempt counts, a risk score and a record of past password changes. This exists to protect the account and to let an administrator see how it has been used. We do not use it to track you across other websites.
• One-time codes. Where you sign in by email code rather than through your work Microsoft account, the code is stored hashed, is single use and expires.
• Presence and status. Whether you are online, when you were last seen and any status you set. Your own settings have a switch for each of the first two, and when you hide yours, other people stop seeing it and you stop seeing theirs.
• Push subscriptions. If you turn on browser notifications, the subscription your browser issues, which is what lets us send a notification to that browser and nothing else.
• API tokens. Tokens issued for agent access are stored as a hash. We cannot read a token back, and a lost token has to be reissued rather than recovered.
• Work content. Everything you write into the product: requests, issues, feature and change requests, tasks, comments, edit history, time entries, chat messages, voice notes and files you attach.
• Demo requests. If you fill in the form on this website: your name, organisation, email address, what you are interested in and anything you type in the context box, plus a hashed version of your IP address used only to stop the form being flooded. The hash is not reversed and is not used to identify you.
• Error logs. When something breaks, we record the technical detail of the failure, including which account it happened to. Error logs are pruned to the last 30 days.

We do not ask for sensitive personal data, and the product has no field for it. Please do not put identity card numbers, health details or financial account details into a ticket or a chat message unless your organisation has told you to and has a lawful basis for it.

Meetings, recordings, captions and summaries

Meetings run in the browser. This is the part of the product that touches the most personal data, so it is set out in full.

• Joining. A meeting is reached through a join link. The code in that link is the secret, so treat it like one. We record who joined, when, and under what name. Where a guest joins from outside your organisation, a hashed form of their IP address is used to cap how many guests can queue in the lobby.
• Typed chat and live captions. Chat typed during a meeting, and live captions, are kept as a transcript when the host leaves the transcript switch on. The host can turn it off, and when it is off nothing is kept.
• Three caption paths. Captions are produced in one of three ways, depending on the browser and on what the host has enabled. Some browsers do speech recognition themselves, in which case the audio is handled by that browser and its maker under their own terms. Otherwise the audio is relayed live to our own transcription service and turned straight into text without being stored as audio at any point. The third path runs a speech model inside your own browser tab, where the audio never leaves your device at all once your browser has downloaded the speech model from us. A caption line is attributed to whoever's browser produced it. We do not identify a speaker from their voice, and we do not build a voice or face template from a meeting.
• Recordings. A recording is made by the host's own browser, not by a server sitting in the meeting. Everyone in the meeting sees a recording badge and a notice when it starts. A finished recording is stored for your organisation and kept until somebody with the right to delete it deletes it. There is no automatic expiry, which means the retention decision belongs to your organisation. When a recording is deleted, or the meeting it belongs to is deleted, the stored file is purged rather than hidden.
• Summaries. If the host leaves the summary switch on, the transcript text is sent to an AI service we run ourselves to produce a written summary. It is not sent to a third-party AI provider, and it is not used to train a model. If the service is not configured for a deployment, summaries simply do not happen.

Recording a meeting is the host's decision and the host's responsibility. If you do not want to be recorded, say so before the recording starts, or leave.

Attendance, expense claims and the project secrets register

These three features record information about the people on your organisation's own team. None of them applies to client accounts.

• Attendance. When a staff member checks in or checks out, we record the time. If the person lets their browser share its location, we also record the latitude and longitude the browser reports at that moment, with its accuracy. We record whether location was shared, refused or unavailable, the IP address the request came from, and an approximate city and country worked out from that connection. From the location we work out whether the check-in was within 1 km of the office or remote, and the distance from the office, and we store that result. Location is read only at the moment of checking in or out, never in between and never continuously, and refusing it does not stop anybody checking in. Where an administrator later records a missed check-out, we record who did it, when, and any note they wrote.
• Who sees attendance. Each person sees their own days. The full report, with everybody's times, locations, a map link and a CSV export, is visible only to the roles your organisation grants it, which is the Admin role by default.
• Expense claims. A claim holds its title and currency; each line's category, date, merchant, description and amount, the original amount and currency where something was paid in another currency, and the distance for mileage; the receipt attached to each line, as a photo or a PDF; any project or organisation the claim is linked to; the questions, replies and decisions on it, with who made them and when; and, once it is paid, the payment date and the payment reference the payer types in. We do not ask for bank account numbers. A receipt shows whatever was printed on it, and a line can carry the category Medical, so a claim can reveal that somebody saw a doctor. A claim is visible to the person who made it and to the roles your organisation grants to approve or pay claims, which is the Admin role by default.
• Project secrets register. For each credential or setting a project depends on, we record its name, kind, environment, provider, what it is used for, where the real value is kept, the name of the setting, notes, the colleague who owns it, its expiry and rotation dates, and who added or changed the entry. We never store the value of a credential, and the register has no field for one. Client accounts cannot see the register.

Why we process it, and on what basis

• To provide the service under a contract. Account records, work content, notifications and the meeting features are processed because that is what your organisation has asked us to run for it.
• To keep the service secure. Sign-in security data, rate limiting and error logs are processed to protect accounts and to keep the service standing up. This is necessary for the contract and for our lawful interest in a service that is not broken into.
• With your consent. Browser notifications, a profile picture, meeting recordings and AI summaries all run on a switch somebody chooses to turn on, and they can be turned off again. Sharing your location when you check in or out is your browser's permission to give or refuse, and it can be withdrawn in the browser's settings.
• To answer you. A demo request is processed so that a person can reply to it.
• To meet a legal obligation. Where a law requires us to keep or disclose something, we do.

Giving us your name and work email is not optional if you want an account, because the product cannot attribute work to somebody it cannot name. Everything else on the list is optional, and the consequence of not supplying it is only that the feature it powers does not work.

Who else sees it

• Other people in your organisation, exactly as the product's own sharing rules allow. Roles, project membership and per-file sharing decide who sees what, and those decisions are enforced on the server rather than by hiding a menu.
• Client organisations, where your organisation has shared a record, a file or a meeting with them. Sharing is per item, and revoking it takes the access away.
• Our processors, being the classes of third party we rely on to run the service at all: our hosting and content delivery provider, Microsoft services for sending email, and the AI service we operate ourselves, which is what performs triage, the relayed live captions and meeting summaries. Speech recognition performed by a visitor's own browser is done by that browser's maker, as described above.
• Anyone the law requires, where we are obliged to disclose, and where we are permitted to tell you we will tell you.

We do not sell personal data. We do not share it with advertisers or data brokers. We do not use your organisation's content to train anyone's AI model.

Where it is processed

The service runs on an edge network, which means requests are served from whichever location is nearest the person making them. We cannot publish a fixed list of countries for that reason. Your personal data may be processed in the countries where our hosting provider operates. Transfers out of Malaysia are made on the conditions section 129 of the Personal Data Protection Act 2010 allows, as rewritten by the Personal Data Protection (Amendment) Act 2024 with effect from 1 April 2025. That means we satisfy ourselves that the destination has a law substantially similar to the Act, or otherwise protects the data to a standard at least equivalent to it, or that another of the Act's conditions applies, and we keep contractual protection in place with the providers we use.

How long we keep it

• Sessions. A signed-in session uses a short access token that lasts 15 minutes. It is refreshed silently while you keep using the product, so a session ends after 7 days with no use at all, and in any case 30 days after you signed in, whichever comes first. After that you sign in again. Signing out, or an administrator ending your sessions, ends them immediately.
• Error logs. 30 days, then pruned.
• Recordings, transcripts and summaries. Until somebody with the right to delete them does. There is no automatic expiry, so this is a retention decision your organisation owns.
• Work content. For as long as your organisation keeps the account, and then in line with what we agree with your organisation on exit.
• Attendance records, expense claims and receipts, and the secrets register. For as long as your organisation keeps the account, like other work content. There is no automatic expiry. When a user's account is permanently deleted, their attendance records and their claims, receipts included, are deleted with it.
• Demo requests. Kept as a record of the enquiry and of our reply. We keep demo requests for 24 months, then delete them.
• Accounts. Deleting a user normally deactivates the account rather than erasing it: sign-in is blocked, sessions end and project memberships are removed, but the person's name stays attached to the work they did, because an audit trail that forgets who made a change is not an audit trail. Where an account has authored nothing at all, it can be permanently deleted, and then the record is gone rather than deactivated.

Your rights

Under the Personal Data Protection Act 2010 you may:

• Ask what we hold about you, and get a copy of it.
• Ask us to correct it where it is wrong, incomplete or out of date.
• Withdraw your consent to anything we do on the basis of consent. Some of the product stops working when you do, and we will say which parts before you decide.
• Tell us to stop sending you direct marketing, at any time, with no reason needed.
• Ask us to stop processing where the processing is causing you substantial damage or distress.
• Ask us to transmit your personal data to another organisation, where that is technically feasible and the formats are compatible.

How to exercise them

Write to privacy@dhcertainty.com from the email address on the account, or tell us enough for us to be sure it is you. We answer access and correction requests within 21 days, which is the period the Act sets. If we refuse, we say why, within the same 21 days. For a request to transmit your data to another organisation, the Act does not yet prescribe a period, so we act within a reasonable time and tell you when to expect it.

If the data belongs to your organisation's workspace rather than to your account with us, we will pass the request to that organisation and help them answer it, because they decide what happens to it and we do not.

If something goes wrong

If we have reason to believe personal data has been breached, we notify the Personal Data Protection Commissioner as soon as practicable and within 72 hours. Where the breach is likely to cause significant harm to people, we notify those people too, in plain language, and no later than 7 days after we notify the Commissioner. Where we hold the data as a processor for a customer, we tell that customer without undue delay so they can make their own notification. We keep a register of breaches for at least two years, including the ones that do not need reporting.

Cookies

The product sets session cookies and nothing else. They are the sign-in cookies, they are marked so that scripts on a page cannot read them, they are sent only over a secure connection, and they are scoped to our own domain so that the four parts of the product share one sign-in. There are no advertising cookies, no tracking pixels and no cross-site profiling anywhere on this site or in the product.

Your browser also remembers your own display preferences on your device, such as dark mode, text size and which parts of the menu you have hidden. Those stay in the browser, they are never sent to us, and clearing your browser's site data removes them.

This marketing site can carry a privacy-friendly analytics tag which counts page views without setting a cookie and without building a profile of a visitor. It is only present when the site has been configured with a token for it, and when it is not, no analytics script is served at all.

Children

This is a product for people at work. Accounts are provisioned by an employer or a client organisation, there is no public sign-up, and the service is not directed at children. We do not knowingly collect personal data from anyone under 18. If you think a child's data has reached us, write to privacy@dhcertainty.com and we will remove it.

Automated processing and AI

Two parts of the product use AI, and neither of them decides anything about a person.

• Triage. Incoming requests can be sorted, categorised and given a suggested priority automatically, so that nothing sits unread. The suggestion is a suggestion. A person on your team reviews it and can change any part of it, and the product records who changed what. The request's title and description are sent to the same AI service we run ourselves, on the same terms as a summary: no third-party AI provider, and nothing used to train a model.
• Meeting summaries. A summary is generated text produced from a transcript. It is a convenience, not a record of what was decided, and it can be wrong. Read the transcript if the detail matters.

Neither is profiling, neither produces a legal or similarly significant effect on anybody, and neither is used to make decisions about employment, credit or entitlement. If we ever change that, we will tell you before it happens rather than after.

Security

Sign-in is through your work Microsoft account or a one-time email code, so in most deployments there is no password for us to lose. Permissions are checked on the server on every request. Files are checked against the requesting account's organisation and project before they are served. Agent tokens are stored as hashes. Sessions expire, and can be revoked centrally. No system is perfect, and the section above says what we do when one of ours is not.

For users in Singapore

Where Singapore's Personal Data Protection Act 2012 applies, you have the same practical rights described above: to ask what we hold, to have it corrected, and to withdraw consent. We limit retention and protect the data as that Act requires, and where we act as a data intermediary for a Singapore customer we notify that customer of a breach without undue delay. Where we are required to notify the Personal Data Protection Commission in Singapore, we do so as soon as practicable and no later than 3 calendar days after we assess a breach as notifiable.

We honour Singapore's Do Not Call rules for marketing messages sent to Singapore numbers, and marketing to a business contact stops the moment you ask it to. Address Singapore requests to privacy@dhcertainty.com and they will reach the same person.

Changes to this notice

If we start doing something new with personal data, we tell you before it starts, not after. Material changes are announced in the product and by email at least 30 days ahead, and nothing here is applied retroactively. The version and the effective date at the top of this page change every time the text does.

Notis Perlindungan Data Peribadi

Ini ialah notis perlindungan data peribadi kami dalam Bahasa Malaysia, seperti yang dikehendaki oleh seksyen 7(3) Akta Perlindungan Data Peribadi 2010. Jika terdapat percanggahan, teks Bahasa Inggeris di atas akan diguna pakai.

Siapa kami. TQ Infotech (Malaysia) Sdn Bhd, yang berniaga sebagai DigiHwy Certainty, di Jalan SS 15/4, SS 15, 47500 Subang Jaya, Selangor, Malaysia. Kami ialah pengawal data bagi rekod akaun, data keselamatan log masuk, hubungan bil, permintaan demo dan log ralat teknikal. Bagi kandungan kerja yang dimasukkan oleh organisasi anda ke dalam produk, kami ialah pemproses data dan organisasi anda ialah pengawal data. Hubungi kami di privacy@dhcertainty.com.

Apa yang kami kumpul. Nama, alamat e-mel, nombor telefon, gambar profil dan pejabat anda. Butiran keselamatan log masuk termasuk alamat IP, pelayar, peranti, lokasi anggaran dan sejarah log masuk, yang digunakan untuk melindungi akaun anda. Status kehadiran anda. Langganan pemberitahuan pelayar. Token API disimpan sebagai nilai cincangan (hash) sahaja. Kandungan kerja yang anda tulis dalam produk. Rekod mesyuarat: siapa yang menyertai, mesej yang ditaip, kapsyen langsung yang disimpan sebagai transkrip apabila hos membiarkan suis transkrip dihidupkan, rakaman yang dibuat oleh pelayar hos, dan ringkasan yang dijana oleh perkhidmatan AI kami sendiri. Log ralat teknikal, disimpan selama 30 hari.

Kehadiran, tuntutan perbelanjaan dan daftar rahsia projek. Apabila kakitangan mendaftar masuk atau keluar, kami merekod masa, lokasi yang dilaporkan oleh pelayar pada saat itu jika dibenarkan, alamat IP dan anggaran bandar, serta sama ada ia dibuat di pejabat atau dari jauh. Lokasi dibaca hanya pada saat mendaftar masuk atau keluar. Tuntutan perbelanjaan menyimpan butiran setiap perbelanjaan, fail resit, keputusan dan rujukan pembayaran. Daftar rahsia projek menyimpan nama, tempat simpanan dan tarikh luput sesuatu kelayakan, tetapi tidak pernah nilainya. Semua ini hanya untuk kakitangan organisasi anda, bukan akaun pelanggan.

Tujuan. Untuk menyediakan perkhidmatan kepada organisasi anda, melindungi akaun anda, menjawab pertanyaan anda, dan mematuhi kewajipan undang-undang.

Pendedahan. Kepada ahli lain dalam organisasi anda mengikut peraturan perkongsian dalam produk; kepada organisasi pelanggan yang dikongsikan sesuatu rekod, fail atau mesyuarat dengannya; kepada kelas pemproses data berikut: pembekal hosting dan penghantaran kandungan, perkhidmatan Microsoft untuk menghantar e-mel, dan perkhidmatan AI yang kami kendalikan sendiri; dan kepada pihak yang dikehendaki oleh undang-undang. Kami tidak menjual data peribadi.

Pemindahan ke luar negara. Data anda mungkin diproses di negara tempat pembekal hosting kami beroperasi, tertakluk kepada syarat seksyen 129 Akta.

Penyimpanan. Sesi log masuk tamat selepas 7 hari tanpa penggunaan, dan dalam apa jua keadaan 30 hari selepas anda log masuk. Log ralat 30 hari. Rakaman, transkrip dan ringkasan disimpan sehingga dipadam oleh orang yang berhak dalam organisasi anda. Akaun yang dipadam dinyahaktifkan, dan nama anda kekal pada kerja yang anda buat untuk tujuan jejak audit.

Hak anda. Anda berhak meminta akses kepada data peribadi anda, membetulkannya, menarik balik kebenaran anda, menghentikan pemasaran langsung, dan meminta data anda dihantar kepada pengawal data lain. Anda juga berhak meminta kami berhenti memproses data anda apabila pemprosesan itu menyebabkan anda kerugian atau tekanan yang ketara, dan berhak membuat aduan kepada Pesuruhjaya Perlindungan Data Peribadi. Kami menjawab permintaan akses dan pembetulan dalam tempoh 21 hari. Pemberian nama dan e-mel kerja anda adalah wajib untuk membuka akaun; yang lain adalah sukarela, dan akibatnya hanyalah ciri berkenaan tidak berfungsi.

Pelanggaran data. Kami memberitahu Pesuruhjaya Perlindungan Data Peribadi dalam tempoh 72 jam, dan memberitahu individu yang terjejas dalam tempoh 7 hari selepas itu apabila pelanggaran itu berkemungkinan menyebabkan kemudaratan yang ketara.

Versi. Versi 1.1, berkuat kuasa 26 September 2026.

Our data protection officer

Section 12A of the Personal Data Protection Act 2010 requires us to appoint a data protection officer, and the Commissioner's guideline on that appointment requires us to publish how to reach them. Ours is reachable at privacy@dhcertainty.com, and by post at the address at the foot of this page, marked for the attention of the data protection officer.

Requests from Singapore reach the same officer, during Singapore business hours.

Contact

Questions, requests and complaints about personal data: privacy@dhcertainty.com, or by post to TQ Infotech (Malaysia) Sdn Bhd, Jalan SS 15/4, SS 15, 47500 Subang Jaya, Selangor, Malaysia. You also have the right to complain to the Personal Data Protection Commissioner in Malaysia, and to the Personal Data Protection Commission in Singapore where that Act applies, but we would rather you told us first and gave us the chance to fix it.

The terms this notice sits alongside are on the terms of service page.