Terms of service

Version 1.0. Effective 4 September 2026.

Version history: 1.0, 4 September 2026, the first published version.

1. Who this agreement is between

These terms are between TQ Infotech (Malaysia) Sdn Bhd, trading as DigiHwy Certainty, of Jalan SS 15/4, SS 15, 47500 Subang Jaya, Selangor, Malaysia, and the organisation that has agreed to take Certainty HelpDesk. In these terms, we and us mean DigiHwy Certainty, and you and the customer mean that organisation.

This is a business product. It is supplied for business purposes, there is no consumer sign-up route, and by agreeing to these terms you confirm that you are taking the service for the purposes of your business and not for a personal, domestic or household purpose.

People who use the service under your account, whether they are your staff, your contractors or your clients, are bound by these terms through you. You are responsible for what they do with the service, and for making sure they know what is expected of them.

2. Accepting these terms

You accept these terms by signing an order, by asking us to open a deployment for you, or by using the service. Our privacy policy forms part of this agreement and is incorporated into it by this reference. It stays at that address, and every version of it is kept.

Where you have signed an order form or a written agreement with us, and it says something different from these terms, the signed document wins on that point. Otherwise these terms govern.

3. The service

Certainty HelpDesk is a hosted workspace for client requests, issues, feature and change requests, tasks, time tracking, files, chat, meetings, a calendar and a client portal, with roles and permissions across all of it. It is deployed for your organisation and reached through a browser.

What is included in your deployment is what your order says. This website describes the product as it stands today; where something is not built yet, the page says so, and a description on this website is not a commitment to build anything.

4. Accounts and security

Accounts are created by an administrator of your organisation or by us on your instruction. Each account belongs to one named person. Accounts are not to be shared, and a leaver's account should be deactivated rather than passed on.

You are responsible for the security of the accounts under your deployment: for keeping sign-in credentials and one-time codes to the person they belong to, for reviewing who has which role, and for telling us promptly if you think an account has been compromised.

API tokens. The product can issue tokens that let an AI agent or a script act under a person's own permissions. A token is a means of access. Only the person the token was issued to is authorised to hold it. Passing a token to anybody else, including to a colleague, is not permitted: section 6 of the Computer Crimes Act 1997 makes it an offence to communicate a means of access to somebody not duly authorised to have it, and these terms are what decide who is duly authorised. Tokens can be revoked at any time by the person who holds them or by an administrator, and they should be rotated when anybody who might have seen one leaves.

5. Acceptable use

What the service must not be used for.

• Unlawful content or conduct. Nothing that breaks Malaysian law or the law where the person is. That includes content that is obscene, indecent, false, menacing or grossly offensive in character and sent with intent to annoy, abuse, threaten or harass anybody, or to commit an offence involving fraud or dishonesty. We will remove such content and suspend the account behind it.
• Unauthorised access. No attempting to reach data, an account, an organisation or a project you have not been given access to. No circumventing permissions, rate limits or lobby controls. No security testing of the service without our written permission first. These are not just contract terms: the Computer Crimes Act 1997 makes unauthorised access, unauthorised modification and sharing a means of access criminal offences, and these terms are what define the boundary of what you are authorised to do.
• Interference. No action intended to impair the normal operation of the service for anybody else, including flooding it with requests, scraping it, or running automated traffic outside the documented interfaces and their rate limits.
• Recording without consent. A meeting recording is started by a host and is the host's responsibility. The product shows every participant that a recording has started, and you must not defeat, hide or work around that notice. Where the law that applies to your participants requires their consent, getting it is your job, not ours.
• Other people's personal data. No uploading personal data you have no lawful basis to process, and no putting sensitive personal data into the product unless you have the explicit consent or other lawful ground the law requires for it.

We may remove content or suspend access where we reasonably believe this section has been broken, and we will tell you what we did and why, in advance where that is practical and straight afterwards where it is not.

6. Your data, and how we process it

The content your organisation puts into the service is yours. We do not claim ownership of it. You grant us the licence we need to host, store, transmit, process and display it, and nothing beyond that, and only for the purpose of running the service for you.

Where the content contains personal data, you are the data controller and we act as your data processor. That means:

• we process it on your documented instructions and for no other purpose;
• we keep it confidential and require the same of the people who work on it;
• we comply directly with the Security Principle under the Personal Data Protection Act 2010, which since April 2025 binds a data processor in its own right and not only through its customer;
• we use the classes of sub-processor named in the privacy policy, and we tell you before we add a new class;
• we help you answer access and correction requests within the 21 days the Act sets for them, and we help you answer withdrawal, objection and portability requests promptly;
• we tell you about a personal data breach affecting your content without undue delay, so that you can make your own notifications;
• transfers out of Malaysia are made on the conditions the Act permits, with contractual protection in place with each provider;
• on termination, we return or delete your content as section 12 sets out, and we will confirm in writing when it is done.

We do not use your content to train an AI model, ours or anybody else's. Where the product generates text from your content, such as a meeting summary or a triage suggestion, that output is your content too.

If you need a separate signed data processing agreement, including one that names transfer destinations for a Singapore customer, write to privacy@dhcertainty.com and we will put one in front of you.

7. Our intellectual property

The service itself, its software, its design, its documentation and the Certainty HelpDesk and DigiHwy Certainty names remain ours. Nothing in this agreement transfers any of it to you. You get the right to use the service for your business for as long as this agreement runs, and that is the whole of the grant.

You must not copy, decompile or reverse engineer the service except to the extent the law says you may despite a term like this one, and you must not resell or offer it as your own service without our written agreement.

If you send us feedback or a suggestion, we may use it to improve the product without owing you anything for it. We will not identify you as its source without asking.

8. Third-party services

Some parts of the service depend on providers outside our control, including hosting and content delivery, email delivery, and speech recognition performed by a participant's own browser. Where you connect the service to a third-party system of your own, that system is governed by its own terms, not by these. We are not responsible for a third-party service failing, changing or withdrawing, though we will tell you when we know about it and will work with you on the alternatives.

9. Fees

Fees, the billing cycle and the term are as agreed in your order. There are no prices on this website: the deployment is quoted for your organisation.

Invoices are payable by the date on the invoice. Taxes, including sales and service tax where it applies, are on top of the quoted fees unless the order says otherwise. Where an invoice is significantly overdue and we have asked you about it in writing, we may suspend access until it is settled, and suspension for non-payment does not reduce what is owed for the period.

We may change fees for a renewal term by telling you in writing before the renewal, with enough notice for you to decide not to renew.

10. Availability and support

We use reasonable efforts to keep the service available and to fix faults promptly during business hours in Malaysia. We do not promise a specific uptime percentage, and no service level applies unless your order says so in writing and sets out what it is.

We will give you notice of planned maintenance where we reasonably can. Availability excludes anything caused by your own systems or network, by a third-party provider, or by an event outside our reasonable control.

11. Suspension

We may suspend access, in whole or in part, where it is necessary to protect the service or other customers, where section 5 has been broken, where the law requires it, or where fees are significantly overdue after written notice. We keep a suspension no wider and no longer than the reason for it, and we tell you what would lift it.

12. Termination and what happens to your data

Either of us may end this agreement at the end of the current term by giving written notice before it renews. Either of us may end it immediately for a material breach that the other has not put right within 30 days of being told about it in writing, or where the other becomes insolvent.

On termination, your access ends and payment falls due for the period up to that date. For 30 days after termination we will keep your content available for export and, if you ask, will provide it in a structured, machine-readable format. After that window we delete it, other than anything we are required to keep by law or that sits in a routine backup, which is deleted on its own cycle.

13. Warranties

We warrant that we will provide the service with reasonable skill and care, and that we have the right to grant what this agreement grants.

Beyond that, and to the extent the law allows, the service is provided as it is. We do not warrant that it will be uninterrupted or error free, that it will meet a requirement we have not agreed in writing, or that AI-generated text such as a triage suggestion or a meeting summary will be accurate. Those are aids, and a person on your team is expected to check them.

You warrant that you have the right to put your content into the service, and the lawful basis to process the personal data in it.

14. Liability

Neither of us excludes liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for anything else the law does not allow to be excluded or limited.

Subject to that, and to the carve-outs below, each party's total liability under this agreement, whether in contract, tort including negligence, or otherwise, is limited in aggregate to the fees paid or payable by you under this agreement in the 12 months before the event giving rise to the claim.

Neither of us is liable to the other for indirect or consequential loss.

The cap does not apply to:

• your obligation to pay fees that are properly due;
• either party's fraud or wilful misconduct;
• a breach of the confidentiality obligations in section 16;
• your breach of section 5, acceptable use;
• an indemnity given under section 15.

Nothing in this section prevents either of us from bringing a claim within the period the Limitation Act 1953 allows.

15. Indemnity

You will indemnify us against claims, losses and reasonable costs arising from your content, from your use of the service in breach of section 5, or from your failure to hold a lawful basis for personal data you put into it.

We will indemnify you against a third-party claim that the service as supplied by us infringes that third party's intellectual property rights, provided you tell us promptly, let us conduct the defence, and do not settle without our agreement.

16. Confidentiality

Each of us will keep the other's confidential information confidential, use it only for this agreement, and protect it at least as carefully as we protect our own. This does not apply to information that is already public through no fault of the receiver, that was already known, or that must be disclosed by law, and in that last case the discloser will tell the other party where it is permitted to.

17. Changes to these terms

We may change these terms, and when we do we will tell you at least 30 days before the change takes effect. If a change materially disadvantages you, you may terminate at the date it would take effect by telling us in writing before then, and we will refund fees paid for the period after termination. We do not change these terms retroactively, and we do not change them without notice.

18. Electronic contracting

Under the Electronic Commerce Act 2006, this agreement is not deprived of legal effect because it is formed electronically, and an electronic signature satisfies a requirement for a signature.

As a matter of this agreement rather than of that Act, notices under this agreement may be given by email to the address each party has given the other for the purpose, and are treated as received on the next business day.

19. General

• Order of precedence. A signed order form, then a signed data processing agreement, then these terms, then the privacy policy.
• Force majeure. Neither party is liable for a failure caused by an event outside its reasonable control, for as long as that event lasts.
• Assignment. Neither party may assign this agreement without the other's written consent, except to a successor of substantially the whole of its business.
• Entire agreement. This agreement, with the documents it names, is the whole of what has been agreed, and it replaces earlier discussions on the same subject. Nothing here limits liability for fraudulent misrepresentation.
• Severability. If a term is found to be void or unenforceable, the rest of the agreement stands.
• No waiver. Not enforcing a term on one occasion does not waive it for the future.
• No partnership. Nothing here makes either party the other's agent, partner or employee.

20. Governing law and jurisdiction

This agreement is governed by the laws of Malaysia. If a dispute arises, we will each nominate a senior person and try in good faith to resolve it between us for 30 days first, because that is usually faster and cheaper than the alternative.

If that does not settle it, the courts of Kuala Lumpur have exclusive jurisdiction over the dispute, and both parties submit to it.

Nothing in this clause stops either of us from going to court at any time where waiting would cause harm that cannot be undone, including for an injunction or another urgent remedy.

21. Contact

Commercial and contractual questions: partnerships@dhcertainty.com. Data protection questions: privacy@dhcertainty.com. By post: TQ Infotech (Malaysia) Sdn Bhd, Jalan SS 15/4, SS 15, 47500 Subang Jaya, Selangor, Malaysia.

How we handle personal data is set out in the privacy policy, which forms part of this agreement.