Privacy Policy

We collect personal data that you provide directly to SNLuxLab Solution, SSM Registration No. 202603133213 (003853382-H), when you use our website, software services, AI tools, automation systems, APIs, support channels, quotation forms, project communication channels or other services offered through snluxlab-solution.com. The type of personal data collected depends on your relationship with us and the services you use.

This may include:

• Identity information, such as your name, company name, job title, business registration details and representative details.
• Contact information, such as email address, phone number, business address and communication details.
• Account information, such as username, login records, authentication information, access permissions and account activity.
• Service data, such as project requirements, prompts, instructions, uploaded files, uploaded images, generated outputs, workflow settings, API requests, system configuration and support requests.
• Technical data, such as IP address, browser type, device information, operating system, access logs, error logs, API logs, usage records, security logs and approximate location derived from IP address.
• Billing and transaction data, such as invoice details, subscription records, payment status, purchase history and related accounting information.
• Communication data, such as emails, messages, meeting notes, support tickets, feedback and records of enquiries.

Where our services involve AI, automation, image generation, chatbot, data processing, media processing, analytics, software development or system integration, we may process the content submitted by you or your authorised users in order to provide the requested service. You are responsible for ensuring that you have the necessary rights, consent or lawful authority before submitting personal data of another individual to us.

We do not intentionally collect sensitive personal data unless it is necessary for the specific service requested, required by law or voluntarily provided by you. Sensitive personal data may include information relating to health, disability, biometric data, religious belief, political opinion or other protected information. Where such data is provided, we will process it only for the relevant purpose and with appropriate safeguards.

We use personal data to provide, operate, maintain, secure and improve our website, software services, AI services, automation tools, APIs, consulting services, project delivery, system integration, hosting and support services. We only use personal data for purposes that are necessary, lawful and connected to our business relationship with you.

We may use personal data for the following purposes:

• To create, manage and authenticate user accounts.
• To provide software, AI, automation, API, hosting, consulting and support services.
• To process enquiries, quotations, project requests, service orders, invoices and payments.
• To communicate with you about projects, support matters, service updates, billing and administrative issues.
• To generate AI outputs, process uploaded files, run automation workflows and deliver requested system functions.
• To troubleshoot errors, monitor system performance, maintain service reliability and improve user experience.
• To protect our services against fraud, misuse, unauthorised access, security threats and unlawful activity.
• To maintain internal records, audit logs, accounting records, tax records and contractual records.
• To improve our products, workflows, documentation, models, features and business operations.
• To comply with legal, regulatory, accounting, tax, audit, security and contractual obligations.
• To enforce our agreements, protect our legal rights, resolve disputes and respond to lawful requests.

Where practical, we may use aggregated, anonymised or de-identified data for analytics, product improvement, reporting, system monitoring and business planning. Such data does not directly identify an individual.

Where we provide services to a business customer and process personal data only based on that customer’s instructions, the customer remains responsible for giving proper privacy notices, obtaining required consent and ensuring that the personal data submitted to our services may lawfully be processed by us.

Our website and software services may use cookies, local storage, session storage, pixels, SDKs or similar technologies to operate the services, maintain user sessions, remember preferences, protect accounts, monitor performance, analyse usage and improve user experience. Some of these technologies are necessary for the website or service to function properly.

We may use the following types of technologies:

• Essential cookies or storage, used for login sessions, authentication, security, load balancing and core service functionality.
• Preference cookies or storage, used to remember settings such as language, interface preferences or user choices.
• Analytics technologies, used to understand how visitors and users interact with our website and services.
• Performance technologies, used to identify errors, slow pages, failed requests and system reliability issues.
• Security technologies, used to detect abuse, fraud, unauthorised access and suspicious activity.

Where required by applicable law, we will request your consent before using non-essential cookies or similar technologies. You may manage or disable cookies through your browser settings or any cookie preference tool made available on our website. However, disabling certain cookies or local storage may affect the functionality, security or performance of our services.

We do not use cookies or local storage to collect more personal data than is reasonably necessary for the stated purpose. Where third-party analytics, hosting, security or software providers are used, their technologies may process limited technical information in accordance with their own privacy terms and our contractual arrangements with them.

We do not sell personal data. We may disclose or make personal data available only where necessary for service delivery, legitimate business purposes, legal compliance, security protection, contractual performance or with your consent.

Personal data may be disclosed to the following categories of recipients:

• Our employees, directors, contractors, consultants and authorised personnel.
• Hosting providers, cloud infrastructure providers, database providers and storage providers.
• Software vendors, API providers, automation platforms, AI infrastructure providers and technical service providers.
• Payment processors, billing platforms, accounting providers and financial service providers.
• Email providers, communication platforms, customer support systems and project management tools.
• Analytics providers, monitoring providers, cybersecurity providers and logging services.
• Professional advisers, including lawyers, accountants, auditors, tax advisers and compliance consultants.
• Government authorities, regulators, courts, law enforcement agencies or statutory bodies where required or permitted by law.
• Business partners, subcontractors or service providers involved in delivering services requested by you or your organisation.

We require service providers and processors to handle personal data only for authorised purposes, maintain appropriate confidentiality and security controls, and comply with applicable contractual and legal obligations. Where a processor processes personal data on our behalf, we will take reasonable steps to ensure that the processor provides sufficient guarantees in relation to data protection, security, confidentiality, retention and deletion.

Where personal data is transferred outside Malaysia, we will take reasonable steps to ensure that the transferred personal data is protected in a manner consistent with applicable data protection laws. This may include using contractual safeguards, assessing the recipient, limiting the data transferred, applying security controls and ensuring that the transfer is necessary for the service, contract, legal obligation or other lawful purpose.

If SNLuxLab Solution is involved in a merger, acquisition, restructuring, financing, sale of assets, business transfer or similar transaction, personal data may be disclosed to the relevant parties and advisers as part of the transaction, subject to appropriate confidentiality and data protection safeguards.

We take reasonable administrative, technical and organisational measures to protect personal data against unauthorised access, misuse, loss, alteration, disclosure or destruction. Our security measures are designed to protect personal data based on the nature of the data, the risks involved and the services provided.

These measures may include:

• Access control and role-based permission management.
• Authentication controls and password protection.
• Encryption where appropriate.
• Network, server and application security controls.
• Logging, monitoring and audit trails.
• Backup and disaster recovery controls.
• Vulnerability management and security review.
• Restricted access to production systems.
• Internal confidentiality obligations for personnel and contractors.
• Security procedures for handling incidents, errors and unauthorised access attempts.

Access to personal data is limited to personnel, contractors and service providers who need such access for legitimate business or service purposes. We expect all persons handling personal data on our behalf to maintain confidentiality and to process the data only in accordance with authorised instructions and applicable law.

No internet, software, cloud, AI, API or electronic storage system can be guaranteed to be completely secure. While we take reasonable steps to protect personal data, users are also responsible for maintaining the confidentiality of their login credentials, using strong passwords, restricting account access, protecting their own systems and notifying us promptly if they suspect unauthorised access, compromise or misuse.

If we become aware of a personal data breach that may result in significant harm or is otherwise notifiable under applicable law, we will take reasonable steps to assess the incident, contain the risk, notify the relevant authority and affected individuals where required, and implement remedial measures as appropriate.

We retain personal data only for as long as reasonably necessary to fulfil the purposes for which it was collected, provide our services, comply with legal obligations, resolve disputes, enforce agreements, maintain security and protect our legitimate business interests. The actual retention period may vary depending on the type of data, the nature of the service, the sensitivity of the data, legal requirements and operational needs.

Our general retention approach is as follows:

• Account and customer records are retained for as long as the account or business relationship remains active, and for a reasonable period after closure where required for legal, contractual, audit or dispute-resolution purposes.
• Contract, invoice, payment, accounting and transaction records may be retained for the period required by applicable tax, accounting, audit and legal requirements.
• Project records, support tickets and communication records may be retained as necessary to provide continuing support, evidence service delivery, manage customer relationships or resolve disputes.
• System logs, security logs, API logs and technical records are generally retained for a limited period necessary for troubleshooting, monitoring, abuse prevention, security investigation and service improvement, unless a longer period is required for legal, security or operational reasons.
• AI input, uploaded content and generated output may be retained for the period necessary to deliver the service, support user access, troubleshoot issues, maintain auditability or comply with contractual requirements, unless earlier deletion is requested and legally permitted.

Where personal data is no longer required, we will take reasonable steps to delete, anonymise, de-identify or securely dispose of it. Backup copies may remain for a limited period until they are overwritten or deleted in accordance with our backup and disaster recovery procedures, subject to appropriate access controls.

If you request deletion of your personal data, we will assess and process the request in accordance with applicable law. We may retain certain data where retention is required or permitted for legal compliance, dispute resolution, fraud prevention, security, accounting, audit, contractual enforcement or legitimate business purposes.

Subject to the Personal Data Protection Act 2010 of Malaysia and other applicable laws, you may have certain rights in relation to your personal data. These rights may be subject to legal exceptions, verification requirements and practical limitations.

You may request to:

• Access the personal data we hold about you.
• Correct personal data that is inaccurate, incomplete, misleading or outdated.
• Withdraw consent where processing is based on consent.
• Limit the processing of your personal data where permitted by law.
• Opt out of direct marketing communications.
• Ask questions about how we collect, use, disclose, store or protect your personal data.
• Make a complaint if you believe your personal data has been handled improperly.

To exercise your rights, you may contact us using the contact details provided in this Privacy Policy. We may request information to verify your identity before responding to your request. We will respond within a reasonable time and in accordance with applicable legal requirements.

We may refuse or limit a request where permitted by law, including where disclosure would affect another person’s privacy, reveal confidential commercial information, interfere with legal proceedings, prejudice security investigations, conflict with legal obligations or where the request is excessive, incomplete or unsupported by sufficient verification.

If you provide personal data on behalf of another person, you confirm that you have obtained the necessary consent or have another lawful basis to provide that personal data to us. If you are a business customer using our services to process personal data of your own users, customers, employees or other individuals, you are responsible for handling their privacy requests unless otherwise agreed in writing.

You may withdraw consent for optional processing at any time. However, withdrawal of consent may affect our ability to provide certain services, features, support or communications. Withdrawal of consent does not affect processing carried out before the withdrawal, or processing that is required or permitted by law.