Privacy Policy & Personal Data Protection Notice

1. Introduction

This notice is issued by LUX ELECTRICAL ENTERPRISE (No. Pendaftaran: 003697691-U), No 12A-5A, Galleria @ Cyberjaya, Jalan Tenokrat 6, Cyber 5, Cyberjaya, 63000, Selangor. ("we", "us") as the operator of the SiteFlow platform, pursuant to the Personal Data Protection Act 2010 ("PDPA") of Malaysia. It explains how we collect, use, disclose and protect your personal data when you use SiteFlow.

In line with PDPA requirements, this notice is provided in both Bahasa Melayu and English.

2. Personal Data Collected

• Account information: full name, email address, phone number, job position, and (where recorded by your company) employee identity card number for site attendance/log records.
• Company information: company name, SSM registration number, address.
• Project & site data: daily logs, project schedules, documents and site photos uploaded by your company's users.
• Payment information: transaction references and payment status from the payment gateway. We do NOT store your card numbers or bank account details — these are processed directly by ToyyibPay.
• Technical data: IP address, device/browser type, sign-in history and technical error records — for security and troubleshooting.

3. Purposes of Collection

• Providing and operating the SiteFlow service for your company.
• Account management, identity verification and access control.
• Processing subscription payments and issuing invoices/receipts.
• Customer support and technical troubleshooting.
• Platform security, abuse prevention and audit trails.
• Service communications (e.g. subscription notices, log approval notifications).
• Compliance with legal obligations.

4. Disclosure to Third Parties

We do not sell your personal data. Data is disclosed only to service providers who process data on our behalf, to the extent necessary to operate the platform:

• Supabase — database and file storage (cloud hosting).
• Vercel — web application hosting.
• Anthropic — AI processing for the BQ import feature (only documents you upload for that feature).
• Resend — service email delivery.
• ToyyibPay — payment processing.
• Authorities, where required by law or court order.

5. Transfer of Data Outside Malaysia

Some of the service providers above operate servers outside Malaysia (for example Singapore or the United States). By using SiteFlow, you consent to such transfers, which are carried out with reasonable contractual and technical safeguards.

6. Security

We implement reasonable security measures including encryption in transit (HTTPS), database row-level security that isolates each company's data, role-based access control, and audit trails. However, no system is absolutely secure; you are also responsible for keeping your password confidential.

7. Retention

Personal data is retained for as long as your company's account is active (including read-only mode after subscription expiry), and for a reasonable period after termination for recovery, dispute resolution and legal compliance purposes, after which it is deleted or anonymised.

8. Your Rights Under the PDPA

• The right to access the personal data we hold about you.
• The right to correct data that is inaccurate, incomplete or out of date.
• The right to withdraw consent to processing (withdrawal may affect our ability to provide the service).
• The right to limit processing for certain purposes.

9. Cookies

SiteFlow uses only necessary cookies: sign-in session cookies, and preference cookies (language and display theme). We do not use advertising or third-party tracking cookies.

10. Children

SiteFlow is a business service and is not directed at individuals under 18 years of age.

11. Changes to This Notice

We may update this notice from time to time. The latest version and its effective date will always be displayed on this page.

12. Contact Us

To access, correct or update your personal data, or for any query regarding this notice, contact LUX ELECTRICAL ENTERPRISE through the in-app support channel. We will respond within a reasonable period in line with PDPA requirements.