PDPA Notice

This Notice is issued under section 7 of the Personal Data Protection Act 2010 (Act 709), as amended by the Personal Data Protection (Amendment) Act 2024. It tells you how Taokeh processes your personal data.

Taokeh is operated by Enya Venture, a sole proprietorship registered with the Companies Commission of Malaysia (SSM), business registration no. 003853053-D (202603132312), with its registered address at Inspirasi Mont Kiara, Jalan Kiara 4, 50480 Kuala Lumpur, Malaysia ("we", "us", "Taokeh"). The software and website at https://taokeh.my are referred to as "the Service".

In this Notice, "you" / "the Customer" means the person or business that subscribes to or uses the Service.

1. Personal data we process

We process the following personal data about you, as the data controller, when you register for and use the Service:

• Identity and account data — your name, email address, telephone number, password (stored in hashed form), two-factor authentication credentials, and user role.
• Business and registration data — your company or business name, SSM business registration number, and address.
• Billing and subscription data — your subscription plan, add-ons, payment and renewal status. We do not store full payment card numbers; card and payment details are handled by our payment processors (see section 5).
• Usage and technical data — server and audit logs, IP address, browser and device information, and session cookies.

Business records you enter into the Service — Where you use the Service to record your own business data (for example, the contact details of your customers, suppliers and employees, employee payroll data, invoices, bank transactions and uploaded documents), you are the data controller of that data and we process it only as your data processor, on your instructions, to provide the Service to you. The purposes, lawful basis and notice obligations for that data are yours, and you must give your own personal data protection notice to those individuals. A separate Data Processing Agreement governs that processing. This Notice covers only the personal data for which Taokeh is the data controller, listed above.

2. Purposes of processing

We collect and further process your personal data to:

• create and administer your account and authenticate your sign-in (including two-factor authentication);
• provide, operate, maintain and support the Service;
• process your subscription, payments and renewals, and manage your billing status (including making your workspace read-only when a paid term lapses);
• communicate with you about your account, security, service changes and support;
• keep records and meet our legal, tax, accounting and regulatory obligations; and
• protect the security and integrity of the Service and prevent fraud or misuse.

We process your personal data only for these purposes or purposes directly related to them.

3. Source of the data

We obtain your personal data directly from you — when you sign up, set up your workspace, enter your account and company details, subscribe, or contact us — and automatically from your use of the Service (for example, log, device and session data generated when you access the Service).

4. Your right of access and correction; how to contact us

You have the right to request access to your personal data that we hold and to request correction of it if it is inaccurate, incomplete, misleading or out of date.

To make an access or correction request, or for any inquiry or complaint about your personal data, contact us at:

• Email: admin@taokeh.my
• Telephone: +60 16-773 9678
• Address: Enya Venture, Inspirasi Mont Kiara, Jalan Kiara 4, 50480 Kuala Lumpur, Malaysia
• Data protection enquiries: dpo@taokeh.my. A formal Data Protection Officer will be appointed and named here if and when Taokeh meets the mandatory threshold under the Personal Data Protection (Amendment) Act 2024.

We will respond as soon as practicable and within the period prescribed under the Act. A prescribed fee may apply to an access request. If you are not satisfied with how we handle your request or complaint, you may refer the matter to the Personal Data Protection Department (Jabatan Perlindungan Data Peribadi, JPDP), Putrajaya — see pdp.gov.my for the current complaint channel.

5. Classes of third parties to whom we may disclose data

We may disclose your personal data, only as necessary for the purposes above, to the following classes of third parties:

• Cloud hosting and database providers that host the Service and store its data — Supabase (database hosting, Singapore — AWS ap-southeast-1) and Render (application hosting, Singapore).
• Payment processor that handles your subscription payments — HitPay (MYR / FPX / DuitNow / cards), Singapore.
• Communications and infrastructure providers — Zoho Mail (transactional and account email; Zoho Corporation data centres, United States) and Cloudflare (DNS, content delivery and security; global edge network, with traffic routed to the Singapore region).
• Optional AI text-feature provider — Anthropic (Claude), United States, only where you choose to use an AI helper feature, which is optional and gated behind a one-time, workspace-level acceptance of AI terms. Only the text you submit to an AI helper is sent; outputs are for your human review, and under the provider's commercial terms your data is not used to train its models.
• Government authorities, regulators, professional advisers and law-enforcement bodies, where disclosure is required or permitted by law, or to establish, exercise or defend legal rights.
• A successor entity, if Taokeh's business is reorganised, sold, merged or transferred.

Separately, where you choose to use particular features, the Service transmits data on your instruction (as your data processor) to: LHDN MyInvois (e-invoice submission, Malaysia, only if you use e-invoicing) and Shopee / TikTok Shop (regional — Singapore / South-East Asia, only if you connect your own shop). The Bank Negara Malaysia (Malaysia) foreign-exchange reference feed is read-only and involves no personal data.

6. Cross-border transfer

Because our hosting and database providers are located in Singapore, your personal data is stored and processed in Singapore, outside Malaysia. Each tenant's data is logically isolated. We rely on a lawful basis for this transfer under the Act's cross-border transfer requirements (including the necessity of the transfer to perform our contract with you and reasonable precautions/safeguards with our processors). We apply appropriate contractual safeguards with our Singapore-based processors for this transfer and review them periodically.

7. Your choices and means to limit processing

You may limit how we process your personal data by:

• choosing not to use optional features (for example, the AI helper features, which remain off until you accept the separate AI terms);
• adjusting your account, communication and privacy settings within the Service;
• opting out of non-essential or marketing communications using the unsubscribe link or by contacting us (we will still send essential service, security and billing messages);
• managing or blocking cookies through your browser settings (note that blocking the session cookie will prevent you from signing in); and
• contacting us at admin@taokeh.my to request that we limit the processing of your personal data.

Some limitations may mean we can no longer provide part or all of the Service to you.

8. Is supplying the data obligatory or voluntary?

Supplying the personal data described in section 1 is obligatory to the extent it is necessary to create your account, provide the Service and meet our legal and tax obligations. It is voluntary to provide any further information beyond this.

Consequence of not supplying the obligatory data: if you do not provide it, we will be unable to register or verify your account, provide the Service, or process your subscription, and we may be unable to perform our contract with you.

9. Bilingual notice

This Notice is issued in both Bahasa Malaysia and English in accordance with section 7(3) of the Personal Data Protection Act 2010. In the event of any inconsistency between the two versions, the English version prevails. The Bahasa Malaysia version is available at https://taokeh.my/pdpa?lang=bm.

Taokeh is operated by Enya Venture (SSM business registration no. 003853053-D / 202603132312), Inspirasi Mont Kiara, Jalan Kiara 4, 50480 Kuala Lumpur, Malaysia. Contact: admin@taokeh.my · +60 16-773 9678 · https://taokeh.my