Privacy Notice

This Privacy Notice explains how KHATIJAH TECH SOLUTION (“KTS”, “we”, “us”, “our” or “the Business”) collects, uses, discloses and protects personal data when you visit our website, submit a business enquiry, or apply for a position with us.

We have prepared this notice with Malaysia’s Personal Data Protection Act 2010 and its subsequent amendments and subsidiary guidance in mind. Publishing this notice does not by itself mean that every requirement of Malaysian data protection law has been met; it describes our practices and our commitments to you.

Please also read our Terms of Use and Cookie Policy.

KTS is a Malaysia-based technology solutions provider. We help organisations modernise operations, digitise workflows, integrate systems, and build secure and scalable business platforms.

Our capabilities include custom software development, cloud and DevOps enablement, data, analytics and AI integration, system integration, digital transformation consulting, enterprise business systems, managed IT services, web and ecommerce, mobile solutions, and cybersecurity services.

For the purposes of Malaysia’s Personal Data Protection Act 2010, KHATIJAH TECH SOLUTION acts as the data controller in respect of the personal data described in this Privacy Notice.

We collect only the personal data we need for the purposes set out in this notice.

3.1 Business enquiries

When you submit an enquiry through our contact form, we may collect:

• Full name
• Company or organisation name
• Email address
• Telephone number
• The service or business requirement you are asking about, where you provide it
• The content of your enquiry or message

3.2 Job applications

When you apply for a position with us, we may collect:

• Full name
• Email address
• Telephone number
• The position applied for
• Your resume or CV
• Cover letter and any application message
• Employment history and related information
• Education and academic background
• Skills, certifications and qualifications
• Any other information you choose to include in your CV or supporting documents

3.3 Technical information

When you visit our website, limited technical information is processed automatically by our hosting infrastructure as part of delivering and securing the site. This typically includes your IP address, browser and device information, the pages you request, and the date and time of your request.

3.4 Sensitive personal data

We do not ask you to provide sensitive personal data, including information relating to your health, religious beliefs, political opinions, the commission or alleged commission of an offence, biometric data or other sensitive information, unless we have specifically requested it and explained why it is required.

Please do not include such information in your enquiry, CV or cover letter unless we have asked for it.

We collect personal data:

• Directly from you, when you complete our contact form, submit a job application, upload a CV, or otherwise correspond with us by email, telephone or in person.
• Automatically, through the technical operation of our website and hosting infrastructure.
• From third parties, where you have asked them to share information with us or where the sharing is otherwise lawful, for example a referee you have nominated.

Providing personal data through our forms is voluntary. However, if you choose not to provide the information marked as required, we may not be able to respond to your enquiry or process your application.

We process personal data for defined and limited purposes. We do not process your data for unrelated purposes without notifying you or, where required, obtaining your consent.

Our purposes are set out in sections 6 and 7 below, together with the operational purposes common to both:

• Operating and maintaining our website and IT systems
• Protecting our website, systems and data against fraud, abuse, spam and security threats
• Maintaining internal business records
• Complying with applicable legal, regulatory and record-keeping obligations
• Establishing, exercising or defending legal claims where necessary

Where you submit a business enquiry, we process your personal data to:

• Respond to your enquiry
• Contact you regarding your enquiry, including by email or telephone
• Understand your business requirements
• Prepare proposals, quotations or scoping information where appropriate
• Provide information, documentation or materials you have requested
• Manage our relationship with you as a prospective or existing client
• Maintain records necessary for our legitimate business operations

Marketing

KTS does not currently operate a newsletter or mailing list for direct marketing through this website. Contact details submitted through our enquiry or careers forms will not be used for marketing communications unless the individual separately agrees to receive them.

If we introduce marketing communications in future, we will provide a separate and clearly identified means for you to opt in, and a means to opt out at any time.

We treat CVs, resumes and the information contained in them as confidential personal information.

Where you apply for a position, we process your personal data to:

• Administer and process your application
• Assess your skills, experience and suitability for the role you applied for
• Arrange and conduct interviews and assessments
• Communicate with you about your application and its outcome
• Verify information you have provided, where appropriate and with your knowledge
• Maintain recruitment records for the period described in section 12
• Consider you for other suitable vacancies at KTS during that retention period

Consideration for future vacancies

If your application for a particular role is unsuccessful, we may keep your application on file and consider you for other suitable KTS vacancies that arise during the 12-month retention period described in section 12. After that period, your CV and related application data are deleted or securely disposed of, unless another lawful reason requires us to retain them. We do not keep CVs indefinitely.

If you would prefer not to be considered for future vacancies, or would like your application deleted sooner, contact us using the details in section 21.

Who can see your application

Applications and CVs are not made available to the public. Access to CVs and recruitment information is restricted to authorised KTS personnel who require access for recruitment and employment-related purposes, and to any authorised service providers that process recruitment information on our behalf, subject to appropriate confidentiality and security requirements.

We do not currently use an external applicant tracking system or recruitment platform. If we introduce one, we will update this notice.

Applicants: what to leave out

Please do not include in your CV or cover letter:

• NRIC or passport numbers
• Bank account or financial details
• Photographs, where not required for the role
• Personal data about other individuals, for example referees, unless you have their agreement to share it with us

We will ask for any such information separately and at the appropriate stage of the recruitment process.

Our website’s use of cookies and similar technologies is described in our Cookie Policy.

In summary: based on our review of this website’s code and its live behaviour, including after form submission, this website does not currently set any cookies and does not use analytics, advertising or behavioural tracking technologies. Because of this, we do not display a cookie consent banner. If this changes, we will update this notice and our Cookie Policy, and put an appropriate consent mechanism in place before any non-essential cookie or tracking technology is used.

We do not sell personal data. We do not trade or rent personal data to third parties for their own marketing purposes.

We may disclose personal data:

• To our personnel who need it to perform their duties, on a need-to-know basis
• To service providers who process data on our behalf, as described in section 10
• To professional advisers, such as lawyers, auditors or accountants, where necessary
• Where required or permitted by law, court order, or a lawful request from a regulator or enforcement authority
• Where necessary to establish, exercise or defend legal claims, or to protect the rights, property or safety of KTS, our clients or others
• To a successor entity in connection with a business transfer or reorganisation, subject to appropriate protections

Where we engage a service provider to process personal data on our behalf, we require that they process it only on our instructions and apply appropriate confidentiality and security measures.

We use third-party service providers to operate this website and to handle enquiries and applications.

We do not currently use a customer relationship management (CRM) platform or an external recruitment platform in connection with this website. We also do not currently use a dedicated file or CV storage provider, a database, a CAPTCHA or anti-spam service, or a website monitoring or error-tracking service.

We implement reasonable technical and organisational measures appropriate to the nature of the personal data we process and the risks involved.

Our website is served over HTTPS, so information you submit through our forms is encrypted while in transit between your device and our hosting infrastructure.

Access to CVs and recruitment information is restricted to authorised KTS personnel who require it for recruitment and employment purposes.

The website is built and delivered primarily as static content. A single, narrowly scoped server-side function handles contact form submissions and forwards them by email; there is no database and no administrative back-end exposed on the public website, which limits the technical attack surface of the site.

No website, system or method of transmission over the internet can be guaranteed to be completely secure. While we work to protect your personal data, we cannot guarantee absolute security, and any transmission is at your own risk.

If a personal data breach occurs, we will assess the breach and make notifications to the Personal Data Protection Commissioner and affected individuals where and within the periods required by applicable Malaysian law.

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, or as required or permitted by applicable law. When personal data is no longer required, we take reasonable steps to delete it or otherwise render it no longer identifiable.

Enquiry records may be kept for longer than 24 months where they form part of an actual client relationship, contract, accounting record, legal matter, or other record that we are required or reasonably need to retain.

Personal data contained in backups may persist for a period after deletion from our active systems, and is removed in accordance with our backup cycle.

Our website is hosted by Vercel Inc., a provider headquartered in the United States that operates global infrastructure. Personal data submitted through this website may therefore be processed or stored on servers located outside Malaysia.

Emails sent to our contact email address are processed by Google LLC, and contact form submissions are additionally relayed through Resend before reaching that mailbox. Both providers operate infrastructure outside Malaysia, and neither publishes a guaranteed processing or storage region for the kind of account used for this website, so, so far as reasonably ascertainable, that processing should also be treated as taking place outside Malaysia.

Where personal data is transferred outside Malaysia, we will take reasonable steps to ensure that the transfer complies with applicable Malaysian personal data protection requirements, including the requirements relating to the destination, level of protection and any other applicable statutory condition.

Subject to the conditions and exceptions in applicable Malaysian data protection law, you may:

• Request access to the personal data we hold about you
• Request correction of personal data that is inaccurate, incomplete, misleading or out of date
• Withdraw consent to our processing, where our processing is based on your consent (see section 15)
• Request that we stop processing your personal data for direct marketing purposes
• Request that we stop processing where the processing is causing, or is likely to cause, unwarranted substantial damage or distress to you or another person
• Request data portability, where this right applies and is technically feasible, to have your personal data transmitted to another data controller

To exercise any of these rights, contact us using the details in section 21. We may need to verify your identity before acting on a request, and we may charge a prescribed fee for data access requests where the law permits. We will respond within the period required by applicable law.

Some rights are qualified. There are circumstances in which we may lawfully decline a request in whole or in part, for example where complying would breach a legal obligation, would disclose another individual’s personal data, or where an exemption applies. If we decline a request, we will tell you why.

We have described only the rights available under applicable Malaysian law. Rights that exist under other jurisdictions’ laws, such as the GDPR’s right to erasure, are not stated here and should not be assumed to apply.

Where we process your personal data on the basis of your consent, you may withdraw that consent at any time by contacting us using the details in section 21.

Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. If you withdraw consent, we may be unable to continue responding to your enquiry or processing your job application. We may also need to retain certain records where we have a legal obligation or a legitimate need to do so.

We take reasonable steps to ensure the personal data we hold is accurate, complete and up to date, taking into account the purpose for which it is processed.

Please help us by providing accurate information and by letting us know if your details change, particularly if you have an active enquiry or job application with us.

Our website and services are directed at businesses and at adults seeking employment. They are not directed at children.

We do not knowingly collect personal data from anyone under the age of 18 through this website. If you believe a child has provided us with personal data, please contact us and we will take reasonable steps to delete it.

Where an applicant is under 18 and a role is genuinely open to them, we will handle their application in accordance with the applicable requirements for processing a minor’s personal data, including any requirement for parental or guardian consent.

Our website may contain links to third-party websites, platforms or services that we do not control. This Privacy Notice does not apply to those sites.

We are not responsible for the privacy practices or content of third-party websites. We encourage you to read the privacy notice of any site you visit through a link from ours.

We may update this Privacy Notice from time to time to reflect changes in our practices, our systems, or applicable law.

The current version is always available at /privacy, and the date at the top of this page shows when it was last updated. Where a change is significant, we will take reasonable steps to bring it to your attention.

This Privacy Notice is available in English and Bahasa Malaysia. Both versions are intended to have the same meaning. In the event of any inconsistency or conflict between the two versions, the English version shall prevail to the extent permitted by applicable law.

For any question about this Privacy Notice, or to exercise any of the rights described in section 14, contact us at:

KHATIJAH TECH SOLUTIOND-G-1, Taman Universiti
43300 Seri Kembangan
Selangor, Malaysia

Email: KhatijahTechSolution@outlook.com
Telephone: +60 11-6571 1315

The same email address may be used for general enquiries, privacy enquiries and recruitment enquiries.

If you have a concern about how we have handled your personal data, please contact us first using the details above. We will look into it and respond to you.

If you are not satisfied with our response, you may lodge a complaint with the Personal Data Protection Department (Jabatan Perlindungan Data Peribadi), Malaysia. Current contact details and complaint procedures are published on the Department’s official website.