How we handle personal data

1. Who is responsible

“KKCSI”, “KKBOSS”, “we”, “us” or “our” means the service provider identified on your checkout record, order confirmation or invoice. For account and billing information, we determine why and how personal data is processed. When we process personal data placed in Customer Data solely on a business customer’s instructions, that customer generally determines the purposes and we act as its service provider or data processor/data intermediary, as applicable.

2. Personal data we collect

• Account and organization data: name, email address, organization name, password hash, account status and acceptance records.
• Technical and security data: IP address, browser/user-agent information, session identifiers, timestamps, API-key prefixes and hashes, request and security logs.
• Service data: project and collection names, JSON records, imported CSV/JSON content, manual record snapshots and configuration submitted by authorized users.
• Billing data: selected plan, currency, orders, invoices, payment status and PayPal transaction identifiers. PayPal handles payment credentials; we do not receive full card or funding-account details.
• Support data: name, email address, subject, message, ticket history and information you choose to provide.

3. Sources and purposes

We obtain data from you, authorized users in your organization, automated interactions with our service, and payment or service providers such as PayPal. We use it to create and administer accounts; authenticate users; provide projects, API access, imports and snapshots; process orders and payments; communicate service and security messages; answer support requests; prevent abuse; diagnose faults; maintain records; and comply with law. Where consent is the applicable basis, you may withdraw it with reasonable notice, subject to consequences we explain and processing otherwise permitted or required by law.

4. Disclosure and service providers

We may disclose only the data reasonably needed to hosting/infrastructure, email delivery, payment, security and professional-service providers; authorized personnel and users in your organization; a successor in a genuine business transfer; and regulators, courts or law-enforcement bodies where required or permitted by law. Providers are expected to process data for authorized purposes and apply appropriate safeguards. We do not sell or rent personal data.

5. Location and cross-border transfers

kkbase’s primary application environment is currently located in Singapore. Some service providers, communications or support operations may process data in other countries. Where Malaysian or Singapore personal data is transferred internationally, we use contractual, organizational or other measures intended to provide the level of protection required by applicable law. Contact us for information about a relevant transfer.

6. Cookies and similar technology

The customer portal uses an essential secure session cookie to keep users signed in and protect authenticated activity. Technical logs and rate-limiting controls may also use IP-derived or request identifiers for security. We do not describe these essential functions as advertising cookies. If optional analytics or marketing technologies are added, this notice and any required consent controls must be updated before use.

7. Retention

We retain personal data only while reasonably needed for the purposes above, the active account or service, security, dispute resolution and legal, tax or accounting requirements. Retention varies by record type. Expired sessions and tokens are invalidated; support, billing and security records may be kept longer where necessary; Customer Data is deleted or anonymized after account closure according to the applicable retention process. Deletion from active systems may not immediately remove protected backup copies, which are isolated and expire through their normal lifecycle.

8. Security and incidents

We use measures appropriate to the nature of the data and risk, including access controls, tenant-scoped authorization, password hashing, secure session cookies and operational logging. No online system can guarantee absolute security. We assess suspected personal-data breaches and notify the applicable regulator and affected individuals when required by Malaysian or Singapore law.

9. Your choices and rights

Subject to applicable law and exceptions, you may ask for access to or correction of your personal data, information about its use or disclosure, withdrawal of consent, and deletion or export where available or required. We may verify identity and authority, request details, charge a lawful fee where permitted, or refuse/limit a request where an exception applies. You may complain to us and, where applicable, to Malaysia’s Personal Data Protection Commissioner or Singapore’s Personal Data Protection Commission. Account details can be updated through the portal; other requests may use the contact below.

10. Customer responsibilities and children

Business customers must have lawful authority to place personal data in kkbase, provide required notices, respect individuals’ rights, keep data accurate and avoid uploading unnecessary sensitive data. kkbase accounts are not directed to children under 18, and we do not knowingly offer accounts to them.

11. Changes

We may update this notice when practices or law change. We will publish the effective date and give reasonable notice of material changes where appropriate. A change does not authorize materially different processing that requires fresh notice or consent.

Notis Privasi Bahasa Malaysia

Ringkasan: Kami mengumpul maklumat yang diperlukan untuk membuka dan melindungi akaun, menyediakan projek kkbase dan API rekod JSON, memproses bayaran PayPal, menjawab permintaan sokongan serta mematuhi undang-undang. Kami tidak menjual data peribadi dan tidak menjamin bahawa mana-mana sistem bebas risiko sepenuhnya.

1. Pihak yang bertanggungjawab

“KKCSI”, “KKBOSS” atau “kami” ialah penyedia perkhidmatan yang dinyatakan pada rekod pembayaran, pengesahan pesanan atau invois anda. Bagi maklumat akaun dan pengebilan, kami menentukan tujuan dan cara pemprosesan. Apabila kami memproses data peribadi dalam Data Pelanggan hanya mengikut arahan pelanggan perniagaan, pelanggan tersebut biasanya menentukan tujuan dan kami bertindak sebagai penyedia perkhidmatan atau pemproses data.

2. Data yang dikumpul

• Nama, e-mel, nama organisasi, cincangan kata laluan, status akaun dan rekod penerimaan.
• Alamat IP, maklumat pelayar/peranti, pengecam sesi, cap masa, awalan dan cincangan kunci API serta log keselamatan.
• Nama projek/koleksi, rekod JSON, kandungan import CSV/JSON, snapshot manual dan konfigurasi pengguna.
• Pelan, mata wang, pesanan, invois, status bayaran dan pengecam transaksi PayPal. Kami tidak menerima butiran penuh kad atau akaun pembiayaan.
• Nama, e-mel, mesej dan sejarah tiket sokongan.

3. Sumber dan tujuan

Data diperoleh daripada anda, pengguna organisasi yang diberi kuasa, penggunaan perkhidmatan secara automatik dan penyedia seperti PayPal. Data digunakan untuk mentadbir akaun, mengesahkan pengguna, menyediakan perkhidmatan, memproses bayaran, menghantar mesej perkhidmatan/keselamatan, memberi sokongan, mencegah penyalahgunaan, mendiagnosis masalah, menyimpan rekod dan mematuhi undang-undang. Jika pemprosesan bergantung pada persetujuan, anda boleh menarik balik persetujuan dengan notis munasabah, tertakluk pada akibat yang diterangkan dan pemprosesan lain yang dibenarkan undang-undang.

4. Penzahiran

Kami boleh menzahirkan data yang perlu kepada penyedia infrastruktur, e-mel, bayaran, keselamatan dan profesional; kakitangan dan pengguna organisasi yang diberi kuasa; pengganti dalam pemindahan perniagaan sebenar; serta pihak berkuasa apabila dikehendaki atau dibenarkan undang-undang. Kami tidak menjual atau menyewakan data peribadi.

5. Lokasi dan pemindahan rentas sempadan

Persekitaran aplikasi utama kkbase kini berada di Singapura. Sesetengah penyedia, komunikasi atau operasi sokongan mungkin memproses data di negara lain. Bagi pemindahan antarabangsa, kami menggunakan langkah kontrak, organisasi atau langkah lain yang bertujuan memberikan tahap perlindungan yang dikehendaki undang-undang yang terpakai.

6. Kuki

Portal menggunakan kuki sesi selamat yang penting untuk mengekalkan log masuk dan melindungi aktiviti. Log teknikal dan kawalan had kadar juga mungkin menggunakan pengecam daripada IP atau permintaan untuk keselamatan. Jika analitik atau pemasaran pilihan ditambah, notis dan kawalan persetujuan yang diperlukan mesti dikemas kini terlebih dahulu.

7. Penyimpanan

Kami menyimpan data hanya selama diperlukan bagi tujuan di atas, akaun/perkhidmatan aktif, keselamatan, pertikaian dan keperluan undang-undang, cukai atau perakaunan. Tempoh berbeza mengikut jenis rekod. Pemadaman sistem aktif mungkin tidak serta-merta memadam salinan sandaran terlindung; salinan tersebut diasingkan dan luput mengikut kitaran biasa.

8. Keselamatan dan insiden

Kami menggunakan langkah bersesuaian seperti kawalan akses, kebenaran mengikut penyewa, cincangan kata laluan, kuki sesi selamat dan log operasi. Tiada sistem dalam talian boleh menjamin keselamatan mutlak. Kami menilai pelanggaran data dan membuat pemberitahuan apabila dikehendaki undang-undang Malaysia atau Singapura.

9. Hak anda

Tertakluk pada undang-undang dan pengecualian, anda boleh meminta akses atau pembetulan, maklumat penggunaan/penzahiran, menarik balik persetujuan, serta pemadaman atau eksport jika tersedia atau diwajibkan. Kami boleh mengesahkan identiti dan kuasa pemohon. Anda boleh mengadu kepada kami dan, jika berkenaan, Pesuruhjaya Perlindungan Data Peribadi Malaysia atau Suruhanjaya Perlindungan Data Peribadi Singapura.

10. Tanggungjawab pelanggan dan kanak-kanak

Pelanggan perniagaan mesti mempunyai kuasa yang sah untuk memasukkan data peribadi, memberikan notis yang perlu, menghormati hak individu, menjaga ketepatan data dan mengelakkan data sensitif yang tidak diperlukan. Akaun kkbase tidak ditujukan kepada individu bawah 18 tahun.

11. Perubahan

Kami boleh mengemas kini notis ini apabila amalan atau undang-undang berubah. Tarikh kuat kuasa akan diterbitkan dan notis munasabah akan diberi bagi perubahan material jika sesuai.