Orbyte

Legal

PRIVACY POLICY

This privacy policy (“Privacy Policy”) describes how Alpha Red Pro Sdn Bhd (Registration No. 202301012895 (1506817-K)), the operator of the Orbyte platform (“Orbyte”, “we”, “us” or “our”) collects, uses, processes, shares and discloses information about a user (collectively “you”, “your” or “yours”) when you visit or interact with our website at www.orbyte.my (the “Site”), sign up for or use the Orbyte platform, web and mobile applications, modules and related services made available through the Site (the “Services”), or use other means connected to the Site (such as contacting our customer support team via chat or email).

“Personal Data” has the meaning given in the Personal Data Protection Act 2010 (as amended from time to time) (the “PDPA”) and includes any information which can be used to identify, directly or indirectly, you or from which you are identifiable. This includes but is not limited to your name, nationality, telephone number, bank and credit card details, personal interests, email address, your image, government-issued identification numbers, biometric data, race, date of birth, marital status, religion, health information, employment and attendance information, claims and expense information, and recruitment information.

Our role. Where you visit our Site, create an account, contact us or subscribe to the Services on your own behalf, we act as the “data controller” of your Personal Data under the PDPA. Where an organization (such as your employer or another business customer) subscribes to the Services and its administrators or users submit Personal Data through the Services (for example employee, leave, claim, attendance, client, job applicant and document data) (“Customer Data”), that organization is the data controller of the Customer Data and we act as its “data processor”, processing Customer Data on its behalf and in accordance with our agreement with it. If your Personal Data forms part of Customer Data, please direct your requests regarding that data to the relevant organization in the first instance; we will assist it as required by the PDPA and our agreement with it.

This Privacy Policy explains how we process your Personal Data. Where the PDPA requires your consent, we will obtain it in the manner required by law, and we may process Personal Data on another basis where permitted by the PDPA. If you do not provide Personal Data necessary for a particular feature or service, we may be unable to provide it. Nothing in this Privacy Policy limits any rights you have under the PDPA.

INFORMATION WE COLLECT

We collect Personal Data about you in the ways listed below. Unless we indicate otherwise, the Personal Data we ask for is necessary for us to provide the Site and the Services; if you do not provide it, we may be unable to create your account, provide the Services or respond to you. We may also combine the collected Personal Data with other Personal Data in our possession:

  1. We collect information about you that you voluntarily provide to us when using the Site, such as your name, company name, job title, address, phone number, email address, account log-in credentials, and billing and payment details.
  2. If you sign up or log in using a Microsoft or Google account, or if your organization connects its Microsoft Entra ID directory to the Services, we receive information from that provider, such as your name, email address, profile identifier and (for Entra ID) directory information such as your department, group membership and reporting line, in accordance with the permissions granted by you or your organization.
  3. If you use the Services through an organization's account, we process the information that you and your organization submit through the Services, which may include leave, claim (including receipts), overtime, attendance, travel, work status, project, client and directory information, documents and signatures (including signatory details and audit logs), and job applications and candidate information. We generally process this information as a data processor (see "Our role" above).
  4. When you use AI-assisted features of the Services (for example AI assistants, policy question-and-answer, receipt reading and candidate screening), we process the inputs you provide, the business information you are authorized to access and the outputs generated.
  5. When you visit our Site, we may also automatically collect certain usage information, such as your IP address, geographic data, country, search preferences related to specific searches, browser, and information about your device's operating system, application version, language settings, pages and features accessed, referring URLs, and log data. If you are using a mobile device to access our mobile app or mobile optimized Site, we might also collect information that identifies your mobile device, such as the device ID, location of the device (with your consent), and device-specific settings and characteristics. Where such usage data is maintained in a form that identifies you, we treat it as Personal Data. Where it is aggregated or anonymized so that you cannot be identified, it is not Personal Data and we may use it for analysis, statistics and to improve the Site and the Services.
  6. We collect information if you need to get in touch with our customer support team or reach out to us through other means (such as through social media or communicating with our partners).
  7. Where you submit feedback or reviews regarding the Services or other ancillary services available on our Site, we will collect information from you including your reviews, your name, your email address and/or country of residence.
  8. Where you provide us with Personal Data about other individuals (for example, when you invite colleagues or employees to use the Services, add clients or referees, or submit a request on behalf of someone else), it is your responsibility to ensure that you are authorized to do so and that the person or people you have provided Personal Data about are aware that you have done so, and have understood and accepted how Orbyte uses their information (as described in this Privacy Policy). We may ask for your assistance in obtaining their consent, and you agree to use your best endeavors to assist.
  9. Our agents, partners (including integrated partners whose solutions you or your organization choose to connect) and your organization may share information about you with us if you have questions about, or disputes arise regarding, your use of the Services or the services provided by us.
  10. Where necessary to provide the Services, we may process sensitive Personal Data (as defined in the PDPA), such as information on your physical or mental health (for example, a medical certificate attached to a leave or claim), religious beliefs or biometric data. We will do so only with your explicit consent (or that of the relevant organization, where we act as its data processor) or as otherwise permitted by the PDPA. We may also process national identity numbers (such as MyKad or passport numbers) where necessary to provide the Services or to comply with the law, and we protect them with appropriate safeguards.
  11. You are responsible for ensuring that the Personal Data you provide to us is accurate, complete and not misleading, and that it is kept up to date.

MINORS UNDER 18 YEARS OLD

Our Site and Services are not directed to minors under the age of 18, and we do not knowingly collect Personal Data from them without the consent of their parent(s) or legal guardian(s). If you are a parent or guardian and believe that a minor has provided us with Personal Data without your consent, please contact us using the details below and we will take reasonable steps to delete it.

COOKIES

Our Site and Services use and allow third parties to place cookies (session and persistent), pixels/tags, SDKs, application program interfaces ("APIs"), and other technologies (collectively, "Cookies") on our Site that collect and store certain information about you. Some of these Cookies are necessary to provide, secure, and maintain the Site to you, such as to keep you logged in while you visit our Site, while other Cookies are used to provide you with a better user experience, such as:

  • To personalize the Site by remembering information about your activities on the Site (e.g., the language you selected or your log-in details);
  • To perform website analytics, such as impression reporting, demographic reporting and interest reporting to improve our Site and services; and
  • To provide you with advertising tailored to your interests, including through third-party advertising and social media platforms (such as Google, Meta, LinkedIn and TikTok), and to measure the effectiveness of our campaigns.

Please review your Internet browser settings, typically under the sections "Help" or "Internet Options," to exercise choices you have for certain Cookies. If you disable or delete certain Cookies in your Internet browser settings, you might not be able to access or use important functions or features of this Site, and you may be required to re-enter your log-in details. Where you choose to stay signed in (for example through a "Remember me" option, where offered), we may store a log-in identifier in a persistent Cookie, which remains on your device until it expires or you delete it. Some Cookies are set by third parties (including analytics providers and social media and advertising platforms) and are governed by those third parties' own privacy policies, which we do not control.

PURPOSES

We may use, combine and process the Personal Data collected through the Site and the Services, on the basis of your consent or where otherwise permitted by the PDPA (for example, where necessary for the performance of a contract with you or to comply with a legal obligation), to:

  1. Provide you with the requested products and/or services, such as creating and managing your user account and subscription, enabling single sign-on, delivering the modules and features of the Services, processing and confirming your requests and transactions, responding and/or communicating with you about our services, your enquiries, special requests, cancellations, and/or rewards;
  2. Respond to questions, comments and feedback from you;
  3. Investigate and address concerns raised by you in relation to the products and/or services;
  4. Process subscriptions, usage-based charges, invoices, payments and related matters, and conduct business analytics;
  5. Send you marketing communications, including emails, SMS, MMS, and/or phone calls (telemarketing) about products and services that may be relevant to you. You may, however, at any time choose to opt out of these marketing communications from us pursuant to Section 11 below;
  6. Conduct surveys and market research or provide you with information about our services on our Site or on other websites you may visit;
  7. Maintain and improve the Site, tailor and enhance the user experience, and conduct internal training;
  8. Monitor, process and/or track your use of the Site in order to provide you with a seamless experience;
  9. Send you service and administrative communications, such as approvals, reminders, notifications, security alerts and updates to our terms and policies;
  10. Provide, operate and improve AI-assisted features of the Services, including generating answers, summaries and suggestions from business information you are authorized to access;
  11. Enable integrations with partner solutions and identity providers that you or your organization choose to connect;
  12. Protect the security of you and the Site, and detect, prevent and investigate fraud, misuse and security incidents;
  13. Exercise a right or comply with an obligation conferred or imposed by law, including responding to requests and legal demands;
  14. Use or disclose it in connection with mergers, acquisitions, joint ventures, sale of company assets, consolidation, restructuring, financing, business asset transactions, or acquisition of all or part of our business by another company.

(Collectively, "Purposes" or each, a "Purpose")

SHARING AND DISCLOSURE

In connection with your visit to our Site and use of our services, we may share or disclose your Personal Data as follows:

  1. With our holding company, subsidiaries and related corporations, in which case access is limited to their employees who have our permission and who need to know or have access to this Personal Data to perform the services requested by you (including customer services) or to conduct internal (audit/compliance) investigations.
  2. Third-Party Service Providers who provide data processing services to us (for example cloud hosting, identity and single sign-on services, e-signing services, AI service providers, and email and messaging delivery), or who otherwise process Personal Data for purposes such as credit card and payment processing, business analytics, customer service, marketing, or distribution of surveys, to facilitate the delivery of online services and advertising tailored to your interests, and/or fraud prevention. Our third-party service providers will only process information as needed to perform their functions. They are not permitted to share or use the information for any other Purpose.
  3. Our appointed agents, vendors, suppliers, providers, contractors and service providers (collectively "suppliers"). These suppliers may, among other things, contact you as necessary to obtain additional information about you, provide the Services or the partner solutions you request, or respond to a review you submit. Where a supplier uses your Personal Data for its own purposes, its own privacy policy applies.
  4. Your Organization – where you use the Services through an organization's account (for example your employer's), your Personal Data will be made available to that organization and its administrators, approvers and authorized users as configured on the Services (for example in leave, claim and approval workflows). That organization is responsible for its own use of your Personal Data.
  5. Business Partners with whom we may jointly offer products or services, or whose products or services may be offered on or through our Site and Services, including integrated partner solutions (such as payroll, accounting and payment providers) that you or your organization choose to connect.
  6. Where Required or Permitted by Law – such as to protect ourselves against liability, to respond to subpoenas, judicial processes, legitimate requests, warrants or equivalent by law enforcement officials or authorities, to investigate fraud or other wrongdoing or as otherwise required or necessary in order to comply with applicable law. We may also, in compliance with applicable law, disclose your information to enforce or apply the terms and conditions applicable to our services or to protect the rights, property, or safety of Orbyte, our users, or others.
  7. Business Reorganization – such as part of any sale, assignment or other transfer of our business, or transition of service to another provider. We will ask for your consent if required by applicable law.
  8. Professional Advisers – our auditors, lawyers, insurers and other professional advisers, and any other person under a duty of confidentiality to us.

TRANSFER

In connection with the Purposes described above, your Personal Data may be transferred to, processed or stored in places outside Malaysia (for example, where our cloud hosting providers, service providers or partners are located). We will transfer Personal Data outside Malaysia only where permitted by the PDPA, including where the destination has laws substantially similar to the PDPA or ensures a level of protection at least equivalent to that under the PDPA, or where another basis under the PDPA applies (such as your consent or the transfer being necessary for the performance of a contract), and we take reasonable steps, including contractual safeguards, to ensure your Personal Data remains protected. Before any such transfer, we assess whether a condition under section 129 of the PDPA applies and put in place the safeguards it requires. Where consent is the applicable basis, we will obtain it from you in the manner required by the PDPA.

RETENTION

We will retain your Personal Data for the period necessary to fulfil the Purposes outlined in this Privacy Policy, in line with our internal retention policies. When we no longer need to use your information, we will – unless we need to keep your information to comply with applicable legal or regulatory obligations or to establish, exercise or defend legal claims, resolve disputes, or prevent and investigate fraud and security incidents – remove it from our systems and records and/or take steps to properly anonymize it so that you can no longer be identified from it. In deciding how long to keep Personal Data, we consider its nature and sensitivity, the purpose for which it was collected, whether your account remains active, and applicable legal requirements, including record-keeping obligations under Malaysian tax and company laws. Where we process Customer Data as a data processor, we retain and delete it in accordance with our agreement with, and the instructions of, the relevant organization.

SECURITY MEASURES

We maintain reasonable physical, electronic, and organizational security measures to protect your Personal Data against accidental or unlawful destruction or accidental loss, alteration, or unauthorized disclosure or access. These include role-based access controls and audit trails, and we require our service providers to maintain appropriate security measures. However, no method of transmission or storage is completely secure, and you are responsible for keeping your log-in credentials confidential. If a personal data breach occurs, we will notify the Personal Data Protection Commissioner and, where the breach causes or is likely to cause significant harm, the affected individuals, as required by the PDPA.

ACCESS OR AMEND YOUR INFORMATION

You can easily correct your Personal Data such as your name and contact number at any time by signing into your account on the Site. Alternatively, please contact us by sending an email to our Data Protection Officer at privacy@orbyte.my to exercise any of the following rights:

  • Access: You are entitled at any time to obtain information about your Personal Data that we store, in accordance with applicable law, subject to a fee permitted under the PDPA for the handling and processing of your requests to access your Personal Data.
  • Rectification: You may request that we rectify any of your Personal Data that is incomplete or incorrect.
  • Deletion: You may request that we delete your Personal Data or account. We will do so unless we are required or permitted by law to retain it.
  • Restrictions of Processing: You may ask us to restrict or cease processing of your Personal Data where the PDPA gives you that right, or otherwise ask us to consider a restriction. For example, you may contact us if you object to processing and the applicable grounds are being reviewed.
  • Objection: You may object, at any time, to your Personal Data being processed by us for direct marketing purposes.
  • Right to Revoke Consent: You have the right to withdraw your consent at any time by written notice to us, without affecting the lawfulness of our processing based on such consent before it was withdrawn. Withdrawing consent may mean that we can no longer provide some or all of the Services to you.
  • Other: You may contact us about any other matters related to your Personal Data.

To protect your privacy and security, we will verify your identity before responding to any request under this Section or Section 10, and we will respond within 21 days of receipt (or such other period as the PDPA requires or permits). In some cases we may not be able to give you access to certain Personal Data, for example where it is connected with the Personal Data of other persons, or for legal reasons; if so, we will explain why. We may also decline a request for deletion or rectification where the law requires us to keep the data, for example for accounting, claims processing, fraud detection or prevention, or mandatory retention purposes.

DATA PORTABILITY

Subject to the PDPA, you may request that we transmit the Personal Data that we hold about you directly to another data controller of your choice, provided that this is technically feasible and the data format is compatible. Where practicable, we will provide the data in a structured, commonly used and machine-readable format.

OPT OUT OF MARKETING COMMUNICATIONS

If you no longer wish to receive marketing or promotional communications from us, please click the unsubscribe link in the relevant email or message. Alternatively, you may also contact us by sending an email to privacy@orbyte.my to opt out.

UPDATES TO PRIVACY POLICY

On occasion, we may revise this Privacy Policy to reflect changes in the law, our information collection and use practices, the features of our Site, or advances in technology. If we make revisions that change the way we collect or use your Personal Data, those changes will be posted in this Privacy Policy and the "Last Updated" date at the beginning of this Privacy Policy will be revised. Therefore, you should review this Privacy Policy periodically so that you are up to date on our most current policies and practices. Before any material change takes effect, we will notify you by posting a prominent notice on the Site and, where appropriate, by email or in-app notification, and we will ask for your consent where the PDPA requires it. Your continued use of the Site or the Services after a revision takes effect means the revised Privacy Policy will apply to you, but it does not replace any consent that the PDPA requires us to obtain.

CONTACT US

If you have any queries about your Personal Data, please contact our Data Protection Officer at:

Email: privacy@orbyte.my

Company: Alpha Red Pro Sdn Bhd (Registration No. 202301012895 (1506817-K))

Address: 5th Floor, Block D, Kelana Square, 17 Jalan SS 7/26, Kelana Jaya, 47301 Petaling Jaya, Selangor, Malaysia.

This Privacy Policy was originally drawn up in the English language. Translations in other languages may be available for your convenience. In case of conflict between the English language version and a translated version, the English language version shall prevail. This Privacy Policy is governed by the laws of Malaysia.