Personal data protection notice

Data controller: DataFlux Consulting (registered business, sole proprietorship), 83,Jalan Gaya, 88000 Kota Kinabalu, Malaysia. SSM registration 202103156789.

Data Protection Officer: Hafiz Rahman bin Ismail — contact info@dataflux.digital (same channel as general inquiries).

This notice is issued under the Personal Data Protection Act 2010 (Act 709) as amended in 2024, including obligations effective from 1 June 2025 regarding Data Protection Officers and breach notification.

Personal data we collect

• Inquiry form: name, email, optional phone, and message content you submit voluntarily. Submissions are sent as JSON to the same-domain endpoint /api/inquiry for staff to respond; they are not used for marketing lists.
• Cookie preference: a single value stored locally in your browser (see Cookies).
• Server logs: our hosting provider may process technical connection data; we do not use those logs for profiling or advertising.

We do not run analytics pixels, advertising tags, or third-party trackers on this website.

Purposes and legal basis

We process inquiry data to respond to your request, prepare quotations, and perform pre-contract steps at your initiative. Consent preferences are stored to honour your choice about non-essential storage. Processing is limited to what is adequate and relevant for these purposes (PDPA general principle of processing).

Disclosure

Inquiry content is accessed only by authorised staff of DataFlux Consulting and secure infrastructure used to deliver email to info@dataflux.digital. We do not sell personal data. Processors (such as email or hosting vendors) are engaged under confidentiality and security obligations appropriate to the data.

Retention

Inquiry records are kept up to twenty-four months after the last meaningful correspondence unless a longer period is required for tax or dispute records. Consent preference strings remain until you clear site data in your browser or change your choice via the banner.

Security

We use TLS for site transport, restrict administrative access, and avoid storing card data on this site (payments are invoiced separately when applicable).

Data subject rights

You may request access to, correction of, or limitation on our processing of your personal data, and — where the amended Act applies — data portability for data you provided in a structured, commonly used format. Contact the DPO at info@dataflux.digital. You may also refer matters to the Personal Data Protection Commissioner of Malaysia.

Data breaches

If a personal data breach occurs, we will notify the Commissioner as soon as practicable where required, and affected individuals when significant harm is likely, in line with section 12B of the amended Act.

Cross-border transfers

If you contact us from outside Malaysia, your data may be processed on systems located in Malaysia or jurisdictions where our processors operate. We ensure appropriate safeguards consistent with PDPA requirements.

Updates

We may revise this notice when laws or our practices change. Material changes will be posted on this page with an updated review date.

Last reviewed: 23 October 2026.