Privacy Policy

Under Malaysia's Personal Data Protection Act 2010, as amended ("PDPA"), a customer organisation that keeps records of its members, donors, devotees or beneficiaries in BizCARE CRM is the "data user" for that data — it decides what is collected and why. BizCARE CRM processes that data on the customer organisation's instructions, as their data processor.

If you are a member, donor or other contact of an organisation that uses BizCARE CRM, your relationship for data-protection purposes is with that organisation, not with us directly. We describe further down how we still help with access and correction requests.

For BizCARE's own customers — the organisation's account holders and administrators — we are the data user for the account and billing information described below.

Account and billing data: the name, email address, phone number and organisation details of the people who sign up for and administer a BizCARE CRM account. This comes directly from the account holder.

Customer records: whatever a customer organisation enters or imports into their BizCARE CRM workspace — for example member profiles, donor records, memorial tablet registrations, genealogy entries, or WhatsApp Outreach conversation logs. This data comes from the customer organisation, or from the public forms and public sites some modules publish (a memorial claim, a membership application, a devotee sign-in).

Technical data: session cookies, IP address and basic request logs, collected automatically to keep the service secure and working.

To provide the CRM service the customer organisation has signed up for: storing and displaying their records, running the modules they have enabled, and publishing any public site those modules include.

To send WhatsApp messages through the WhatsApp Business Platform, but only for a customer organisation that has enabled the Outreach module and only to the contacts and templates they configure.

To provide support, prepare quotations and invoices, and keep the service secure.

To meet our own legal and regulatory obligations.

BizCARE CRM runs on Cloudflare Workers and stores data in Neon PostgreSQL. Both providers operate global infrastructure, so data may be processed on servers located outside Malaysia. We select providers that maintain recognised security and data-protection standards, and we keep each customer organisation's data logically separated by organisation.

Traffic to crm.bizcare.my is encrypted in transit. Access to customer data inside BizCARE CRM is controlled by the roles and permissions each customer organisation sets for its own staff.

We use only the cookies needed to keep you signed in and your session secure. We do not use advertising cookies, and we do not run third-party analytics or ad-tracking scripts on crm.bizcare.my.

Cloudflare — hosting, content delivery and the application runtime.

Neon — the PostgreSQL database that stores customer records.

Meta (WhatsApp Business Platform) — message delivery, only for a customer organisation that has enabled the Outreach module.

We do not use a third-party payment processor: fees are invoiced and paid outside the product, per each customer's quotation.

We keep a customer organisation's data for as long as their account is active. After an account is closed, we retain the data for a reasonable period to allow the organisation to request an export and to meet our own legal and backup obligations, then delete it.

Under the PDPA, you may request access to, or correction of, personal data held about you, and in some circumstances withdraw consent to its processing or lodge a complaint.

If your data is held by a customer organisation using BizCARE CRM (for example, you are one of their members or donors), please make your request to that organisation first — they are the data user and can act on it directly in their own records; we assist them where needed.

If you are a BizCARE account holder, contact us directly using the details at the bottom of this page.

BizCARE CRM is not directed at children. Some modules — for example alumni or membership registers — may hold data about a minor, submitted by a parent, guardian or the customer organisation itself. The customer organisation is responsible for obtaining any consent required under applicable law before submitting such data.

If we become aware of a personal data breach affecting a customer organisation's data, we will notify that organisation without undue delay and assist them in meeting any notification obligations they have to the affected individuals or the authorities.

We may update this policy from time to time. The "last updated" date at the top of this page shows when it last changed. Where a change is material, we will notify customer organisations directly.

Questions about this policy, or a data access or correction request for a BizCARE account, can be sent to bizcare.my@gmail.com.