Privacy Policy

Introduction

Tessaract is committed to protecting the privacy and security of your personal data. This Privacy Policy explains how we collect, use, store, and protect information about you when you interact with our website, engage our services, or communicate with us.

We comply with the Personal Data Protection Act 2010 (PDPA) of Malaysia and implement appropriate technical and organizational measures to ensure data protection. By using our services or providing us with your personal data, you consent to the practices described in this policy.

For questions about this policy or our data practices, please contact us at [email protected].

Information We Collect

Personal Data You Provide

We collect information you voluntarily provide when you:

• Complete contact forms on our website (name, email address, phone number, company name, message content)
• Request consultations or assessments (business information, technical infrastructure details, organizational context)
• Engage our services through contracts (project requirements, stakeholder information, data relevant to implementations)
• Subscribe to communications (email address, communication preferences)
• Participate in surveys or feedback requests (responses, opinions, satisfaction ratings)

Information Collected Automatically

When you visit our website, we may automatically collect:

• Technical information (IP address, browser type, device information, operating system)
• Usage data (pages visited, time spent, referral sources, navigation patterns)
• Cookies and similar technologies (see our Cookie Policy for details)

Information from Third Parties

We may receive information about you from business partners, referral sources, or publicly available sources when relevant to providing our services or maintaining business relationships.

How We Use Your Information

Legal Basis for Processing

We process personal data based on:

• Consent: You have given clear consent for us to process your personal data for specific purposes
• Contract: Processing is necessary for performance of a contract with you
• Legitimate interests: Processing is necessary for our legitimate business interests, provided these do not override your rights
• Legal obligation: Processing is required to comply with legal requirements

Specific Purposes

We use your information to:

• Respond to your inquiries and provide requested information about our services
• Conduct readiness assessments and develop service proposals tailored to your needs
• Deliver consulting services, implementations, and support as contracted
• Communicate project updates, deliverables, and ongoing support
• Process payments and maintain financial records
• Send relevant updates, insights, and educational content (with consent)
• Improve our services, website functionality, and user experience
• Comply with legal obligations and protect our legal rights
• Prevent fraud, security threats, and abuse of our services

Data Sharing and Disclosure

When We Share Information

We may share your personal data with:

• Service providers: Third-party vendors who assist with website hosting, analytics, email delivery, payment processing (subject to confidentiality obligations)
• Professional advisors: Lawyers, accountants, auditors when necessary for business operations
• Business partners: Technology providers when relevant to service delivery, with appropriate data protection agreements
• Legal authorities: When required by law, regulation, legal process, or governmental request

We Do Not

We do not sell, rent, or trade your personal data to third parties for marketing purposes. We do not share client project details or proprietary information outside of authorized personnel and contracted service providers bound by confidentiality.

Data Security

We implement appropriate technical and organizational security measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. Our security practices include:

• Encryption of data in transit and at rest using industry-standard protocols
• Access controls limiting data access to authorized personnel only
• Regular security assessments and monitoring of systems
• Employee training on data protection and confidentiality requirements
• Secure development practices for custom implementations
• ISO 27001 certified information security management system

While we strive to protect your personal data, no method of transmission or storage is completely secure. We cannot guarantee absolute security but maintain rigorous practices to minimize risks.

Data Retention

We retain personal data only as long as necessary to fulfill the purposes outlined in this policy, unless a longer retention period is required or permitted by law. Specific retention periods include:

• Inquiry data: Retained for up to 2 years from last contact
• Client project data: Retained for 7 years after project completion for business records and legal compliance
• Financial records: Retained for 7 years as required by Malaysian tax law
• Marketing communications: Until you unsubscribe or request deletion
• Website analytics: Aggregated data retained for 26 months

After retention periods expire, we securely delete or anonymize personal data. Some data may be retained in backup systems for additional periods as part of disaster recovery procedures.

Your Rights

Under the PDPA and applicable data protection laws, you have the following rights:

Right to Access

You may request confirmation of whether we process your personal data and obtain a copy of the data we hold about you.

Right to Correction

You may request correction of inaccurate or incomplete personal data.

Right to Erasure

You may request deletion of your personal data in certain circumstances, subject to legal retention requirements.

Right to Withdraw Consent

Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing based on consent before withdrawal.

Right to Object

You may object to processing of your personal data for direct marketing purposes or where processing is based on legitimate interests.

Right to Data Portability

You may request to receive your personal data in a structured, commonly used format and have it transmitted to another controller.

How to Exercise Your Rights

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within 30 days. We may require verification of your identity before processing requests.

Cookies and Tracking

Our website uses cookies and similar tracking technologies to enhance user experience and analyze website usage. For detailed information about the cookies we use and your choices regarding cookies, please see our Cookie Policy.

International Data Transfers

We primarily process data within Malaysia. If personal data is transferred outside Malaysia, we ensure appropriate safeguards are in place, such as:

• Standard contractual clauses approved by relevant authorities
• Transfers to countries with adequate data protection laws
• Implementation of appropriate technical and organizational measures

Children's Privacy

Our services are not directed to individuals under 18 years of age. We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child without parental consent, we will take steps to delete such information.

Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices, legal requirements, or business operations. We will notify you of material changes by:

• Posting the updated policy on our website with a new "Last Updated" date
• Sending email notifications to registered users for significant changes
• Displaying a notice on our website for a reasonable period

Your continued use of our services after changes become effective constitutes acceptance of the updated policy.

Contact Information

For questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact: