Privacy notice.

This privacy notice explains how Tao Web Services Sdn Bhd (SSM: 202101040786 / 1441086-M, "we", "us") collects, uses, stores, shares and protects personal data when you visit taowebservices.com or interact with us via our contact forms, email or phone. It's written to comply with Malaysia's Personal Data Protection Act 2010 (Act 709) as amended in 2024.

If you'd rather read a shorter summary: we collect very little data, we don't sell it, we use Google Analytics for usage stats, and you can email us anytime to ask what we hold or to delete it.

1. Who we are

Tao Web Services Sdn Bhd
Reg No: 202101040786 (1441086-M)
10, Jalan PJS 11/18, Bandar Sunway, 47500 Petaling Jaya, Selangor, Malaysia
Email: admin@taowebsystems.com
Phone / WhatsApp: +60 12-396 9338

For any privacy or data-protection matter, contact our Data Protection Officer at the same address, or email admin@taowebsystems.com with "PDPA Request" in the subject line.

2. What personal data we collect

When	What we collect	Why
Contact form	Name, email, phone (optional), company (optional), message content, service of interest	To respond to your inquiry, scope work, and follow up on the project
Lead magnet form (AI Readiness Checklist)	Name, email, company (optional)	To send the resource and related follow-ups
Any page visit	IP address, browser type, pages viewed, time spent, referrer, device type (via Google Analytics 4 — only if you consent to analytics cookies)	Understanding which content is useful; measuring how people find us
Email you send us directly	Name, email, anything you include in the email	To respond to your message

3. Legal basis for processing

We process your personal data under one or more of these PDPA bases:

• Consent — you ticked a box on our contact or lead-magnet form, or you accepted analytics cookies on the banner.
• Contract / pre-contract necessity — processing is necessary to respond to your inquiry or deliver the service you asked for.
• Legitimate interest — for basic site operation (security logs, anti-spam, error monitoring) where your rights don't override these interests.

4. Who we share your data with

We don't sell your data. We share it only with these categories of service providers who help us operate the site and our business:

• Form handling: Web3Forms processes contact and lead-magnet form submissions on our behalf. Data is encrypted in transit.
• Email: Our business email is hosted by a reputable provider with encryption in transit and at rest.
• Analytics: Google Analytics 4 (Google LLC) — only loaded if you consent. We use IP anonymization and data-retention settings set to 14 months.
• Hosting: Our website runs on a VPS in Hostinger's Singapore data centre; Hostinger processes server logs on our behalf as a data processor.
• Project delivery partners: when you engage us, we may integrate with or share relevant data with tools like Bukku, Shopify, WhatsApp Business API, etc., strictly for the purpose of your project and with your prior instruction.
• Authorities: we disclose data if legally compelled by Malaysian authorities.

5. International data transfers

Some of our service providers (Google, Web3Forms) may process data outside Malaysia. Under PDPA's data transfer requirements, we only use providers that have appropriate safeguards (standard contractual clauses, encryption, adequacy decisions where applicable). If you object to international transfer of your data, email us and we'll explain what limited processing is possible without it.

6. How long we keep data

• Contact form submissions: up to 3 years from last interaction, then deleted unless you've become a client (in which case we keep business records per SSM requirements).
• Lead-magnet signups: until you unsubscribe, then deleted within 30 days.
• Analytics data: 14 months (Google Analytics 4 default retention, set by us).
• Client business records: 7 years per Malaysian statutory requirements.
• Server logs: 30 days.

7. Your rights under PDPA

You have the following rights in relation to your personal data. To exercise any of them, email admin@taowebsystems.com with "PDPA Request" in the subject line. We respond within 21 days (the PDPA statutory period).

• Right to access — request a copy of the personal data we hold about you.
• Right to correct — ask us to fix inaccurate or outdated data.
• Right to withdraw consent — revoke any consent you previously gave (e.g., for marketing emails or analytics).
• Right to limit processing — request we stop processing your data for certain purposes (e.g., direct marketing).
• Right to data portability (new under 2024 amendments) — request your data in a machine-readable format, to transfer to another provider.
• Right to complain to the Personal Data Protection Commissioner (JPDP) if you believe your rights have been breached.

8. Cookies & similar technologies

Our site uses a minimal set of cookies and similar storage:

• Essential cookies — a single preference cookie that remembers your cookie-consent choice. Cannot be disabled.
• Analytics cookies (Google Analytics 4) — only loaded if you accept. Tracks page views, device, referrer. Never contains your name or email.
• No marketing or advertising cookies are used on this site.

You can change your consent at any time by clicking "Cookie preferences" in the site footer.

9. Data security

We take reasonable technical and organisational measures to protect your data:

• HTTPS (TLS) encryption on all pages and form submissions.
• Our VPS is secured with SSH key authentication, a firewall, regular OS patching, and fail2ban for intrusion detection.
• Admin access is 2FA-protected where the underlying tool supports it.
• Encrypted off-site backups.
• A limited, named list of people (our small senior team) have access to client data.

10. Breach notification

If we suffer a personal-data breach likely to cause significant harm to you, we will notify the Personal Data Protection Commissioner within 72 hours and you directly, as required by the 2024 PDPA amendments. We will tell you what happened, what data was affected, and what we're doing about it.

11. Changes to this notice

We may update this notice if our practices change, we add new services, or the law changes. Material changes will be communicated via a notice on the site, or by email if we have your address. The "Last updated" date at the top always reflects the current version.

12. Questions

Email admin@taowebsystems.com — we read and respond to every PDPA-related email within one business day.