klikAkaun Data Processing Terms

Between the organisation or company that registers ("Customer", "you") and Klik Innovations Sdn Bhd ("Klik", "we"). These terms are made under the Malaysian Personal Data Protection Act 2010 (PDPA), as amended in 2024.

Version 1.0. The effective date is shown with this document at sign-up.

Klik Innovations Sdn Bhd, SSM number 202201021984 (1467681-U). Registered address: 118G, Jalan Tiga, Batu Caves, Centrepoint, 68100 Batu Caves, Selangor.

This is the second document you accept at sign-up, after the Terms of Service. Your acceptance is recorded.

1. Roles

• You enter other people's personal data into your klikAkaun books: for example donors, payees, staff and customers. For that data, you are the data controller and Klik is the data processor.
• For your own registration and account data (applicant, signatory, users), Klik is the data user. See the Privacy Notice.

2. Scope and purposes

• Data: personal data in your books, such as names, phone numbers, addresses, bank account numbers, donation details, salaries and receipts.
• Purposes: only to provide the klikAkaun service to you. This includes storing, showing, calculating, reporting, backing up, restoring and exporting your data, support you ask for, and keeping the service secure.
• We process the data only on your instructions: your use of features in the app, written support requests and these terms.
• We do not use your data for our own purposes. We do not sell it and we do not train AI models with it.
• Duration: while your account exists, and until deletion under section 9.

3. Your duties as controller

• Make sure you have the right to enter the data, a lawful basis, and that you have given notice to the people concerned.
• Decide who in your organisation can access the data, and look after your user accounts.
• Do not enter sensitive personal data unless needed. Under the PDPA, sensitive data includes information about health, religious belief and criminal records.
• Donor or member data of a surau can show religious belief. If your books hold such data, make sure you have the clear consent of the person. Use the "donor privacy" setting to reduce what is sent to AI.

4. Our duties as processor

• Process on your instructions only.
• Make sure staff who access the data are bound by confidentiality.
• Apply the security measures in section 6.
• Use only the sub-processors in section 5 and give notice of changes.
• Help you answer access or correction requests from individuals, within reason, free of charge.
• Tell you about a data breach (section 7).
• Return and delete data at the end of the service (section 9).

5. Sub-processors

You allow us to use:

• The AI provider is your choice, not a sub-processor appointed by us. You are responsible for that provider's terms and privacy. Some free models may log prompts or use them for training. We do not send your books data to an AI provider unless you switch AI on.
• The support assistant uses Klik's own Anthropic account and receives only your question, not books data.
• Cross-border transfers (Google, WhatsApp, Anthropic): the data sent is limited to what is listed above. Backups are encrypted before they are sent. We use only services that are bound by the provider's own data-processing and security terms. By accepting these terms you are told of these transfers under section 129 of the PDPA.
• Changes to sub-processors: we give 30 days' notice by e-mail or in the app. If you object on reasonable grounds, you may cancel (see the Terms of Service).

6. Security measures

• Role-based access and separation of data between customers.
• Encryption:
• backups are encrypted (age) before leaving our server;
• AI account keys are encrypted (AES-256-GCM);
• two-step secrets, ledger connection keys and some personal data (for example donor name, phone and IC) are encrypted in the database;
• uploaded documents and statements are encrypted when stored;
• connections to the app use HTTPS.
• The database and server disks as a whole are not encrypted at rest.
• Two-step sign-in (TOTP) and passkeys that users can switch on. Re-confirmation before sensitive changes.
• Second-person approval that each company can switch on (the person who prepared an item cannot approve it).
• A hash-chained audit trail (who did what, when).
• The Klik staff console does not show the transactions in your books, only administrative information and sign-up applications.
• If we need to see your books to help you, your account owner gives "Support access": read-only, for 24 hours or 3 days. Every page viewed is recorded and you can see the log. You can withdraw the access at any time.
• Klik server administrators have technical access to the server, used only for maintenance, backups and recovery.
• Encrypted backups and restore tests.
• No system is 100% secure. This list names only controls that exist and have been tested.

7. Data breach notification

• If we learn of a breach of personal data in your books, we tell you without undue delay, and within 48 hours.
• The notice says what we know: what happened, the type of data, the estimated number of people affected, the steps taken and our advice to you.
• You, as controller, decide whether to notify the Personal Data Protection Commissioner and the people affected. We help with information.

8. Audit and information

• On reasonable written request, we give the information needed to show we follow these terms, and answer reasonable security questionnaires.
• On-site or technical audit: once a year or after a breach, with 30 days' notice, in working hours, and without affecting other customers. You pay the audit cost.
• We need not disclose other customers' data or security details that would weaken protection.

9. Return and deletion

• Export: you can export your data at any time in open formats, including while the account is locked for overdue payment.
• After the account is closed: read-only with export for 90 days, then the data is deleted. Backups expire within about 13 months.
• We confirm deletion in writing on request.
• Exceptions: we may keep data where the law requires. We also keep the terms acceptance records (7 years) and our own billing records (7 years).

10. Requests from individuals and authorities

• If an individual contacts us about data in your books, we refer them to you and do not answer for you unless you ask.
• If an authority asks for your data, we tell you first, unless the law forbids us. We disclose only what the law requires.

11. Liability, law and changes

• The limitation of liability in the Terms of Service applies to these terms.
• Malaysian law applies.
• Changes to these terms follow the changes section of the Terms of Service (30 days' notice).
• If these terms conflict with the Privacy Notice about data in your books, these terms apply.

12. Contact

Data protection contact: MUHAMAD KAMAL SELAMAT, Klik Innovations Sdn Bhd. E-mail klik.innovations@gmail.com. WhatsApp 011-1040 7107. SSM number: 202201021984 (1467681-U). Address: 118G, Jalan Tiga, Batu Caves, Centrepoint, 68100 Batu Caves, Selangor.

AI insights are information only, not licensed financial, tax or legal advice.