Privacy Policy

1. Regulatory Notice & Scope

Kryz Payment Terminal ("we", "our", or "us") respects your privacy and is committed to protecting your personal data in accordance with the Personal Data Protection Act 2010 ("PDPA 2010") of Malaysia. This Privacy Notice explains how we collect, use, process, disclose, and safeguard personal and business data when you access or interact with our services.

2. Information We Collect

In operating the gateway and merchant portal, we process the following categories of data:

• Merchant Identity & Contact: Work email address, company or project name, and WhatsApp contact phone number.
• Authentication Data: Cryptographically salted password hashes (Argon2id/SHA-256) and temporary session cookies. We never store or transmit plaintext passwords.
• Settlement Information: Beneficiary bank name, bank account number, account holder name, or registered Touch 'n Go eWallet phone number provided for withdrawal processing.
• Transaction Logs & Metadata: Payment amounts, unique sen offsets, order references, customer names as extracted from incoming device notifications, timestamps, and IP addresses.

3. Purpose of Data Processing

Your information is processed strictly for the following purposes:

• Facilitating the automated matching of incoming TNG transfer notifications to open merchant orders.
• Generating and securely delivering signed cryptographic HMAC-SHA256 webhook notifications to your backend server.
• Maintaining an accurate financial ledger and processing withdrawal requests to your DuitNow or TNG account.
• Detecting, preventing, and investigating potential fraud, unauthorized access, or abusive API activity.
• Complying with applicable statutory and regulatory obligations under Malaysian law.

4. Disclosure of Personal Data & Third Parties

We never sell, lease, or monetize your personal or transaction data to third-party advertisers or data brokers.

Data may only be disclosed under the following strictly limited circumstances:

• To financial institutions or banking networks solely to execute your requested balance withdrawals.
• When compelled by court orders, lawful subpoenas, or regulatory directives issued by Malaysian law enforcement or judicial bodies.
• To investigate potential fraud or severe violations of our Terms of Service.

5. Security Safeguards & Retention

We employ robust technical and organizational security controls to protect your data against unauthorized access, loss, or disclosure:

• Encryption: All network communications are enforced over TLS 1.3 / HTTPS. Sensitive credentials and API keys are hashed at rest.
• No-Cache Controls: Authenticated dashboard pages strictly emit no-store, no-cache headers to prevent browser caching on shared or mobile devices.
• Data Retention: Financial transaction records are retained for auditing and accounting integrity. Merchant profile data is deleted upon verified account closure and final ledger settlement.

6. Your Rights Under PDPA 2010

Under the Malaysian PDPA 2010, you have the following rights regarding your personal data:

• Right of Access: You may request access to the personal data we hold about you.
• Right of Correction: You may request correction or updating of any inaccurate or incomplete personal information.
• Right to Withdraw Consent: You may withdraw your consent for future processing, subject to contractual and legal retention obligations.

7. Contacting Our Data Officer

To exercise your PDPA rights or inquire about our data privacy practices, contact us via WhatsApp at +60 13-734 5871 (60137345871) with your registered merchant email.