Data Processing Agreement

Last updated: 13 November 2026

This Data Processing Agreement ("DPA") is part of the Terms of Service between Corevexis Sdn Bhd (202601001379 (1663476-D)) ("Processor", "we") and the Customer that uses MyOffice ("Controller", "you"). It applies to personal data that you or your users put into MyOffice ("Customer Personal Data"). Words such as "personal data", "sensitive personal data", "data controller", "data processor" and "processing" have the meanings given in the Personal Data Protection Act 2010 as amended (PDPA).

1. Roles

You are the data controller of Customer Personal Data and decide why and how it is processed. We are your data processor and process it only on your behalf.

2. Details of the processing

• Purpose: providing, securing, supporting and backing up MyOffice for you.
• Duration: while you use MyOffice, and afterwards until the data is deleted as set out in section 9.
• People concerned: your staff, contractors and site workers, and people named in your records such as suppliers, clients and visitors.
• Kinds of data: the data listed in section 2 of our Privacy Policy, which can include identity numbers, bank details, salaries, photos, locations and, where you attach them to leave, medical certificates (sensitive personal data).

3. Your instructions

We process Customer Personal Data only on your documented instructions. The Terms, this DPA and the way you and your users set up and use MyOffice are your instructions. We will tell you if we believe an instruction breaks the PDPA. We may also process data where Malaysian law requires it; if so we will tell you first unless the law forbids it.

4. Your responsibilities

You are responsible for having a lawful basis for the data you put in, for giving your staff and other people the notices the PDPA requires, for getting explicit consent where needed (for example for medical certificates and attendance photos and locations), for the accuracy of the data, and for deciding who in your company can see it.

5. Confidentiality

We make sure that our staff and contractors who can access Customer Personal Data are bound to keep it confidential and access it only when needed to run or support the service, or when you ask us to.

6. Security

We keep appropriate technical and organisational measures in place, including: encrypted connections (HTTPS); passwords stored as one-way hashes; optional 2-step sign-in that you can make compulsory; separation of each customer's data; files served only to signed-in users of the same company who are allowed to see them; role-based access, including restricting salaries and IC numbers to the people you choose; an activity log of important actions; protection against repeated wrong passwords; nightly database backups and weekly file backups; and keeping our software up to date.

7. Sub-processors

You agree that we use these sub-processors: SyokHost (hosting and email sending, Malaysia), Cloudflare (domain name service, secure connections and protection from attacks; global network), and ToyyibPay (online payments for our own billing). We make sure each sub-processor is bound to protect the data at least as well as this DPA requires. We will tell account owners by email at least 30 days before adding or replacing a sub-processor that will process Customer Personal Data. If you object on reasonable data protection grounds and we cannot resolve it, you may end the agreement and we will refund the unused part of your paid period.

8. Helping you

MyOffice lets you find, correct, export and delete records yourself. If you need more help to answer a request from a person exercising their PDPA rights, to carry out a data protection assessment, or to deal with the Commissioner, we will help you within reason. If a person contacts us directly about data in your account, we will pass the request to you and not answer it ourselves unless you ask us to.

9. Personal data breaches

If we become aware of a breach affecting Customer Personal Data, we will tell the account owner without undue delay, and in any case within 48 hours, so that you can meet the PDPA deadline of 72 hours for notifying the Commissioner. We will tell you what happened, the data and people likely affected, the likely consequences, and what we have done and recommend. We will keep you updated and take reasonable steps to contain the breach and prevent it happening again.

10. Deletion and return

You can export your records and download your files at any time. When your subscription ends, we keep Customer Personal Data for 90 days so you can renew or export it, then delete it within the following 30 days, unless you ask in writing for earlier deletion or the law requires us to keep it. Deleted data disappears from our backups within 4 weeks.

11. Information and audits

On request we will give you the information reasonably needed to show that we meet this DPA, such as answers to a security questionnaire, once a year or after a breach. Any on-site audit needs 30 days' notice, is at your cost, and must not see other customers' data.

12. Transfers outside Malaysia

Customer Personal Data is stored on servers in Malaysia. Web traffic passes through Cloudflare's global network on the way to those servers. We transfer data outside Malaysia only as allowed by the PDPA.

13. General

This DPA lasts as long as we process Customer Personal Data for you. If it conflicts with the Terms about personal data, this DPA applies. The liability limits in the Terms apply to this DPA. Malaysian law governs it.

14. Contact

Data Protection Officer: [email protected]
Corevexis Sdn Bhd (202601001379 (1663476-D)), SW-03-16 Cova Square, Jalan Teknologi PJU5, Kota Damansara, 47810 Petaling Jaya, Selangor