Privacy Policy

Last updated: 13 November 2026. Baca dalam Bahasa Melayu

This policy explains how Corevexis Sdn Bhd (202601001379 (1663476-D)) ("we", "us") handles personal data in MyOffice and on https://myoffice.com.my/, under the Personal Data Protection Act 2010 as amended in 2024 (PDPA).

1. Our two roles

For our customers' data we are a data processor. Companies that subscribe ("Customers") put their staff's and other people's data into MyOffice. The Customer is the data controller of that data and decides what goes in and why. We process it only to provide the service, on the Customer's instructions, under our Data Processing Agreement. If you are a Customer's employee, your employer's own privacy notice tells you how they use your data; please send requests about it to your employer, and we will help them answer.

For our own business we are a data controller. We collect personal data of the people who sign up, account owners and billing contacts, people who contact us, and visitors to our website, to run, bill, secure and support the service.

2. What is processed in MyOffice on behalf of Customers

Depending on the apps a Customer uses, this can include:

• Users: name, email, phone, position, role, approvers, password (stored only as a one-way hash), 2-step sign-in settings.
• Claims: receipts and their photos, amounts, projects, mileage trips, bank name and account number for claim payments, IC number where the claim form needs it.
• Leave: leave types, dates, reasons, balances, and supporting documents such as medical certificates. Medical certificates are sensitive personal data under the PDPA.
• Staff records: staff number, contact details, IC or passport number, gender, date of birth, nationality, department, position, manager, employment type, join and leaving dates, reasons for leaving, basic salary and notes. Only the owner, admins and HR officers the Customer chooses can see salary and IC numbers.
• Purchase requests, tasks, meetings, account documents and brand files, which may contain names and contact details of staff, suppliers and clients.
• Site diary: site records and photos, which may show people on site.
• Attendance: clock-in and clock-out times, a photo taken at that moment, and the device's location. We do not use face recognition or any other biometric processing; photos are only shown to the person and their managers.
• Activity log: who did what and when in the account, and sign-in times and IP addresses, for security and audit.

3. What we collect for ourselves and why

• Sign-up and account owner details (name, email, phone, company name and registration details): to create and run the account and tell you about it.
• Billing details (company details, packages bought, invoices, payments): to bill you and keep tax records. Card and online banking details are entered on our payment provider's page; we never see or store them.
• Messages you send us: to answer you.
• Partners (people who recommend MyOffice and earn a commission): name, email, phone, firm, what they told us in their application, bank account details for paying them, and the commissions and payments to them: to run the partner programme, pay them and keep tax records.
• Referrals: if your company signed up through a partner's link or code, we record which partner, so we can pay them a commission. We do not tell the partner which company you are: they see only how many companies signed up and paid, and the amounts. Partners never see your users, records or files.
• Website visits: our server records the IP address, browser and pages requested in standard logs for security. We also count visits to our public pages (home, sign-up, demo, sign-in and legal pages) on our own server: the page, the website or link that sent you, your country (provided by Cloudflare) and your type of device and browser. For this count we do not store your IP address and set no cookie; a visitor code made from it changes every day and cannot be used to follow you from one day to the next. Visit counts are kept for about 13 months. We do not use advertising trackers or third-party analytics.

We do not sell personal data, use it for advertising, or use Customer Data to train artificial intelligence.

4. Cookies

We use only the cookies needed for the service to work: a sign-in session cookie, and cookies that remember your language and light or dark mode. If you open a partner's link, we also set a cookie holding that partner's code for 60 days, so the partner is credited if you sign up; it holds nothing else and is not shared. We do not use advertising or tracking cookies.

5. Who we share data with

We use these service providers to run MyOffice. They process data only for us:

• SyokHost (Malaysia): servers that store all data and files and send our emails, located in Malaysia.
• Cloudflare: domain name service, secure connections and protection from attacks for our website. Web traffic passes through Cloudflare's global network on its way to our servers in Malaysia.
• ToyyibPay (Malaysia): online payments.
• Google Fonts: our public home page loads its fonts from Google, which receives the visitor's IP address. The MyOffice app itself does not.

We may also disclose data where the law requires it, for example to a court or regulator, or to protect people's safety. Where data passes through a provider outside Malaysia, we rely on the safeguards allowed by the PDPA, such as the provider's contractual and security commitments.

6. Security

Connections are encrypted (HTTPS). Passwords are stored as one-way hashes, and Customers can require 2-step sign-in. Each Customer's data is kept separate, and files are only given to signed-in people of the same company who are allowed to see them. Important actions are logged. Backups are made every night.

If a personal data breach happens, we will tell the Customers affected without delay. Where the PDPA requires it, we (or the Customer, as data controller) will notify the Personal Data Protection Commissioner within 72 hours of becoming aware of it, and the people affected where the breach is likely to cause them significant harm.

7. How long data is kept

• Customer Data: while the subscription is active, and for 90 days after it ends so the Customer can renew or export; then deleted within the following 30 days.
• Attendance photos: 12 months, then deleted (the time records stay).
• Site diary photos: 90 days after a site is marked finished, after reminders to download them. Saved site reports: 1 year.
• Backups: database backups for 14 days and file backups for 4 weeks, so deleted data disappears from backups within that time.
• Our billing records: 7 years, as tax law requires.

8. Your rights

Under the PDPA you can ask for access to your personal data and a copy of it, ask us to correct it, withdraw consent, limit how it is used, and ask for your data to be sent to another organisation where this is technically possible (data portability). For data in a Customer's account, ask the Customer, who controls it; we will help them. For data we hold for ourselves, email [email protected]. We will answer within 21 days. We may ask you to prove who you are, and may charge the fee the law allows for a copy of data.

Giving us your sign-up and billing details is needed to provide the service; without them we cannot open or bill an account.

9. Children

MyOffice is for businesses and is not meant for anyone under 18.

10. Data Protection Officer and contact

Our Data Protection Officer can be reached at [email protected].
Corevexis Sdn Bhd (202601001379 (1663476-D)), SW-03-16 Cova Square, Jalan Teknologi PJU5, Kota Damansara, 47810 Petaling Jaya, Selangor.

If you are not satisfied with our answer, you can complain to the Personal Data Protection Commissioner of Malaysia (Jabatan Perlindungan Data Peribadi).

11. Changes

We will post any change to this policy here with a new date, and email account owners about important changes.

This policy is also available in Bahasa Melayu. If the two versions differ, the English version applies.