How Kiplepay handles your personal data on this website.
This notice is issued under the Personal Data Protection Act 2010 (PDPA). It covers personal data collected through the Kiplework website, including the register interest form, the contact form and the custom-branded enquiry form, and emails you send to us. Personal data processed inside the Kiplework product on behalf of an employer is covered by the service agreement with that employer, not by this notice.
1. Who we are
The data user for the purposes of the PDPA is Kiplepay Sdn Bhd, a company incorporated in Malaysia and an issuer of electronic money approved by Bank Negara Malaysia under the Financial Services Act 2013. Kiplework is a product of Kiplepay Sdn Bhd. Our address is The Ascent Paradigm, B-23A-3, No 1, Jalan SS7/26A, Kelana Jaya, 47301 Petaling Jaya, Selangor.
In simple terms
Kiplepay is the company responsible for your data. Kiplework is our product name, not a separate company.
2. What personal data we collect
Through the register interest form we collect: your full name, work email address, telephone number (optional), job role (optional), company name, company size, state, company type (optional), number of outlets or sites (optional), current HR system (optional), the features you select, whether you want the full suite, whether you want a call, and your consent choices.
Through the contact form we collect: the topic of your message, your full name, work email address, company name (optional), telephone number (optional), your message, and your consent choices.
Through the custom-branded enquiry form we collect: the options you choose for branding, hosting and integrations, company name, company type, number of staff who would use the product, number of companies in your group, current HR or payroll system (optional), preferred go-live timing, your full name, job title, work email address, telephone number, any notes you add (optional), and your consent choices.
If you email us, for example at [email protected] or [email protected], we collect your name, email address and anything you include in your message.
Through the website generally we collect technical data such as IP address, browser type, device type, pages visited and the time of visit, through cookies and similar technologies described in section 8. When we email you, we record whether the email was delivered and opened, and which links were clicked.
We collect personal data directly from you when you fill in a form or email us, and automatically through cookies and email tracking when you use the website or read our emails. We do not buy personal data from other sources.
On the register interest form, name, work email, company name, company size and state are required. On the contact form, topic, name, work email and message are required. On the custom-branded enquiry form, all fields are required except current HR or payroll system and notes. If you do not provide the required fields we cannot register you or respond to your enquiry. All other fields are voluntary.
We do not collect sensitive personal data through this website and ask that you do not submit any.
In simple terms
We only ask for what our forms show, and fields marked optional can be skipped. We also see basic browsing data and whether you open our emails. Please do not type anything sensitive, like health or religion, into message or notes fields.
3. Why we collect it and on what basis
We process your personal data for the following purposes:
- To record and respond to your registration of interest in Kiplework, including confirming it by email and contacting you about onboarding when the product opens.
To respond to messages you send through the contact form or by email, and to scope and propose a custom-branded deployment if you ask for one.
- To call you, if you have asked us to.
- To understand which features companies want, using the selections you make, so we can plan the product. This analysis is carried out on aggregated data where practicable.
- To send you updates about Kiplework by email, only where you have ticked the separate marketing consent box. You may withdraw this consent at any time.
- To operate, secure and improve the website.
- To comply with legal and regulatory obligations that apply to Kiplepay Sdn Bhd.
We rely on your consent, given when you submit a form. We also process your data where it is necessary to respond to your enquiry, or to take steps you have asked for before entering into a contract with us.
In simple terms
We use your details to reply to you, scope what you asked for, and plan what to build. We only send marketing emails if you ticked that box, and you can stop them any time.
4. Who we share it with
We may disclose your personal data to the following classes of third parties, only to the extent needed for the purposes above:
- Service providers who host this website and store form submissions on our behalf, currently Webflow, Inc.
- Service providers we use to send email and manage enquiries. Mailgun sends our service emails, such as confirmations and replies. MailerLite sends our marketing emails, which we send only if you have ticked the marketing consent box.
Google, which provides website analytics through Google Tag Manager and Google Analytics.
Cloudflare, which delivers and protects this website and so processes visitor IP addresses.
- Companies within the Green Packet Berhad group, where needed to respond to your enquiry.
Our professional advisers and auditors, who are bound by a duty of confidentiality.
- Regulators, law enforcement or courts where required by law.
We do not sell personal data and we do not share it with third parties for their own marketing.
In simple terms
The companies that run our website, analytics and email can see your data because they have to. So can our parent group if they need to answer you, and our auditors and advisers. Nobody else, unless the law requires it. We never sell it.
5. Where it is stored and transferred
Our service providers store and process data on servers located outside Malaysia. Form submissions are stored by Webflow, our website hosting provider. Service emails are sent through Mailgun and marketing emails through MailerLite. Website analytics are processed by Google, and Cloudflare delivers and protects the website. When you submit a form, you consent to the transfer of your personal data outside Malaysia for these purposes, as permitted under section 129(3)(a) of the PDPA. For all transfers, including website analytics, we also rely on section 129(3)(f) of the PDPA: we take reasonable precautions and exercise due diligence by using only providers that commit, under their data protection terms, to protect personal data to a standard comparable to the PDPA.
In simple terms
Our website, email and analytics providers keep their servers overseas, so your data leaves Malaysia. We only use providers that commit to protect it properly.
6. How long we keep it
We keep registration data for as long as needed to respond to your interest and, where you become a customer, for the duration of that relationship. If you do not become a customer, we delete or anonymise your registration data within six months of the product launch, unless you have consented to receive updates, in which case we keep your contact details until you withdraw that consent. Messages and enquiries sent through the contact form, the custom-branded enquiry form or by email are kept for 12 months after our last contact with you, unless you become a customer. Email delivery, open and click records are kept for as long as we keep your contact details. Technical data is kept for 14 months.
In simple terms
If you register but never become a customer, we delete your details within six months of launch. Messages and enquiries are kept for 12 months after we last spoke. If you asked for updates, we keep your email until you unsubscribe.
7. Your rights
Under the PDPA you have the right to:
- Request access to the personal data we hold about you.
- Request correction of personal data that is inaccurate, incomplete, misleading or out of date.
- Withdraw consent to processing, including marketing, at any time.
- Limit the processing of your personal data, including for direct marketing.
Ask us to stop processing that is causing, or is likely to cause, substantial damage or distress to you or another person.
Request that your personal data be sent to another data user, where this is technically feasible.
To exercise any right or to make a complaint, contact our Data Protection Officer using the details in section 11. We will respond to an access or correction request within 21 days of receiving it. We may need to verify your identity before acting, and may charge the fee allowed by law for an access request. If you are not satisfied with our response, you may complain to the Personal Data Protection Commissioner.
In simple terms
You can ask what we hold, ask us to fix it, tell us to stop, or ask us to send it to another company. We reply within 21 days, after checking it is really you. If you are unhappy with our answer, you can go to the Personal Data Protection Commissioner.
8. Cookies and similar technologies
This website uses cookies that are necessary for it to function, including those set by our hosting provider for security and form handling. We also use Google Tag Manager to load Google Analytics, which sets cookies to help us count visits and understand which pages are useful. Google Analytics collects data such as pages visited, device and browser type, and approximate location. It does not store your IP address. This data is kept for 14 months. You can opt out of Google Analytics by installing the Google Analytics opt-out browser add-on at tools.google.com/dlpage/gaoptout, or by blocking cookies in your browser settings. Blocking necessary cookies may stop the register form from working.
Emails we send through Mailgun and MailerLite contain small tracking images and tracked links. These tell us whether an email was delivered and opened, and which links were clicked. We use this to confirm delivery and to improve our emails. You can block tracking images by turning off automatic image loading in your email app, and you can stop marketing emails at any time using the unsubscribe link.
In simple terms
Cookies are small files that help the site work. We use the essential ones, plus Google Analytics to count visitors. Our emails can tell us if they were opened. You can block both in your browser or email app.
9. Security
We apply administrative, technical and physical safeguards appropriate to the nature of the data, including access controls, encryption in transit and restriction of access to staff who need it. No method of transmission over the internet is completely secure and we cannot guarantee absolute security. Where a breach affects your personal data and the law requires notification, we will notify the Personal Data Protection Commissioner and, where required, you.
In simple terms
We protect your data with the usual safeguards and only let staff who need it see it. If something goes wrong and the law says we must tell you, we will.
10. Changes to this notice
We may update this notice from time to time. The version number and effective date at the top will change when we do. Where a change materially affects how we use your personal data, we will notify you by email if we hold your address.
In simple terms
If we change something important, we will email you. Small wording changes will just show a new date at the top.
11. Contact
For questions, requests or complaints about your personal data, contact:
Data Protection Officer, Kiplepay Sdn Bhd. Email: [email protected]. Postal address: The Ascent Paradigm, B-23A-3, No 1, Jalan SS7/26A, Kelana Jaya, 47301 Petaling Jaya, Selangor.
In simple terms
Questions, requests and complaints go to our Data Protection Officer. A Bahasa Malaysia version of this notice will be linked here.