Privacy Policy.

This Privacy Policy explains how TheManager (“we”, “us”, or “our”), operated by The Managers PLT (LLP Registration No. 202604002475 (LLP0047719-LGN)), collects, uses, stores, discloses, and protects personal data in compliance with Malaysia's Personal Data Protection Act 2010 (PDPA), as amended by the Personal Data Protection (Amendment) Act 2024, and applicable data protection regulations.

This Privacy Policy applies to personal data processed through themanagers.app and related subdomains, platforms, APIs, applications, and customer portal services (collectively, the “Platform”), including all enterprise modules: Human Resources, Finance & Payroll, Procurement, Cooperative Management, Ar-Rahnu, Gold & Silver Savings, Asset Management, Budgeting, Energy Management, E-Commerce, Travel & Tourism, and Nutritionist Services.

It covers two distinct categories of data subjects:

• Direct users & website visitors: individuals browsing our corporate website, subscribing to communications, requesting product demonstrations, or managing direct commercial billing relationships with us.
• Tenant end-users: employees, contractors, cooperative members, customers, or individuals whose information is submitted to, generated within, or processed through the Platform by our enterprise clients (“Tenants”).

The categories of personal data collected depend on the specific modules and platform capabilities activated by the Tenant:

• Identity & demographic data: full legal name, National Registration Identity Card (NRIC) number, passport number, identity document images, date of birth, gender, nationality, and citizenship or Bumiputera status (where required for statutory compliance or cooperative reporting).
• Contact data: residential address, billing address, business email address, personal email address, and telephone numbers.
• Employment & workplace data: employment history, job title, department, tax identification numbers, statutory fund identifiers (EPF, SOCSO, EIS), wage structures, and dependent details for statutory declarations.
• Financial & transaction data: bank account numbers, salary disbursements, cooperative shares, dividend histories, Ar-Rahnu collateral and pledge valuations, and Gold & Silver physical/digital holdings.
• eKYC & verification data: identity credentials, live facial extraction records, and verification statuses collected for regulated modules.
• Geofencing & timekeeping data: precise or approximate GPS coordinates captured strictly upon clock-in/out events where location-based attendance tracking is explicitly enabled by the Tenant.
• Authentication & technical data: WebAuthn/FIDO2 passkey credentials (public keys only; raw biometric data never leaves your device), IP addresses, browser types, audit event metadata, and session identifiers.
• Health & wellness data: dietary logs, physical metrics, and nutritional records (processed strictly within the Nutritionist module).

Personal data is collected, handled, and processed for the following specified operational and business purposes:

• Delivering, maintaining, and supporting the specific business modules activated by the Tenant (including HR, Payroll, Accounting, Cooperative Management, Ar-Rahnu, and Asset Management).
• Executing automated payroll distributions, statutory withholdings, and generating mandatory tax and regulatory filings (including LHDN, EPF, SOCSO, and EIS).
• Facilitating eKYC identity verification and statutory compliance across regulated financial workflows.
• Verifying workforce attendance records through configured, geofenced parameters when location-based tracking features are enabled by the Tenant.
• Providing technical support, responding to inquiries, and managing enterprise client relationships.
• Administering subscription billing, issuing overdue-payment notices, resolving billing disputes, and establishing, exercising, or defending legal claims to recover overdue amounts and any lawful late-payment charges or recovery costs. For these purposes we use only relevant billing-contact details, subscription agreements, invoices, payment records, and related correspondence, where permitted by applicable law.
• Enforcing platform security, generating audit logs, detecting anomalies, and preventing unauthorized or fraudulent access.

Payment deadlines, late-payment charges, recovery costs, and payment-related suspension are governed by Section 04 of our Terms of Service and your agreed subscription package or order form. This Privacy Policy does not impose separate charges or a different payment or suspension deadline.

Managers Artificial Intelligence (MAi) governance: to streamline data entry, optical character recognition (OCR), document parsing, and business logic execution, the Platform utilizes Managers Artificial Intelligence (MAi). The operation of MAi is subject to the following principles:

• Zero public model training: customer records, business documentation, uploaded receipts, identity credentials, and end-user data processed by MAi are never used to train, retrain, or improve public AI models or shared commercial foundation models.
• Ephemeral & isolated processing: data processed by MAi runs within secure, tenant-isolated execution environments. Data is retained only for the duration required to complete the specific automated extraction or processing task and is never cached for secondary use.
• Human-in-the-loop verification: extracted data and automated recommendations produced by MAi are designed to be reviewed, verified, and confirmed by authorized Tenant personnel before being committed as permanent ledger or operational records.

TheManager does not sell, lease, monetize, or trade personal data to third parties for independent marketing or advertising purposes. We disclose data solely to authorized sub-processors and external entities necessary to operate the Platform:

• Cloud infrastructure & networking: Tier-1 enterprise cloud infrastructure, managed database systems, and content delivery/DDoS mitigation networks (including Amazon Web Services, Google Cloud Platform, and Cloudflare) operating under enterprise data processing terms.
• Intelligent processing (MAi framework): cloud-hosted computational environments supporting MAi, bounded by strict zero-retention, non-training, and encrypted transmission commitments.
• Payment & financial gateways: licensed payment processors and settlement facilitators (including Stripe, Billplz, and ToyyibPay) to process transaction settlements and billing.
• Legal advisers & debt-recovery providers: where necessary and permitted by applicable law, we may disclose relevant billing-contact details, subscription agreements, invoices, payment records, and related correspondence to appointed solicitors, debt-collection providers, or competent courts for overdue-payment recovery or related legal claims. Disclosure is limited to information necessary for that purpose; unrelated tenant workspace records are not disclosed for debt recovery. Appointed service providers are subject to confidentiality and data-protection obligations.
• Travel & hospitality services: global distribution systems and travel inventory aggregators (including Amadeus and Duffel), strictly when the Travel & Tourism module is provisioned by the Tenant.
• Regulatory & statutory authorities: government departments, statutory bodies, and enforcement agencies (such as LHDN, KWSP/EPF, PERKESO/SOCSO, Suruhanjaya Koperasi Malaysia, and Bank Negara Malaysia) solely where disclosure is mandated by Malaysian law or explicitly authorized by the Tenant.

All external service providers and sub-processors are bound by confidentiality obligations and are contractually required to implement technical and organizational security controls consistent with the PDPA.

Personal data is retained only for as long as necessary to fulfill the purposes for which it was collected, or to comply with statutory retention mandates:

• Employment & statutory payroll records: retained for a minimum of seven (7) years following the financial year to which they relate, in compliance with the Employment Act 1955, the Income Tax Act 1967, and statutory fund guidelines.
• Payslip verification logs: maintained for seven (7) years to preserve audit chains for financial institutions and historical dispute resolution.
• Financial & cooperative records: maintained for seven (7) years in accordance with statutory accounting and audit regulations.
• Session & temporary files: cleared automatically upon transaction completion or cached for a maximum rolling window of thirty (30) days.

Upon contract termination or expiry of the statutory retention period, Tenant data is exported to the client organization and permanently erased from active production databases and backup archives in accordance with secure deletion standards.

Subject to verification and statutory limitations under the PDPA and the 2024 Amendment Act, individuals possess the following rights:

• Right of access: request a copy of the personal data held about you.
• Right to correction: request correction of inaccurate, incomplete, or outdated personal data.
• Right to withdraw consent: revoke previously granted consent for specific processing workflows.
• Right to limit processing: restrict processing where data accuracy is contested or processing grounds are disputed.
• Right to data portability: request transfer of your personal data in a structured, commonly used, and machine-readable format to another data user, subject to regulatory technical guidelines.
• Right to prevent processing: object to processing likely to cause unwarranted substantial damage or distress.

How to exercise your rights: if your data is processed on behalf of an employer or organization using TheManager, please submit your request directly to your organization's system administrator. For personal data submitted directly to TheManager (e.g., website inquiries, direct enterprise accounts), submit requests to privacy@themanagers.app.

In compliance with the mandatory breach notification requirements under the Personal Data Protection (Amendment) Act 2024:

• Regulatory notification: where TheManager discovers an incident affecting personal data that has caused or is likely to cause significant harm, we will notify the Personal Data Protection Commissioner (Jabatan Perlindungan Data Peribadi / JPDP) within seventy-two (72) hours of becoming aware of the incident.
• Tenant & Data User notification: when acting as a Data Processor, TheManager will notify affected Tenant organizations without undue delay (within 24 to 48 hours) upon discovering a confirmed security incident, providing relevant details, impacted data scopes, and mitigation measures so Tenants can fulfill their statutory notification duties.
• Data subject notification: affected individuals will be notified without unnecessary delay whenever a breach presents a high risk of adverse impact to their rights and freedoms.

The Platform is an enterprise business software suite not intended for use by persons under eighteen (18) years of age. Where Tenant organizations record dependent data (such as children's names and identification for tax or health benefit declarations), such records are processed strictly under the directive and lawful responsibility of the employing Tenant organization.

For questions, feedback, or requests regarding this Privacy Policy or our security architecture, contact us via:

Data Protection & Legal Team: privacy@themanagers.app
Support & Sales Inquiries: themanagers.app/contact
Registered Address: The Managers PLT (202604002475 / LLP0047719-LGN), Cyber 10, 63000 Cyberjaya, Selangor, Malaysia