Privacy Policy

This notice is issued by Nexus Aurora (M) Sdn Bhd (1659159-X), a member of the Pioneer Infotech group (“Nexus Aurora”, “we”, “us”). It explains how we process personal data under the Personal Data Protection Act 2010 of Malaysia, as amended by the Personal Data Protection (Amendment) Act 2024 (the “PDPA”).

It covers personal data we receive through this website, enquiries, consultations, the IT services we deliver and NexusBot, including personal data held for us by service providers we engage. Terms such as “personal data” and “processing” have the meaning given in the PDPA.

Depending on how you deal with us, we may collect:

• Identity and contact details: name, job title, company, email address, phone number and correspondence address.
• Enquiry details: the services you are interested in, budget, timeline, project information and messages you send us.
• Account and billing records for NexusBot: account name, login email, plan and invoices.
• Service records: support tickets, system access details and logs needed to deliver contracted IT services.
• Visitor records when you come to our office.

We do not ask for identity card (MyKad) numbers or bank details through this website. Card payments for NexusBot are handled by Stripe; we never see or store your full card details.

Mostly from you: when you fill in a form, book a consultation, message us on WhatsApp, call or email us, sign up for NexusBot, sign a contract with us or visit our office. We may also receive your details from your employer or a colleague who engages us on your company’s behalf.

We use personal data to:

• reply to enquiries and prepare quotes and proposals;
• schedule and hold consultations;
• deliver, monitor and support the services you have contracted;
• create, run and bill NexusBot accounts;
• verify your identity when you make a request;
• keep records needed for security, audits and our ISO/IEC 27001 obligations;
• meet legal and regulatory requirements; and
• send you service updates and, only if you agree, news about our services. You can opt out at any time.

We process personal data with your consent, or where the PDPA allows us to without consent, for example to perform a contract with you or to comply with the law.

We share personal data only where needed for the purposes above, with:

• Pioneer Infotech group companies in Singapore that help us deliver services;
• service providers that host or process data for us: Supabase (form storage, email delivery and the NexusBot app), Hostinger (NexusBot server hosting), Anthropic (AI-assisted replies in NexusBot), Microsoft (email and Outlook Bookings), Meta (WhatsApp, Facebook Messenger and Instagram), Stripe (payments), Netlify (website hosting) and Google (web fonts);
• our professional advisers, such as auditors and lawyers; and
• government agencies, regulators or courts where the law requires it.

We do not sell or rent personal data. Service providers may use it only to provide their service to us.

Some of the parties in clause 5 store or process data outside Malaysia, including in Singapore and in the regions where our cloud providers operate. When we transfer personal data abroad, we make sure it receives protection comparable to the PDPA, through contractual safeguards or because the destination has comparable data protection law, as section 129 of the PDPA requires.

Your consent stays in place until you withdraw it. To withdraw it for some or all purposes, write to our Data Protection Officer (clause 15) with enough information for us to confirm your identity and understand what you want to stop.

We aim to act on your request within 21 days. If withdrawing consent means we can no longer provide a service to you, we will tell you before we complete the request. Withdrawal does not affect processing that the law allows without consent.

You may ask for a copy of the personal data we hold about you, ask us to correct it, or ask us to transmit it to another data controller in a commonly used format. Send your request in writing to our Data Protection Officer (clause 15).

We reply to access and correction requests within 21 days. If we cannot, we will tell you in writing, with our reasons, within that time. The PDPA allows a fee for some access requests; if one applies, we will tell you before we proceed.

We protect personal data with administrative, physical and technical measures under our ISO/IEC 27001:2022 certified information security management system, including encryption in transit, access limited to people who need it, and careful choice of service providers.

No method of transmission or storage is completely secure, so we review and improve these measures continually. If a data breach is likely to cause significant harm, we will notify the Personal Data Protection Commissioner within 72 hours and tell the people affected without undue delay, as the PDPA requires.

We rely on the personal data you give us. Please tell us when your details change so our records stay accurate and complete.

We keep personal data only for as long as we need it for the purpose it was collected for, or as long as the law requires. After that we delete it or remove anything that identifies you.

Data deletion: to have your data deleted, email our Data Protection Officer (clause 15) with the subject “Data deletion request”. A business can also disconnect a WhatsApp, Messenger or Instagram channel in NexusBot (Settings → Channels → Disconnect), which deletes that channel’s access tokens straight away, or close its NexusBot account, after which we delete its data, including data received from Meta, within 30 days. You can also remove NexusBot’s access at any time in your Facebook settings under Business Integrations.

This website does not use analytics or advertising cookies. It loads fonts from Google, which receives your IP address to deliver them.

Links to WhatsApp, Outlook Bookings and Stripe take you to services with their own privacy policies.

When we provide managed IT services or run NexusBot for a business, we may process personal data of that business’s staff and customers. In those cases we act as a data processor on our client’s instructions and under our contract with them. Questions about that data should go to the business concerned first.

Our services are for businesses and are not directed at children under 18. We do not knowingly collect their personal data.

For questions about this notice or to make any request above, contact our Data Protection Officer:

We may update this notice from time to time. The date at the top shows when it last changed, and changes take effect when posted on this page.

This notice is governed by the laws of Malaysia. It is available in English and Bahasa Malaysia; if the two versions differ, the English version prevails.