Privacy Policy
Last updated: Aug 12, 2026
Jom System Sdn Bhd (1515190-T) ("Jom System", "we", "us" or "our") provides Business Management System ("Jom BMS"), a cloud-based business management platform. This Privacy Policy explains what information we collect or process, why we use it, how we protect and share it, and the privacy rights that may apply.
We handle Personal Data in accordance with Malaysia's Personal Data Protection Act 2010 (Act 709), as amended from time to time (the "PDPA"), and other applicable privacy laws.
Scope
This Privacy Policy applies to Jom BMS websites, hosted applications, mobile or device access where available, APIs, integrations, support services, service communications and related features (collectively, the "Services").
It applies to representatives and authorised users of organisations that subscribe to or evaluate the Services, visitors to our websites, people who contact us, and individuals whose Personal Data is entered into or otherwise processed through Jom BMS.
Jom BMS is principally a business-to-business service. Customers may use Jom BMS to manage information relating to employees, customers, leads, suppliers, creditors, debtors, riders, warranty claimants and other individuals. A Customer may have its own privacy notice and legal obligations. This Privacy Policy does not replace the Customer's privacy notice or authorise unlawful collection or use of Personal Data.
Our Role When Processing Personal Data
Personal Data means information relating directly or indirectly to an identified or identifiable individual, including information treated as personal data or sensitive personal data under applicable law.
For Personal Data we collect for our own account management, contracting, billing, support, security, service analytics and business communications, Jom System generally acts as a data controller.
For data submitted to, stored in, generated through or otherwise processed using Jom BMS by or for a Customer ("Customer Data"), the Customer generally acts as the data controller and Jom System generally acts as its data processor. We process Customer Data to provide the Services in accordance with the Customer's lawful instructions, our agreement and applicable law. Our role may vary where the circumstances or law require a different allocation.
Information We Collect
The information we collect or process depends on the features selected, the Customer's configuration and how an individual interacts with Jom BMS. It may include:
- Account and contact information, such as name, username, business email address, telephone number, profile information, role, permissions, account status and authentication or login information.
- Organisation and subscription information, such as company name, registration and tax details, business and billing addresses, branches, subscription plan, authorised contacts, invoices, payments and account-administration records.
- Customer Data processed through enabled modules, which may include accounting and transaction records; e-invoice and tax information; inventory and product information; employee and HR records; customer, lead and CRM information; POS and order records; delivery and task information; asset and warranty records; communications; and data exchanged through integrations or APIs.
- Device, usage and technical information, such as IP address, browser and operating system, device or session information, feature usage, timestamps, audit trails, API activity, error reports, crash data and diagnostic or performance information.
- Support and communications information, such as support enquiries, correspondence, feedback, attachments, troubleshooting information and communication preferences.
- Information received from Customers, Authorised Users, referral sources, payment providers, connected services, implementation partners, public sources or other third parties where permitted by law.
Not every category applies to every Customer. Customers should avoid entering sensitive Personal Data unless it is necessary, lawful and appropriately protected.
How We Obtain Information
We obtain information directly from individuals when they register, sign in, update a profile, contact support, purchase or administer a subscription, submit feedback or otherwise interact with us.
We obtain Customer Data when Customers or their Authorised Users enter, upload, import, generate, synchronise or transmit information through Jom BMS. We may also collect technical information automatically when the Services are used and receive information from connected services, payment providers or implementation partners at the Customer's direction.
If a Customer or Authorised User provides Personal Data about another person, the provider is responsible for having a lawful basis and authority to do so, giving any required notice, obtaining any required consent, and ensuring that the information is relevant and accurate.
How We Use Information
We may process Personal Data and Customer Data for the following purposes, as relevant to our role and the Services used:
- Provide and operate the Services, including hosting, organising, calculating, reporting, exporting, synchronising and backing up Customer Data and processing authorised transactions and workflows.
- Manage trials, subscriptions, billing, collections, contracts, renewals, Customer contacts and service notices.
- Authenticate users, manage roles and permissions, support sign-in and password reset, maintain sessions and protect accounts.
- Provide support, implementation assistance and troubleshooting.
- Protect the security and integrity of Jom BMS, including monitoring suspicious activity, preventing fraud and unauthorised access, maintaining audit records and investigating incidents.
- Improve Jom BMS by analysing aggregated or appropriately minimised usage and performance information, understanding feature adoption, testing changes and fixing errors.
- Send operational, administrative, security, maintenance and support communications, and, where permitted, information about relevant features, offers or related services.
- Meet legal, regulatory, tax, accounting, e-invoice, audit and reporting requirements; respond to lawful requests; establish or defend legal claims; and enforce agreements and policies.
- Conduct internal business administration, governance, risk management, financial reporting, due diligence and corporate transactions, subject to appropriate safeguards.
We process Personal Data only where a lawful ground or condition is available under the PDPA or other applicable law. We rely on consent where the law requires it. Where we act as a processor, we also rely on the Customer's documented and lawful instructions.
If information is required to create an account, provide a selected feature, comply with law or perform a contract, failure to provide it may prevent us or the Customer from providing the relevant service.
Communications and Marketing
We may contact Customers and Authorised Users by email, in-app notification, telephone, SMS or another supplied channel regarding accounts, transactions, support, security, maintenance, surveys and service administration.
Where permitted, we may also send information about Jom BMS features, offers or related services. Recipients may use an available unsubscribe mechanism or contact us to stop direct marketing. Opting out of marketing does not stop essential service, transactional or security communications.
Customers using Jom BMS communication features are responsible for their own recipient lists, notices, consents, suppression lists and compliance with applicable marketing and communications laws.
E-Invoice, Payment and Statutory Services
Where a Customer uses e-invoice, payment or statutory reporting features, relevant information may be transmitted to payment providers, financial institutions, integration partners, the Inland Revenue Board of Malaysia or another competent authority, as applicable and as instructed by the Customer or required by law.
Jom BMS may retain submission references, validation responses, payment metadata, gateway or API logs and status information to provide the relevant feature, reconcile records, troubleshoot issues, prevent fraud and meet legal or contractual requirements. We do not store full payment-card credentials unless expressly stated for a particular payment service; payment providers may collect such information directly under their own terms.
How We Share Information
We do not sell or rent Personal Data. We may disclose information only as reasonably necessary for the purposes described in this Privacy Policy, including to:
- Service providers and subprocessors that support hosting, infrastructure, databases, security, communications, analytics, support, billing or other operations. They are required by contract or applicable law to protect the information and process it only for authorised purposes.
- Customer administrators and Authorised Users according to the Customer's configured roles and permissions.
- Customer-selected integrations, including accounting, payment, delivery, e-invoice, communications, government or other connected services. Once information is sent to a third party, that third party's own terms and privacy practices may apply.
- Professional advisers such as lawyers, auditors, accountants, insurers and consultants where reasonably necessary and subject to confidentiality duties.
- Courts, regulators, law-enforcement agencies, tax authorities and other legal recipients where required or permitted by law.
- A potential or actual purchaser, investor, financier, successor or adviser in connection with a merger, acquisition, financing, reorganisation, sale of assets or similar corporate transaction, subject to appropriate safeguards.
Customers should review third-party integrations, limit access to what is necessary and disconnect integrations that are no longer required.
Your Privacy Rights
Subject to the PDPA, other applicable law and relevant exceptions, an individual may have rights to:
- Request access to Personal Data held about the individual.
- Request correction of Personal Data that is inaccurate, incomplete, misleading or not up to date.
- Withdraw consent or request that certain processing stop where applicable law and the circumstances permit.
- Require us to stop using Personal Data for direct marketing.
- Request transmission of Personal Data to another data controller where a statutory portability right applies and technical requirements can be met.
- Raise a concern with us or lodge a complaint with the Personal Data Protection Commissioner.
To protect individuals and accounts, we may need to verify identity and authority before acting. Requests may be subject to legal exceptions, procedural requirements and any fee permitted by law.
If a request concerns Customer Data controlled by a Customer, please contact that Customer first. We will support the Customer's response where required by law or contract.
Customer Responsibilities
Customers control the purposes for which they use Jom BMS and much of the Customer Data processed through it. Customers are responsible for ensuring that they have an appropriate lawful basis to collect and process Personal Data through Jom BMS, provide required privacy notices and consents, keep data reasonably accurate, configure appropriate access controls and integrations, and comply with applicable privacy and communications laws.
A Customer must not use Jom BMS to process Personal Data in violation of applicable law, another person's rights or its agreement with us. We may restrict processing that creates a material security, legal or rights risk.
Children's Privacy
Jom BMS is intended for business use and is not directed to children as independent users. Customers are responsible for ensuring that any Personal Data relating to children processed through Jom BMS is collected and used lawfully and with any required authority, notice or consent.
Security
We use reasonable and appropriate administrative, technical and physical safeguards designed to protect Personal Data against loss, misuse, unauthorised access, disclosure, alteration and destruction. Safeguards may include access controls, authentication measures, logging, monitoring, secure development and deployment practices, vulnerability management, backups, incident response and controls for personnel and service providers, as appropriate to the risk.
No internet transmission, system or storage method is completely secure. Customers and Authorised Users are responsible for maintaining the security of their accounts, credentials, user permissions, devices and connected integrations and for promptly notifying us of suspected unauthorised access.
If we become aware of a Personal Data breach, we will investigate, contain and remediate it as appropriate and provide notifications where required by applicable law, taking into account our role, the nature of the incident and the risk of harm.
Data Retention
We retain Personal Data for as long as reasonably necessary to provide and secure the Services, maintain the Customer relationship, fulfil the purposes described in this Privacy Policy, comply with legal, tax, accounting and reporting obligations, resolve disputes, enforce agreements and maintain appropriate business records. Retention periods vary by data type, module, Customer instruction and legal requirement.
During an active subscription, Customers may have tools or support processes to access, correct, export or delete certain Customer Data, subject to product functionality, permissions and legal restrictions. On termination or expiry, Customer Data will be handled in accordance with the applicable agreement, documented retention processes and law. Customers should export information they need before access ends.
Deleted information may remain temporarily in backups, logs, archives or disaster-recovery systems until removed through normal cycles. We may retain limited information where required by law, necessary for security or fraud prevention, or needed to establish, exercise or defend legal claims. When retained information is no longer required, we will take reasonable steps to delete, destroy or anonymise it.
International Data Transfers
Jom BMS and its service providers may process or support information from locations outside the Customer's or individual's country. Where Personal Data is transferred outside Malaysia, we will take steps required by applicable law, which may include assessing the destination and recipient, using contractual and organisational safeguards, limiting the data transferred, obtaining consent where required, or relying on another lawful condition for transfer.
Customers should consider their own legal obligations before directing a cross-border transfer through an integration, export, remote-access arrangement or overseas recipient.
Cookies and Similar Technologies
Our websites and Services may use cookies, browser storage and similar technologies to maintain sessions, remember settings, support authentication, protect against misuse, measure performance and understand how features are used. Some technologies are necessary for the Services to function.
Where required, we will request consent for non-essential technologies and provide available preference controls. Browser settings may allow cookies to be blocked or deleted, although disabling necessary cookies or storage may affect sign-in, preferences or functionality. Connected or embedded third-party services may use their own technologies under their privacy terms.
Changes to This Privacy Policy
We may update this Privacy Policy to reflect changes in Jom BMS, our practices, legal requirements or industry guidance. We will post the updated version and revise the "Last updated" date. Where a change is material, we may provide additional notice through the Services, by email or by another reasonable method. The updated policy applies from the stated effective date, subject to any additional consent required by law.
Contact Us
If you have questions, requests or concerns about this Privacy Policy or our handling of Personal Data, please contact us.
Jom System Support
Email: [email protected]
Phone: +603-3132 8109
Website: www.jomsystem.com