Available in English and Bahasa Malaysia. If the two versions differ, the English version prevails.
1. Parties and scope
1.1 This Agreement is between the operator named in the account ("Operator") and the Antlerzone group company that provides the product the Operator uses ("Provider"): Antlerzone Sdn Bhd, Coliving Management Sdn Bhd or Clean Lemons Enterprise.
1.2 It applies to personal data the Operator, its staff or its integrations enter into the service about the Operator's own customers, guests, tenants, owners, visitors, staff and contractors ("Operator Data").
1.3 It does not apply to the shared Antlerzone account a person keeps for themselves. Antlerzone Sdn Bhd is the data user for that account. The Operator receives it only as the Privacy Policy allows (contact details, and other details after the person approves).
1.4 The Operator accepts this Agreement by accepting the Terms and Conditions or by continuing to use the service.
2. Roles
2.1 For Operator Data, the Operator is the data user (controller) and the Provider is the data processor, as those terms are used in the PDPA.
2.2 The Provider processes Operator Data only to provide, secure and support the service, on the Operator's documented instructions (the service settings and these Terms count as instructions), unless the law requires otherwise.
3. Operator duties
3.1 The Operator gives every notice and obtains every consent the PDPA requires for Operator Data, including written notice in Bahasa Malaysia and English where required.
3.2 The Operator collects only the data it needs, keeps it accurate, and answers data subject requests about Operator Data. The Provider helps where the service allows.
3.3 The Operator controls which staff can see Operator Data and removes access when it is no longer needed.
4. Provider duties
4.1 Confidentiality: only Provider staff who need access to run or support the service may access Operator Data, under a duty of confidentiality.
4.2 Security: the Provider keeps technical and organisational measures in line with the PDPA Security Principle and the Personal Data Protection Standard, including access control, encryption in transit and separation of each operator's data.
4.3 Sub-processors: the Provider may use the service providers listed in the Privacy Policy. It will give the Operator at least 14 days' notice of a new sub-processor, and the Operator may object and close its account if it does not agree.
4.4 Breach: the Provider will notify the Operator without undue delay, and aim to do so within 24 hours, after becoming aware of a personal data breach affecting Operator Data. It will give the details the Operator needs to notify the Commissioner within 72 hours and affected people within 7 days.
4.5 Assistance: the Provider gives reasonable help with access, correction, portability and deletion requests, and with impact assessments, for Operator Data.
5. Transfers outside Malaysia
Operator Data is stored on servers in Malaysia. Some sub-processors process data outside Malaysia. The Provider only uses sub-processors that give a comparable level of protection, as section 129 of the PDPA requires.
6. End of the service
6.1 When the Operator closes its account, the Provider lets it export Operator Data for 30 days.
6.2 The Provider then deletes or anonymises Operator Data, except records the law requires it to keep (such as tax and accounting records, usually 7 years) and backups that expire on their normal cycle.
7. Audit
On reasonable written notice, and no more than once a year, the Provider will answer the Operator's written questions about its compliance with this Agreement.
8. Order of precedence
If this Agreement conflicts with the Terms and Conditions on personal data, this Agreement applies.
Contact: info@antlerzone.com (Data Protection Officer: Lim Ye Yong).