Last updated: 21 August 2026
This policy explains what personal data we collect through the Zylax website at https://zylax.com.my, why we collect it, who it is shared with and what you can do about it. It is written to reflect how this website actually works, not a generic template.
It covers the website only. If you become a Zylax client, the handling of data inside a project or a support engagement is dealt with in the agreement we sign with you.
Who is responsible for your data
The organisation responsible for personal data collected through this website is:
- Zylax Technologies
- Arte Plus Jalan Ampang, Jalan Bemban, Kampung Berembang, 55000, Kuala Lumpur, Malaysia
- Email: [email protected]
- Telephone: Darren +6012-5109716, Haffiz +6017-6604771
We handle personal data in line with Malaysia’s Personal Data Protection Act 2010 (PDPA).
What we collect and when
1. Enquiry form on the Contact page
When you send us an enquiry, the form asks for:
- Full name (required)
- Email address (required)
- Phone or WhatsApp number (optional)
- Company name (optional)
- The service you are interested in (required)
- Your message (required)
The notification email we receive also records the IP address the enquiry was sent from, the date and the time. This is included automatically by the form software and helps us deal with spam.
2. Newsletter sign-up
The newsletter form asks only for your email address. Sign-ups are not passed to a mailing list platform. They simply arrive as an email to [email protected], and we keep a note of the address so that we can send you Zylax updates. The notification email also records the IP address, date and time of the sign-up.
You can ask to be removed at any time by emailing [email protected]. No reason is needed and we will not ask for one.
3. Server and delivery data
The website sits behind Cloudflare, which delivers pages and filters malicious traffic. In doing so, Cloudflare processes the IP address of every visitor and basic request information. Our hosting also keeps standard server logs. This happens for every website; it is not specific to Zylax.
4. What we do not collect
To be clear about what is not happening on this site:
- There is no Google Analytics, Google Tag Manager, Meta Pixel, Hotjar, Microsoft Clarity or any other analytics tool.
- There is no advertising or remarketing tracking of any kind.
- We do not build visitor profiles and we do not track you across other websites.
- The site does not accept comments. Commenting is switched off across the whole website, so there is no commenter name, email address or avatar data of any kind.
- You cannot create an account on this website, so we hold no visitor account data.
- The website does not ask for and must not be used to send us identity card numbers, passport numbers, bank details or card details.
Why we use it, and our lawful basis
| What | Why | Basis under the PDPA |
|---|---|---|
| Enquiry form details | To reply to you, understand what you need and prepare a quotation | Your consent, given when you submit the form; and steps taken at your request before entering into a contract |
| Newsletter email address | To send you Zylax updates | Your consent, given when you subscribe |
| Email delivery log | To confirm messages actually reached us and to diagnose delivery failures | Our legitimate interest in a reliable enquiry channel |
| Server and Cloudflare logs | To keep the site online, fast and secure | Our legitimate interest in running a secure website |
We do not use your details for anything else without asking you first. We do not sell personal data and we do not pass it to advertisers or data brokers.
Who your data is shared with
We keep the list of third parties short on purpose. As things stand, they are:
- Microsoft (Microsoft 365 / Microsoft Graph) — every email the website sends is delivered through our Microsoft 365 mailbox at [email protected]. Enquiries, newsletter sign-ups and the automatic acknowledgement we send back to you all pass through Microsoft’s systems and are then stored in that mailbox.
- Cloudflare — sits in front of the website and handles delivery, caching and security filtering. Cloudflare sees the IP address of every request. Cloudflare’s network error reporting is also switched on, which means a small share of failed connections are reported back to Cloudflare.
- Google (Google Fonts) — the site’s typefaces are loaded from fonts.googleapis.com and fonts.gstatic.com. Your browser therefore connects to Google to fetch them, and Google receives your IP address and basic browser information when it does. No cookie is set by this.
- WordPress.org — if your browser cannot display emoji characters, WordPress falls back to fetching emoji images from s.w.org. Most modern browsers never make this request.
We may also disclose personal data if we are legally required to do so, for example under a court order or a lawful request from a Malaysian regulator.
Where your data is processed
Email sent through the website is handled on Microsoft’s infrastructure, and Cloudflare and Google both operate global networks. Your data may therefore be processed on servers outside Malaysia. We rely on these providers’ own contractual protections and security commitments for those transfers.
What is stored on the website, and for how long
Email delivery log
You should know that the website keeps a short-term copy of the emails it sends.
When you submit the enquiry form or the newsletter form, the site sends us an email. Our mail plugin records that email in a log inside the website’s own database, so that we can confirm it was delivered and investigate any failure. The log holds the full message. For an enquiry that means your name, email address, phone number, company, service interest, your message text and the IP address the form recorded. For a newsletter sign-up it means your email address and that IP address.
These log entries are kept for 14 days and are then deleted automatically by a daily clean-up task. We do not use the log for marketing, profiling or any purpose beyond checking that mail is working.
Apart from this 14-day log, the website does not keep a separate database of form submissions. There is no form-entry store and no CRM connected to the site. Once the 14 days have passed, the only remaining copy of your enquiry is the email in our Microsoft 365 mailbox.
Everything else
- Enquiry emails in our mailbox. We keep these for as long as we need them to answer you and to hold a record of the enquiry and anything that followed from it. If you would like your enquiry deleted, email [email protected] and we will do it, unless we are required to keep a record for legal or tax reasons.
- Newsletter sign-ups. Kept until you ask to be removed.
- Server and Cloudflare logs. Kept for short operational periods set by those providers.
How we protect it
The site runs over HTTPS, sits behind Cloudflare’s security filtering, and administrator access is limited to a small number of people. Email is sent over an authenticated Microsoft 365 connection rather than plain server mail. The email delivery log described above sits behind the WordPress administrator login and cannot be reached by the public. No system is perfectly secure, but we take reasonable steps proportionate to the data we hold, which is mostly business contact details.
Your rights
Under the PDPA you may:
- ask what personal data of yours we hold, and get a copy of it;
- ask us to correct anything that is wrong or out of date;
- ask us to stop using your data for a particular purpose;
- withdraw consent you previously gave, including unsubscribing from the newsletter;
- ask us to delete data we no longer need, including asking us to clear your entry from the email delivery log before the 14 days are up.
Some limits apply. We may need to keep records for legal, tax or dispute reasons even after you ask us to delete something, and we will tell you if that is the case.
If you are contacting us from outside Malaysia
This policy is written under Malaysian law. If you are somewhere else and you have data protection rights under the law that applies to you there, you are welcome to raise a request with us at [email protected]. We will consider it and respond.
How to make a request
Email [email protected] with the subject line “Personal data request” and tell us what you want. Please give us enough detail to find your records, such as the email address you used. We may ask you to confirm your identity before we act, so that we do not release someone else’s data by mistake.
We aim to respond within 21 days.
How to complain
If you are unhappy with how we have handled your data, please contact us first at [email protected] so we can try to put it right.
If you are still not satisfied, you may complain to the Personal Data Protection Department (Jabatan Perlindungan Data Peribadi, JPDP) under the Ministry of Digital, Malaysia.
Children
This is a business website and is not aimed at children. We do not knowingly collect data from anyone under 18. If you believe a child has sent us their details, email [email protected] and we will delete them.
Changes to this policy
If we add a tool that collects data, such as analytics, we will update this policy before switching it on and change the date at the top. Please check back from time to time.
Questions
Email [email protected], or call Darren on +6012-5109716 or Haffiz on +6017-6604771.
