Privacy Notice

1. Our role

RF Pulse is used by organisations ("customers") to send SMS messages to their own contacts. We play two different roles:

• For account holders (staff and administrators of our customers), we decide how your account data is used and are responsible for it.
• For message recipients, the organisation that uploaded your details and sent you the message decides how your data is used. We process it only on that organisation's instructions. If you received an SMS through RF Pulse, please contact the sending organisation first about your data; we will help them respond to you.

2. Personal data we process

An email address is required to create an account; without it we cannot provide the service. Recipient data is supplied by the sending organisation, not collected from recipients directly.

3. Why we use it

• To provide the platform: signing in, managing contacts and templates, sending SMS and showing delivery reports.
• To send service emails such as account invitations and password resets.
• To keep the platform secure, prevent misuse and investigate incidents.
• To calculate usage and costs, and to meet our legal and accounting obligations.

We do not sell personal data and do not use recipient data for our own marketing.

4. Who we share it with

We share personal data only with service providers that help us run the platform, under contracts that require them to protect it:

We may also disclose personal data where required by law, court order or a lawful request from a Malaysian authority.

5. Transfers outside Malaysia

Some of our providers store or process data outside Malaysia, as shown above. We take reasonable steps to ensure that data transferred abroad receives a level of protection comparable to the PDPA.

6. How long we keep it

We keep personal data for as long as it is needed to provide the service and for record-keeping, billing, audit, dispute resolution and legal purposes. This includes:

• Account data, contacts, and message and delivery records, which are kept for as long as the organisation's account exists, including while it is deactivated.
• Message and delivery records, which form a permanent ledger used for billing and audit, and are not removed automatically.

Organisations can delete their own contacts at any time. If you ask us to delete your data, we will review the request and act on it where we are no longer required to keep the data for the purposes above.

7. How we protect it

All traffic is encrypted in transit (HTTPS) and data is encrypted at rest by our database provider. Each organisation's data is isolated at the database level, so one customer cannot see another's data. Access is limited by role, and SMS gateway passwords are never sent to the browser.

8. Your rights

Under the PDPA you may:

• request access to the personal data we hold about you;
• ask us to correct data that is inaccurate, incomplete or out of date;
• withdraw your consent, or ask us to limit how your data is used, including for direct marketing;
• make a complaint about how your data is handled.

To exercise these rights, email [privacy@yourdomain.com]. We will respond within 21 days. We may need to verify your identity, and a fee may apply to access requests where the law allows. Message recipients who no longer want to receive SMS should contact the sending organisation, who must stop sending to you.

9. Cookies and local storage

We only use what is needed to run the platform. We do not use advertising or tracking cookies.

10. Children

RF Pulse is a business tool and is not intended for anyone under 18.

11. Changes to this notice

We may update this notice from time to time. The effective date above shows when it last changed, and we will notify account holders of significant changes by email or in the app.

12. Contact us

[COMPANY LEGAL NAME]

[REGISTERED ADDRESS]

Email: [privacy@yourdomain.com]