Aivolux Technologies (registration no. JM1051832-K) (“Aivolux”, “we”, “us”, “our”) respects your privacy. This notice explains how we process personal data, in line with the Personal Data Protection Act 2010 (“PDPA”), as amended. It applies to aivolux.tech (the “Website”), our enquiry and project brief channels, and our dealings with clients, prospective clients and suppliers.
1. Personal data we collect
Data you give us:
- Enquiries and project briefs through Lux, our project concierge, our forms or email: your name, email address, company, the services you’re interested in, project details, budget and preferred start date.
- Client and supplier relationships: business contact details, correspondence, contracts, invoices and payment records.
- Project data: information you share with us so we can deliver a project, which may include personal data about your own customers or staff.
Data collected automatically: our hosting servers record technical information such as your IP address, browser and device type, the pages you request and the time of the request. We use it to operate and secure the Website.
We don’t ask for sensitive personal data — such as health, religious or political information — through the Website. Please don’t send it to us unless we specifically need it for a project and you have the right to share it.
2. Why we use it
- to respond to your enquiry, hold discovery calls and prepare proposals;
- to deliver, manage and support projects and services you’ve engaged us for;
- to manage our client and supplier relationships, including billing and record-keeping;
- to operate, secure and improve the Website, and to prevent spam, fraud and abuse;
- to send you updates or marketing, only where you’ve agreed to receive them;
- to comply with our legal and regulatory obligations, and to establish, exercise or defend legal claims.
Giving us your name and email address is needed for us to reply to an enquiry; other details are optional. If you don’t provide the information we need, we may not be able to respond or work with you.
3. Consent
By sending us your personal data, you consent to us processing it for the purposes in this notice. You can withdraw your consent at any time by emailing us (see section 11). Withdrawing consent doesn’t affect processing we’ve already done, and we may still keep data where the law requires or allows it.
4. Who we share it with
We don’t sell or rent your personal data. We share it only with:
- Service providers who process data on our behalf, such as our website and email host (Hostinger), and providers of fonts and content delivery networks (Google Fonts, cdnjs and jsDelivr), which your browser contacts directly when you load the Website;
- professional advisers, such as lawyers, accountants and auditors, under a duty of confidentiality;
- authorities, where required by law, court order or a lawful request;
- a successor business, if Aivolux is reorganised, merged or sold, subject to this notice.
We require our service providers to protect personal data and to use it only on our instructions.
5. Transfers outside Malaysia
Some of our service providers may store or process data outside Malaysia. We transfer personal data out of Malaysia only where permitted under the PDPA — for example, where the destination has laws substantially similar to the PDPA or ensures an adequate level of protection, where you have consented, or where the transfer is needed to perform a contract with you — and with appropriate safeguards in place.
6. How we protect it
We take practical security steps to protect personal data from loss, misuse, unauthorised access, disclosure or alteration. These include encrypted connections (HTTPS), restricted access on a need-to-know basis, spam and abuse protection on our forms, and trusted hosting providers. No system is completely secure, but we work to keep risks low.
If a personal data breach occurs that causes, or is likely to cause, significant harm, we will notify the Personal Data Protection Commissioner and the affected individuals as required by law.
7. How long we keep it
We keep personal data only as long as needed for the purposes in this notice: enquiries for as long as needed to respond and follow up; client and project records for the length of our relationship plus any period required for legal, tax or accounting purposes. After that, we securely delete or anonymise it.
8. Your rights
Under the PDPA you have the right to:
- access the personal data we hold about you;
- correct personal data that is inaccurate, incomplete, misleading or out of date;
- withdraw consent to us processing your personal data;
- ask us to stop direct marketing to you;
- ask us to stop processing that is likely to cause you substantial damage or distress;
- data portability — ask us to transmit your personal data to another data controller, where technically feasible and permitted by law.
To make a request, email us (see section 11). We may need to verify your identity first, and may charge a fee where the law allows. We’ll respond within 21 days. If we can’t comply, we’ll explain why.
9. Cookies and browser storage
The Website doesn’t use advertising or tracking cookies, and we don’t currently use analytics. When you type a project idea into the “What will you build next?” box, it’s kept in your browser’s session storage just long enough to carry it over to the concierge on the contact page, and it’s cleared when you close the tab. If we introduce analytics or other cookies in future, we’ll update this notice first.
10. Children
Our services are for businesses, and the Website isn’t intended for children. We don’t knowingly collect personal data from anyone under 18 without the consent of a parent or guardian. If you believe a child has sent us personal data, contact us and we’ll delete it.
11. Contact us
For questions, requests or complaints about personal data — including access, correction or withdrawal of consent — contact our data protection team at hello@aivolux.tech, with “Personal data” in the subject line.
If you’re not satisfied with our response, you may contact the Personal Data Protection Department (Jabatan Perlindungan Data Peribadi), Malaysia.
12. Third-party websites
The Website links to other websites, including our clients’ sites. Their privacy practices are their own, and this notice doesn’t apply to them.
13. Changes to this notice
We may update this notice from time to time. The latest version is always on this page, with the date it was last updated.
14. Language
This notice is issued in English and Bahasa Malaysia. If there is any inconsistency between the two versions, the English version prevails.