Privacy Policy – SiniOk

1. Who We Are and Scope

This Privacy Policy applies to all users of the SiniOk Platform, including:

• Members / Buyers who browse services, contact sellers, or save posts.
• Sellers (freelancers, self-employed, businesses) who create profiles, subscribe to plans, and publish posts.
• Inviting Users who participate in Invitation Programmes (Invitation Links, Invitation Codes, usernames, or other approved invitation mechanisms).
• Authorised Organisations and their Authorised Users who access organisation-level features and services under a separate organisation services agreement.
• Visitors who access our websites, public business pages, or interact with our marketing pages.
• Customers whose information is entered into SiniOk by Sellers for the Seller's own business activities.
• Persons who contact SiniOk for support or other enquiries.

SiniOk processes personal data in accordance with applicable Malaysian data protection law, including the Personal Data Protection Act 2010 (Act 709), as amended from time to time. By using the Platform, you acknowledge the practices described in this Privacy Policy, in addition to our Terms of Use. Where applicable law requires consent or another affirmative action for a particular processing activity, continued use alone will not replace that requirement.

2. Information We Collect

We collect the following categories of information:

2A. Business Data

SiniOk provides Business Tools that may process information relating to business operations. Depending on the features used, Business Data may include:

• Appointments: Customer name, phone number, date and time, service information, status, notes and related records.
• Quotations, bills and receipts: Customer information, items and services, quantities, prices, discounts, taxes, charges, totals, payment status, payment methods, payment notes, refunds and related transaction information.
• Expenses: category, amount, date, notes, receipt photos, PDFs and other attachments.
• Customers: name, phone number, address, transaction history, appointments, packages and other business records maintained by the Seller.
• Items and packages: products and services, prices, package information, session or usage records and, where applicable, stock or cost-related information.
• Business reports: sales, payment and expense summaries, customer activity, income information and other business analytics.

These records may contain personal data where they relate to an identifiable individual.

2B. Customer Personal Data Entered by Sellers

2C. AI-Assisted Features

2D. Offline and Local Device Data

3. How We Use Your Information

We use your data to:

1. Verify your identity and secure your account (Email OTP for all users, SMS OTP + IC verification for sellers).
2. Create, operate and personalise your account and seller profile.
3. Publish and display seller information (such as services, ads, photos, videos and reviews) to potential buyers.
4. Facilitate communication between buyers and sellers, including phone-reveal and "Call/WhatsApp" interactions.
5. Administer subscriptions, trials, renewals and billing; generate invoices and payment records; and detect chargeback abuse.
6. Provide Business Tools and process appointments, quotations, bills, receipts, expenses, customers and related Business Data.
7. Provide AI-assisted features, and support offline access and synchronisation where available.
8. Process photos, videos and uploaded files, including security scanning, duplicate or similarity detection, and moderation.
9. Operate Wallet Credits, process withdrawal requests, verify payout details (including any additional compliance or anti-fraud checks we require), and prevent fraudulent or abusive withdrawals. Required payout or verification data is mandatory for withdrawal features; without it we may be unable to complete a payout.
10. Associate qualifying events with Invitation Programmes, issue and claw back related Promotional Benefits, and detect self-invitation or multi-account abuse (including using related-account and technical signals described in Section 2.9), under our Terms of Use.
11. Administer Approved Programmes and organisation-level services for Authorised Organisations; provide aggregated analytics only; enforce confidentiality and anti-re-identification obligations.
12. Apply viewing and contact limits (for example, tiered phone-reveal rules) to prevent abuse and protect sellers.
13. Improve Platform performance, user experience, relevance of listings and search quality.
14. Monitor for fraud, scams, bots and misuse of the Platform, and enforce our Terms of Use.
15. Send important service messages (e.g. security alerts, material changes to Terms or Privacy Policy via in-app notice and/or email). Service messages relating to Account security, transactions, important Platform changes or legal notices are not treated as optional marketing messages. Where permitted, we may also send marketing messages about Platform features, Plans or promotions, and you may unsubscribe using available controls.
16. Comply with legal obligations and cooperate with regulators or law enforcement where required.

4. Legal Basis and Consent

Where required by applicable law (including the Personal Data Protection Act), we rely on one or more of the following legal bases to process your personal data:

• Consent – for example, when you agree to create an account, upgrade to a seller plan, accept cookies, or opt in to marketing communications.
• Contractual necessity – to provide the services you request, such as managing your account, subscription, and access to seller features.
• Legitimate interests – such as improving the Platform, protecting users from fraud and abuse, enforcing our Terms, analysing usage, and developing new features, in a way that does not unfairly impact your rights.
• Legal obligations – to comply with applicable laws, regulations or lawful requests (for example, keeping certain records for audit, tax, or law-enforcement purposes).

5. What Information is Public

6. Data Sharing and Third Parties

We do not sell your personal information. We may share your information only with:

• Service providers who help us operate the Platform, such as:
  • Cloud hosting, data storage, backups and infrastructure providers
  • Email and SMS OTP providers
  • Payment processors, payment gateways and payout / withdrawal partners
  • Analytics, anti-fraud, and security vendors
  • Moderation, video processing, and AI-based services, where used
• Business partners where we integrate or co-offer products or services (for example, payment or verification partners), in which case we will clearly describe the arrangement where required.
• Payout / withdrawal partners (e.g. banks or transfer service providers) with the recipient details needed to complete a Wallet withdrawal you requested.
• Authorised Organisations: limited to organisation contact and Authorised User account data for that organisation, plus aggregated Approved Programme metrics. We do not share other Members' or Sellers' personal data with Authorised Organisations for analytics purposes. Authorised Organisations must not re-identify individuals from aggregates or onward-disclose them except as allowed under the applicable organisation services agreement.
• Legal and regulatory authorities when required by law, court order, or to protect our users, our rights, or the rights of others.
• Corporate transactions, such as a merger, acquisition, financing or sale of all or part of our business, where your data may be transferred as part of that transaction, subject to appropriate safeguards.

Where we transfer personal data outside of Malaysia, we take steps to ensure that an adequate level of protection is provided in accordance with applicable law.

7. Data Retention & Deletion

• We retain your personal data only for as long as necessary to provide the Platform, operate our business, and meet legal, accounting or reporting requirements.
• Account and profile data are generally kept while your account is active. If you request deletion, we will remove or anonymise your personal data, except where we are required or permitted to keep certain information (for example, for fraud prevention, dispute resolution or legal obligations). For step-by-step instructions, see our User Data Deletion page.
• Wallet and Invitation Programme integrity records — including withdrawal payout snapshots, Wallet ledger entries, invitation association and visit logs, and Promotional Benefit fulfilment / clawback records — may be retained for accounting, tax, audit, and anti-fraud purposes for the periods in Section 16. An account-deletion request does not require us to erase these records immediately where they are still needed for an open withdrawal, Promotional Benefit dispute, investigation, or legal obligation.
• Seller advertisements, reviews and public posts may remain visible or stored in backup systems for a reasonable period, even after account closure, unless removal is required by law or technically feasible.
• Logs and security records (such as device, IP and phone-reveal logs) may be retained for a period necessary to investigate abuse, enforce our Terms, and comply with law.

8. Security Measures

• OTP verification for account security (Email OTP for all users, SMS OTP + IC verification for sellers).
• Use of industry-standard security practices to protect data in transit and at rest, including encryption for sensitive information where appropriate.
• Access controls to ensure only authorised staff and service providers can access personal data where necessary.
• Monitoring and logging to help detect suspicious activity, abuse or security incidents.

However, no method of transmission over the internet or electronic storage is completely secure. While we strive to protect your personal data, we cannot guarantee absolute security.

9. Your Rights and Choices

As a SiniOk user, and subject to applicable law, you have the right to:

• Access the personal information we hold about you.
• Update or correct inaccurate or incomplete personal information via your account settings or by contacting us.
• Request deletion of your account and personal data, subject to our legal obligations and legitimate interests as explained above. See our User Data Deletion page for how to submit a request.
• Withdraw consent for certain processing where we rely on consent (for example, marketing communications), without affecting the lawfulness of processing based on consent before its withdrawal.
• Object to or request restriction of certain processing where permitted by law.
• Request data portability where applicable and technically feasible.
• Manage cookies and tracking technologies through your browser or device settings, and through any cookie banners or preferences we provide.
• Report misuse, scams or privacy concerns via our contact channels.

To exercise any of these rights, please contact us using the details in Section 12 below, or follow the process in Section 18. We may need to verify your identity before fulfilling your request.

Limitations. Where permitted by law, we may delay, limit, or refuse access or deletion requests that would impair fraud or security investigations, ongoing Wallet withdrawal or Promotional Benefit disputes, accounting or tax records we must keep, or the rights of other persons. We will explain the basis for any refusal or limitation where we are required to do so.

10. Children

The Platform is intended for adults and business users. If you are under 18, you should only use the Platform with the consent and supervision of a parent or legal guardian. We do not knowingly collect personal data from children in violation of applicable law. If you believe a child has provided us with personal data without appropriate consent, please contact us and we will take appropriate steps.

11. Updates to This Policy

12. Contact Us

Data Protection Officer. Where SiniOk is required by applicable law to appoint a Data Protection Officer ("DPO"), we will appoint one and maintain any required registration or notification. Until or unless a separate DPO contact is provided, privacy enquiries may be submitted using the contact information above.

13. PDPA Principles and Consent Management

14. Notice, Choice, and Mandatory Data

15. Disclosure Controls and Cross-Border Transfers

16. Data Retention Schedule

17. Data Accuracy and User Responsibilities

18. Access, Correction, and Deletion Request Process

19. Security Incident Response