Privacy Policy

1. About This Policy

This Privacy Policy applies to KonstrakOS, a Software-as-a-Service (SaaS) platform designed exclusively for business entities engaged in construction contracting in Malaysia. KonstrakOS is owned and operated by:

Global Digital Technologies Sdn. Bhd. (201901043163) (1352493-X)
3-2-2, Jalan 4/101C, Cheras Business Center, 56100 Kuala Lumpur, Malaysia
Websites: https://mydigital.contractors and https://sykt.contractors

This policy, together with our Terms of Service, constitutes the entire agreement between Global Digital Technologies Sdn. Bhd. and the subscribing business entity ("Subscriber", "you", "your") regarding the handling of data on the platform. In the event of any conflict between this policy and any other communication, this policy shall prevail.

2. Acceptance of Terms

By registering for, accessing, or continuing to use KonstrakOS, the Subscriber irrevocably agrees to this Privacy Policy in its entirety. This acceptance is binding on all authorised users, employees, contractors, and agents operating under the Subscriber's account.

If you do not agree to any provision of this policy, you must immediately cease use of the platform and contact us to close your account. Continued use after any update to this policy constitutes fresh, unconditional acceptance of the revised terms.

3. Information We Collect

3.1 Information You Provide Directly

• Account Information: Company name, business registration number, address, contact person names, email addresses, phone numbers, and job titles.
• Project Data: Project names, descriptions, budgets, timelines, site locations, contractor details, subcontractor records, and progress updates.
• Financial Information: Cost breakdowns, quotations, invoices, payment terms, bank details (for invoicing), and project budgets.
• Site Information: Site diary entries, photographs, checklists, safety records, inspection reports, and site meeting notes.
• CRM Data: Client contacts, lead information, communication histories, and business relationships.
• User Profile Information: Employee names, email addresses, role designations, and access permissions assigned by the Subscriber.

3.2 Information Collected Automatically

• Usage Data: Every page visited, feature used, button clicked, time spent, and workflow executed on the platform.
• Device & Network Information: Device type, operating system, browser type and version, IP address, ISP, and unique device identifiers.
• Log Data: Full access logs, error logs, API call records, and system performance metrics.
• Behavioural Data: User interaction patterns, feature adoption rates, and session recordings used to improve the platform.
• Cookies & Tracking: Session cookies, persistent cookies, pixel tags, and similar technologies. Disabling cookies may impair platform functionality.
• Location Data: Approximate geographic location derived from IP address.

3.3 Information from Third Parties

• Business directories, CIDB records, and public company registration databases
• Referrals and introductions from existing KonstrakOS subscribers
• Integrated third-party applications enabled by the Subscriber
• Analytics, advertising, and marketing partners

All data collected — whether provided directly or collected automatically — becomes part of the platform's operational dataset and is subject to this policy in full.

4. How We Use Your Data

4.1 Service Delivery & Operations

• Providing, hosting, maintaining, and improving all KonstrakOS features and modules
• Processing project costing, invoicing, and financial transactions
• Managing user accounts, subscription tiers, billing, and access permissions
• Delivering customer support, onboarding assistance, and technical help
• Detecting, investigating, and preventing fraudulent, abusive, or illegal activity on the platform

4.2 Platform Development & Analytics

• Analysing aggregate and individual usage patterns to improve the platform's features and performance
• Training and improving internal algorithms and recommendation engines using anonymised data
• Conducting A/B testing, usability research, and product benchmarking
• Generating industry-level reports and benchmarks from anonymised Subscriber data

4.3 Communication & Marketing

• Sending transactional notifications, billing statements, and service updates
• Sending product newsletters, feature announcements, and promotional offers
• Sharing KonstrakOS case studies and success stories (using anonymised data unless consent is given)
• Conducting customer satisfaction surveys and gathering product feedback

4.4 Legal, Compliance & Enforcement

• Complying with the Personal Data Protection Act 2010 (PDPA) and all applicable Malaysian laws
• Enforcing our Terms of Service, this Privacy Policy, and any other contractual agreements
• Exercising or defending legal claims, including debt recovery for overdue subscriptions
• Maintaining audit trails, financial records, and regulatory filings as required by law

5. Our Rights Over Data

The following rights are expressly reserved by Global Digital Technologies Sdn. Bhd. as the platform operator:

5.1 Ownership of Platform-Generated Data

All data generated by, processed through, or derived from the operation of the KonstrakOS platform — including usage logs, performance metrics, aggregate reports, behavioural analytics, and system-generated records — is the sole property of Global Digital Technologies Sdn. Bhd. The Subscriber's input data (project records, financial entries, contacts) remains the Subscriber's property; however, the Subscriber grants us a perpetual, irrevocable, worldwide, royalty-free licence to use such input data in anonymised or aggregated form for product development, benchmarking, and research purposes.

5.2 Right to Monitor and Audit

We reserve the right to monitor, inspect, and audit any activity on the platform at any time and without prior notice, for the purposes of security, fraud prevention, compliance, and service quality assurance. This includes reviewing content uploaded by users where reasonably necessary to investigate a suspected breach of our Terms of Service or applicable law.

5.3 Right to Modify, Restrict, or Suspend Services

We may at our sole discretion, and without liability, modify, restrict, throttle, or temporarily suspend access to the platform or any feature thereof at any time, including in response to suspected abuse, non-payment, regulatory requirements, or necessary maintenance.

5.4 Right to Disclose Without Notice

We reserve the right to disclose Subscriber data to any government authority, regulatory body, or law enforcement agency without prior notice to the Subscriber, where we determine in good faith that such disclosure is required or permitted by applicable law, or is necessary to protect the rights, property, or safety of KonstrakOS, its users, or the public.

5.5 Right to Retain Data Post-Termination

Upon termination or expiry of a subscription — regardless of the reason — we retain the right to keep all Subscriber data for a minimum period of seven (7) years for legal, audit, financial, and regulatory compliance purposes. We may also retain anonymised or aggregated derivatives of such data indefinitely for product improvement purposes.

5.6 Right to Withhold Deletion

Any request for data deletion by the Subscriber will be assessed against our legal, contractual, and operational obligations. We reserve the right to decline or defer deletion where the data is subject to: an active legal hold; an unresolved billing dispute; a regulatory audit or investigation; or any other legitimate operational reason. Deletion, where approved, will be carried out within a commercially reasonable timeframe.

5.7 Right to Amend This Policy Unilaterally

We reserve the right to amend, update, or replace this Privacy Policy at any time, at our sole discretion and without requiring the prior consent of Subscribers. The revised policy becomes effective upon publication at https://mydigital.contractors/privacy-policy or https://sykt.contractors/privacy-policy. Continued use of the platform constitutes acceptance.

6. Sharing of Data

We do not sell individual Subscriber data to third parties for their independent marketing use. We may, however, share data in the following circumstances:

6.1 Service Providers & Sub-Processors

We engage trusted third-party service providers who assist in the operation, hosting, and support of KonstrakOS, including cloud infrastructure providers, payment processors, email delivery services, analytics platforms, and customer support tools. These providers are granted access only to the data necessary for their function and are bound by confidentiality obligations. We are not responsible for the independent data practices of sub-processors beyond our contractual requirements.

6.2 Legal & Regulatory Disclosure

We will disclose data when required to do so by any applicable law, court order, subpoena, regulatory directive, or government authority — including tax agencies, the Malaysian Commissioner for Personal Data Protection, and law enforcement bodies — with or without notice to the Subscriber.

6.3 Business Transfers

In the event of a merger, acquisition, restructuring, asset sale, or any other change of control of Global Digital Technologies Sdn. Bhd., all Subscriber data may be transferred to the acquiring or successor entity as a business asset. Such transfers are not subject to Subscriber consent. We will endeavour to notify affected Subscribers of any material change in data controller following such an event.

6.4 Aggregate & Anonymised Data

We may freely publish, share, license, or commercialise aggregate and anonymised data derived from the platform — including industry benchmarks, usage statistics, and market insights — without restriction and without notice or compensation to Subscribers.

6.5 Enforcement & Protection

We may disclose data as necessary to enforce our Terms of Service, recover overdue payments, investigate suspected fraud or misuse, or protect the rights, property, and safety of Global Digital Technologies Sdn. Bhd. and its users.

7. Data Retention

We retain data for as long as is necessary to fulfil our operational, legal, and regulatory obligations. The following minimum retention periods apply:

• Active Subscription Data: Retained throughout the subscription period and for a minimum of 7 years thereafter.
• Financial & Billing Records: Retained for a minimum of 7 years in compliance with Malaysian tax and corporate law.
• Project & Site Data: Retained for the life of the account plus 7 years, or longer if subject to a legal hold.
• System & Access Logs: Retained for a minimum of 24 months for security, audit, and compliance purposes.
• Backup Copies: Retained for up to 90 days following deletion or account termination for disaster recovery purposes.
• Anonymised Derivatives: Retained indefinitely for platform improvement and research purposes.
• Dispute-Related Data: Retained for the duration of any unresolved dispute plus any applicable limitation period.

The Subscriber acknowledges that data subject to any of the above conditions cannot be deleted upon request until the relevant retention period has elapsed.

8. User Rights & Limitations

Subject to the rights reserved in Section 5 and consistent with the Personal Data Protection Act 2010 (PDPA), Subscribers may exercise the following rights by submitting a written request to our Data Protection Officer:

Right of Access

You may request a summary of the personal data we hold relating to your account. We will respond within 21 days. We reserve the right to charge a reasonable administrative fee for repeated or manifestly unfounded access requests.

Right to Correction

You may request the correction of factually inaccurate personal data. We will assess and, where appropriate, update the data within a reasonable timeframe. We are not obligated to alter data that reflects an accurate record of transactions, logs, or communications.

Right to Deletion

Deletion requests will be evaluated against our retention obligations under Section 7 and the reserved rights under Section 5. We will action approved deletions within 30 working days. Partial deletion (i.e. deletion of some data while retaining other data) is at our sole discretion.

Right to Data Portability

You may request an export of your Subscriber-input data (project records, contacts, invoices) in a standard format. This right applies only to data you directly inputted and does not extend to system-generated data, logs, analytics, or platform-derived records, which remain the property of Global Digital Technologies Sdn. Bhd.

Right to Opt Out of Marketing

You may opt out of marketing communications at any time via the unsubscribe link in any email or by updating your account settings. Transactional communications (billing, security alerts, service notices) cannot be opted out of while your account remains active.

Limitations on Rights

All user rights are subject to the following limitations: (a) verification of the requester's identity and authorisation; (b) our legal and regulatory retention obligations; (c) any active dispute, investigation, or legal proceeding; and (d) the operational integrity of the platform. We reserve the right to refuse requests that are frivolous, repetitive, or made in bad faith.

9. Account Suspension & Termination

Global Digital Technologies Sdn. Bhd. reserves the right to suspend or terminate any Subscriber account, with or without notice, in any of the following circumstances:

• Non-payment of subscription fees or outstanding invoices
• Breach of our Terms of Service or this Privacy Policy
• Use of the platform for fraudulent, illegal, or abusive purposes
• Provision of false or misleading information during registration or at any time thereafter
• Conduct that poses a security, reputational, or legal risk to Global Digital Technologies Sdn. Bhd.
• A regulatory direction or court order requiring suspension or termination

Upon suspension or termination, the Subscriber's access to the platform will be revoked immediately. Data will be retained in accordance with Section 7. No refund of pre-paid subscription fees will be issued where termination is due to a breach by the Subscriber.

10. Security & Liability

10.1 Our Security Measures

• SSL/TLS encryption for all data in transit
• AES-256 encryption for data at rest
• Role-based access controls and two-factor authentication (2FA) support
• Regular security audits, vulnerability assessments, and penetration testing
• Automated threat detection, intrusion monitoring, and DDoS protection
• Documented incident response and breach notification procedures

10.2 Subscriber Responsibilities

The Subscriber is solely responsible for: maintaining the confidentiality of all account credentials; managing user access permissions within the platform; ensuring that all devices used to access KonstrakOS are adequately secured; and promptly reporting any suspected unauthorised access to our support team.

10.3 Limitation of Liability

Global Digital Technologies Sdn. Bhd. shall not be liable for any loss, damage, or liability arising from: (a) the Subscriber's failure to maintain credential security; (b) data breaches caused by third-party service provider incidents beyond our reasonable control; (c) loss of data resulting from the Subscriber's own actions or omissions; or (d) any indirect, consequential, or incidental loss arising from use of the platform. Our total aggregate liability to the Subscriber shall not exceed the total subscription fees paid in the three (3) months preceding the incident giving rise to the claim.

11. Third-Party Services

KonstrakOS may integrate with third-party services including payment gateways, cloud storage, accounting software, email tools, and analytics platforms. When the Subscriber activates any integration, data is transmitted to the relevant third party in accordance with that party's own privacy policies. Global Digital Technologies Sdn. Bhd. is not responsible for the data handling practices of any third-party service, and the Subscriber assumes full responsibility for reviewing and accepting the terms of any integration they enable.

We reserve the right to add, modify, or discontinue any third-party integration at any time without notice or liability.

12. International Data Transfers

KonstrakOS is operated from Malaysia. However, data may be transferred to, stored in, or processed in other jurisdictions — including Singapore, the United States, or other countries where our infrastructure partners operate — which may have different data protection standards than Malaysia. By using KonstrakOS, the Subscriber expressly consents to such transfers. We implement appropriate contractual and technical safeguards to protect data during international transfers, but cannot guarantee that foreign jurisdictions will provide equivalent protections to those available in Malaysia.

13. Policy Updates

We reserve the right to update, amend, or replace this Privacy Policy at any time and at our sole discretion, without prior notice or consent. The updated policy will be published at https://mydigital.contractors/privacy-policy or https://sykt.contractors/privacy-policy with a revised "Last Updated" date. Where changes are material, we will make reasonable efforts to notify active Subscribers by email. Continued use of the platform following publication of any update constitutes irrevocable acceptance of the revised policy. It is the Subscriber's responsibility to review this policy periodically.

14. Governing Law & Dispute Resolution

This Privacy Policy shall be governed by and construed in accordance with the laws of Malaysia, including but not limited to the Personal Data Protection Act 2010 (PDPA), the Companies Act 2016, and the Computer Crimes Act 1997.

Any dispute arising out of or in connection with this policy, including any question regarding its existence, validity, or termination, shall first be referred to mediation. If mediation fails, the dispute shall be submitted to the exclusive jurisdiction of the courts of Malaysia, and the Subscriber irrevocably submits to such jurisdiction.

Nothing in this clause limits our right to seek injunctive or other equitable relief in any jurisdiction to protect our intellectual property, data rights, or platform integrity.

15. Contact Us

For questions about this policy, to exercise your data rights, or to raise a privacy concern, please contact our Data Protection Officer in writing:

Malaysian Commissioner for Personal Data Protection

If you remain dissatisfied after engaging our Data Protection Officer, you may escalate a complaint to the Malaysian Commissioner for Personal Data Protection:

• Email: enquiry@pdp.gov.my
• Website: https://pdp.gov.my