Privacypolicy.

Smart Tech Tank Sdn Bhd ("Smart Tech Tank", "we", "us" or "our") is a Malaysian technology company based in Shah Alam, Selangor. We build smart systems for governments and enterprises.

For the purposes of the Personal Data Protection Act 2010 of Malaysia ("PDPA"), we are the data user responsible for the personal data described in this policy. Where the law of another country applies to you, we also act as the controller of that data.

This policy applies to personal data we process through this website, including when you send us a message, apply for a job, or simply browse our pages. It does not cover personal data we process for clients under a separate agreement. In that case the client decides how the data is used, and our contract with them governs it.

Please read this policy together with our Terms & Conditions. By using this website you confirm that you have read this policy. Where we ask for your consent, you can withdraw it at any time as described below.

We collect only what we need for the purposes in this policy. The information falls into five groups.

Information you give us in the contact form

Your name, email address, company (optional), the type of enquiry, your message and your confirmation that we may contact you. Please do not include passwords, identity numbers, financial details or other sensitive data in your message.

Information you give us when you apply for a role

Your name, email address, telephone number, years of experience, current position (optional), a link to your professional profile (optional), your resume (PDF, DOC or DOCX, up to 5 MB), an optional cover letter, and your confirmation that we may process your application. Your resume and cover letter may contain further details you choose to share, such as education, employment history and referees.

Technical information collected automatically

When you submit a form we record your IP address and browser user agent (the browser and device type your browser reports). Our servers also keep standard security and error logs. We use this information to detect spam and abuse and to keep the website secure.

Security check data (Cloudflare Turnstile)

The contact form and the job application form are protected by Cloudflare Turnstile, a service that tells real visitors from automated bots. When you open one of these forms, your browser loads a script from Cloudflare, which receives your IP address and technical signals about your browser and device (such as browser type, screen and device characteristics, and how the page is used) to decide whether you are a human. When you submit the form, we send the resulting check token and your IP address to Cloudflare to confirm it is genuine. We do not receive the underlying signals. Cloudflare handles this data under its own privacy policy.

Website analytics data (Google Analytics, only if you accept)

If you accept analytics cookies, Google Analytics collects information about how you use this website: the pages you view and when, how you arrived (such as the website or search that referred you), your approximate location, your browser, device and screen type, and your language. It uses cookies to recognise your browser across visits and identifies it with a random identifier, not your name or email address. Google Analytics does not log or store individual IP addresses. Nothing is collected for analytics unless you accept.

We do not knowingly collect sensitive personal data (as defined in the PDPA) through this website and ask that you do not send it to us. If you include it in your resume or message, you consent to our processing it only to the extent needed to respond to you or assess your application.

We use personal data to:

• read and reply to your enquiries, and send an automatic confirmation that we received your message or application;
• assess your suitability for the role you applied for, arrange interviews, and keep you updated on the outcome;
• scope and deliver services, proposals or partnerships you ask about;
• protect the website, our people and other visitors, including blocking spam, limiting repeated submissions and investigating misuse;
• meet our legal, regulatory and accounting obligations, and establish or defend legal claims; and
• understand how the website is performing and improve it, using aggregated or technical information and, if you accept analytics cookies, Google Analytics statistics.

We do not sell your personal data, we do not use it for advertising, and we do not make decisions about you using solely automated means.

Under the PDPA we process your personal data with your consent, which you give by ticking the consent box on our forms, or where processing is necessary to respond to a request you make, to take steps before entering into a contract, or to comply with a legal obligation.

The security check described above runs automatically on pages with a form. It is not based on your consent. It is necessary to protect the website, our systems and the people who use them from abuse, and it is limited to what is needed for that purpose.

Analytics is different. It is optional and based on your consent. The cookie banner asks for your choice the first time you visit, and Google Analytics does not run unless you accept. You can change your choice at any time using "Cookie settings" in the footer. If you withdraw your choice, we remove the analytics cookies and stop the analytics tag, but information already collected stays in Google Analytics until its retention period ends.

If you are in the European Economic Area or the United Kingdom, our legal bases under data protection law are your consent, steps taken at your request before a contract, our legitimate interests in running and securing our business (balanced against your rights), and compliance with legal obligations.

You may withdraw your consent at any time by contacting us. Withdrawal does not affect processing carried out before it. If you withdraw consent we may no longer be able to respond to your enquiry or continue your application.

This website uses the cookies and browser storage it needs to work, including for the security check on our forms. It also uses optional analytics cookies, but only if you accept them in the cookie banner. We do not use advertising cookies.

Session cookie

Keeps your visit together, protects forms from automated submissions and lets us show you confirmation messages. It expires when your session ends or after a short period of inactivity.

Security token cookie (XSRF-TOKEN)

Protects forms against cross-site request forgery. It lasts for your session.

Appearance preference

A cookie and a local storage entry that remember whether you prefer a light, dark or system theme, so the page renders correctly. The cookie lasts up to one year.

Intro animation flag

A session storage entry that remembers whether the introduction animation has already played during your visit. It is cleared when you close the tab.

Cookie choice

A local storage entry that remembers whether you accepted or declined analytics cookies, so we do not ask on every visit. It stays until you clear your browser data.

Analytics cookies (Google Analytics, optional)

Set only if you accept. The cookies named _ga and _ga_ followed by an identifier let Google Analytics recognise your browser across visits, so it can count visitors and pages. They last up to about two years. If you decline they are not set, and if you change your mind, choose Decline in "Cookie settings" in the footer and we remove them.

Security check (Cloudflare Turnstile)

On pages with a form, Cloudflare may use browser storage or similar technologies to run the bot check. Its purpose is to protect the form, not to advertise to you or to track you across other websites. Cloudflare explains how it handles this in its own privacy policy.

You can block or delete cookies in your browser settings. The site will still work, but some features, such as submitting a form, may not.

Your personal data is available only to people at Smart Tech Tank who need it, such as our hiring team for applications and our business team for enquiries. We share it outside the company only as follows:

• Service providers who help us run the website, such as hosting, email delivery and file storage providers. They may process data only on our instructions and under confidentiality and security obligations.
• Cloudflare, which provides the Turnstile security check on our contact and job application forms and receives the information described in "Information we collect".
• Google, which provides Google Analytics if you accept analytics cookies and receives the information described in "Information we collect". Google handles it under its own terms and privacy policy.
• Font delivery. The website loads its typefaces from Bunny Fonts, a privacy-focused font service. Your browser sends your IP address to that service when it requests the fonts.
• Professional advisers, such as lawyers, auditors and insurers, where needed for their advice.
• Government, regulators, courts and law enforcement, where we are required or permitted by law to disclose the data.
• A buyer or successor, if we are involved in a merger, acquisition or restructuring. We will make sure your data stays protected and tell you if its use changes materially.

Our service providers, including Cloudflare and Google, may store or process data on servers outside Malaysia. When this happens we take reasonable steps so that your data receives a standard of protection comparable to that required in Malaysia and rely on these providers' own contractual protections and security commitments for these transfers.

By submitting a form you consent to this kind of transfer, to the extent the PDPA requires your consent.

We keep personal data only as long as needed for the purpose it was collected for, and then delete or anonymise it. Our standard periods are:

• Contact enquiries: up to 24 months after our last communication with you, unless they lead to a contract, in which case we keep records for as long as the contract and our legal obligations require.
• Job applications: up to 12 months after the role is filled or closed. If you ask us to keep your details for future roles, we keep them for up to 24 months and then ask you to confirm again.
• Technical information such as IP address and user agent: kept with the related enquiry or application, and server logs for a short rolling period.
• Analytics data: kept in Google Analytics for up to 14 months, after which Google deletes it automatically.

We may keep data for longer where the law requires it, or where we need it to establish, exercise or defend a legal claim.

We take practical steps to protect personal data from loss, misuse, unauthorised access, modification and disclosure. These include encrypted connections (HTTPS) for all pages and forms, private storage for resumes that is not publicly accessible, role-based access for staff, rate limiting and a Cloudflare Turnstile bot check on forms, and regular software updates.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a data breach is likely to cause you significant harm, we will notify you and the relevant authority as required by law.

You have the right to:

• ask whether we hold your personal data, and request a copy of it;
• ask us to correct personal data that is inaccurate, incomplete or out of date;
• withdraw your consent, or ask us to limit or stop processing your data; and
• ask us to delete your data, where we no longer need it or have no legal reason to keep it.

To exercise these rights, contact us using the details at the end of this page. We may need to verify your identity first, and we aim to respond within 21 days, as the PDPA requires. We may decline a request in the limited cases the law allows, and we will explain why.

You can also complain to the Personal Data Protection Commissioner of Malaysia. If you are in the EEA or the UK, you may complain to your local data protection authority.

This website is intended for businesses, government bodies and adults. It is not directed at anyone under 18, and we do not knowingly collect personal data from them. If you believe a child has sent us personal data, contact us and we will delete it.

This website links to third-party sites, including our LinkedIn, Facebook and Instagram profiles. We do not control those sites and are not responsible for their content or privacy practices. Please read their policies before sharing personal data with them.

We may update this policy from time to time, for example when we change how the website works or when the law changes. The effective date at the top of this page shows when it was last updated. If a change is significant we will highlight it on the website. Continuing to use the website after an update means you accept the revised policy.

This Privacy Policy is made available in both English and Bahasa Malaysia in accordance with the requirements of the PDPA. In the event of any conflict between the English and the Bahasa Malaysia version, the English version shall prevail.

If you have a question about this policy, want to exercise your rights, or want to raise a concern, please write to our team using the details below. Mark your message "Privacy" so we can route it quickly.

Company

Smart Tech Tank Sdn Bhd

Email

[email protected]

Telephone

+60 3 5031 5257

Location

Shah Alam, Malaysia