Privacy policy
Introduction
CALACC is operated by CALMIC SDN BHD (SSM 202201031605). This policy explains how we collect, use, disclose and safeguard information when you use our website and the CALACC application.
Information we collect
We collect information you provide directly, including:
- Account information — name, email address and company details.
- Billing information, processed by our payment provider rather than stored by us.
- Communications you send to support or sales.
- Business records you enter — invoices, bills, payroll and employee data.
We also record technical information generated by using the service, such as sign-in times and actions taken inside the application, which form the audit log.
How we use it
- To provide and maintain the service.
- To process transactions and produce the reports and filings you request.
- To send service messages, security notices and support replies.
- To improve the product.
- To meet legal and statutory obligations.
Page views on this website
The public pages carry a simple counter showing how many times they have been viewed. It records a date and a count, nothing else — no IP address, no cookie, no device fingerprint, and no per-visitor record, so there is nothing that identifies you. Automated traffic such as search-engine crawlers is excluded. Because no personal data is involved, it is not something you need to consent to, and there is nothing to request or erase.
Business records belong to your company
Accounting, payroll and employee records you enter belong to your company. We process them on your instruction to operate the service. We do not sell them, and we do not use them for advertising.
Data security
Access is scoped per company, credentials are stored as salted hashes, sign-in can require a second factor, and sensitive actions are recorded in the audit log. Traffic is served over TLS with secure cookies. No system is entirely secure, and we describe the controls we actually operate on the security page rather than making certification claims.
Retention
Accounting and payroll records are retained for the period required by Malaysian tax and company law. Where a record must be kept, a deletion request is handled through a review flow rather than an immediate purge, so a statutory obligation is not broken by a support request.
Your rights
Under the Personal Data Protection Act 2010 you may request access to, correction of, or (where no retention obligation applies) deletion of your personal data. We may need to verify your identity before acting on a request.
Disclosure
We disclose information to service providers who help us operate the product (hosting, email delivery, payment processing) under contract, and where required by law or a regulator.
Contact
Privacy enquiries and data requests: calmic@calmic.com.my.