Privacy Policy

1. Introduction

This Privacy Policy explains how Talent Reform Consulting Sdn. Bhd. (Registration No. 202401034083 (1579931-K)), operating the NovaCampaign platform, collects, uses, and protects data. NovaCampaign is a business-to-business (B2B) marketing campaign management platform that enables companies to send email and WhatsApp messages to their contacts.

In providing our services, we act in two capacities: as a data controller for client account data, and as a data processor on behalf of our clients for end-consumer contact data.

2. Legal Basis for Processing

We process personal data under the following legal bases, in accordance with GDPR and applicable data protection laws:

• Contract performance -- processing necessary to provide the NovaCampaign platform service as agreed with our clients
• Legitimate interest -- improving service quality, ensuring platform security, and preventing fraud, where such interests are not overridden by data subject rights
• Consent -- where explicitly provided by the individual, such as WhatsApp messaging opt-in or cookie preferences
• Legal obligation -- where processing is required to comply with applicable laws or regulations

For end-consumer data processed on behalf of our clients, the client (as data controller) is responsible for establishing the appropriate legal basis for their data processing activities.

3. Data We Collect

Client Account Data (Controller)

We collect and manage the following data as a data controller for our business clients:

• Company name and business registration details
• User credentials (name, email address, hashed password)
• Billing and payment information
• Channel configuration (email SMTP settings, WhatsApp Business Account details)

End-Consumer Data (Processor)

We process the following data on behalf of our clients, who remain the data controllers for their end consumers:

• Contact names and identifiers
• Phone numbers and email addresses
• Message content and campaign data
• Message delivery status and engagement metrics
• Opt-in and opt-out records

4. How We Use Data

We use collected data for the following purposes:

• Operating and maintaining the NovaCampaign platform
• Delivering messages via email and WhatsApp on behalf of clients
• Providing campaign analytics and delivery reports
• Managing message templates and content
• Processing billing and usage tracking
• Providing customer support and platform improvements

5. Data Sharing

We share data only as necessary to provide our services. Our sub-processors include:

• Meta / WhatsApp Business API -- for delivering WhatsApp messages on behalf of clients
• Client's email provider -- for delivering email messages via the client's configured SMTP service
• Hosting infrastructure -- for platform hosting and data storage

We do not sell, rent, or trade personal data to third parties for marketing purposes.

6. Cross-Border Data Transfers

Your data may be processed in regions where our hosting providers and sub-processors operate. When data is transferred outside your jurisdiction, we ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs) -- where applicable, we use EU-approved SCCs for transfers to countries without an adequacy decision
• Malaysia PDPA -- as our primary jurisdiction, we comply with the Malaysia Personal Data Protection Act 2010
• Sub-processor agreements -- all sub-processors are bound by data processing agreements that include appropriate transfer mechanisms

7. Data Retention

• Account data is retained for as long as the client account remains active, plus 30 days after termination.
• Contact data is retained according to the client's own retention settings and deleted upon the client's request or account termination.
• Message logs (delivery status, timestamps) are retained for 90 days for troubleshooting and analytics, then automatically purged.

8. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access -- request a copy of the personal data we hold about you
• Correction -- request correction of inaccurate or incomplete data
• Deletion -- request deletion of your personal data (GDPR Article 17). You can submit a deletion request via our data deletion page.
• Portability -- request your data in a structured, machine-readable format
• Right to object -- object to the processing of your personal data in certain circumstances

For end consumers whose data is processed on behalf of our clients: please direct your data rights requests to the company that collected your information. As a data processor, we will assist our clients in fulfilling these requests.

9. Cookies

NovaCampaign uses only essential cookies required for platform operation:

• Authentication cookies -- session JWT tokens to keep you signed in
• Cookie consent preference -- to remember your cookie consent choice

We do not use tracking cookies, advertising cookies, or third-party analytics cookies.

10. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will notify affected clients via email at least 14 days before the changes take effect. The "Last updated" date at the top of this page indicates when this policy was last revised.

11. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us:

• Data Protection Officer: training@talentreform.com.my
• Company: Talent Reform Consulting Sdn. Bhd.

For GDPR data subject requests (access, correction, deletion, portability), please email our Data Protection Officer at the address above. We will respond to all verified requests within 30 calendar days.