Privacy Policy
1. Data collection
1.1 Categories we may process
Depending on the modules you use, we may collect and process:
- Personal and corporate identity data, including user identity and business contact details
- Account and authentication data (email, name, role, credentials metadata)
- Company / tenant configuration and operational records you enter into FAOS
- Order records, PO records, delivery records, invoice records, and operational logs required to operate FAOS, WMS, Finance, and Atlas-related workflows
- Financial and logistics data required to run workflows you enable
- Security and audit telemetry, including IP addresses, device identifiers, operator IDs, scan timestamps, session identifiers, device / browser signals, and (where available) approximated coarse geolocation derived from IP for fraud and abuse prevention
- Device identifiers and diagnostic context (for example a stable device or installation UUID, user-agent, app build, and correlated log context) to investigate incidents and demonstrate account integrity
- Support communications you send to us
2. Purpose
We use data to:
- Provide, operate, and secure the Platform
- Maintain session integrity and prevent account takeover
- Detect, investigate, and remediate misuse or operational incidents
- Improve reliability and performance using aggregated techniques where permitted
- Comply with legal obligations
3. No data selling
We do not sell personal or company data.
4. Data sharing
Data may be shared with:
- Infrastructure and hosting providers strictly as needed to run the service
- Payment processors for billing
- Authorities when required by law or to protect rights and safety
4a. Subprocessors and service categories
To operate the Platform we may engage subprocessors or service providers in the following categories (not an exhaustive vendor list; providers may change as the stack evolves):
- Cloud hosting / compute / storage — application and database hosting
- Email / messaging delivery — transactional and support messages
- Payment processing — subscription billing (e.g. card checkout providers)
- Observability / error and uptime monitoring — reliability and security telemetry
- CDN / DNS / edge security — content delivery and abuse protection where used
Such parties process data only as needed to provide their service to us, under contractual confidentiality / data-processing terms where applicable. For a current category confirmation or enterprise diligence request, contact info@orbitasolution.com.
4b. Enterprise data processing terms (DPA)
Enterprise customers that require a formal Data Processing Agreement (DPA) or additional processing schedules may request them in writing. Contact info@orbitasolution.com with your company legal name, country, and required annexes. Until a separate DPA is signed, this Privacy Policy and the Terms & Conditions govern processing for the Service.
5. Security disclaimer
We implement reasonable administrative, technical, and organisational safeguards.
However, no system is completely secure.
5a. Our privacy commitment & your account security
We protect your privacy. We process personal and company data to operate and secure the Platform, with company-scoped isolation, and we do not sell personal data. Details are in this Privacy Policy and applicable law (including PDPA principles where Malaysia applies). See also Sections 4a–4b (subprocessors / DPA) and Section 14 (security incident notification where required by law).
You must protect your account. Keep passwords, verification codes, API/connector secrets, and devices confidential. Do not share logins. Notify us promptly of suspected unauthorised access. Compromise caused by shared or weak credentials remains your responsibility; we apply reasonable safeguards but cannot warrant absolute security. Related terms: Terms §41.
6. Data risk
Users acknowledge that storing data on the Platform carries inherent risk.
7. User rights
Users may request access, correction, or deletion of eligible personal profile data, subject to applicable law and verification requirements.
Depending on your location, you may also have additional rights such as restriction, portability, objection, withdrawal of consent, or complaint to a supervisory authority, subject to legal limits and operational integrity requirements.
8a. Retention
Personal data is retained only for as long as necessary to provide the service, maintain account records, satisfy security requirements, or comply with statutory tax, accounting, audit, and regulatory obligations.
Transactional tracking records, carton movements, picking logs, delivery confirmation records, invoice histories, audit trails, and ledger-linked operational records may be retained where required for audit, tax, accounting, fraud prevention, dispute resolution, security, or regulatory obligations.
8. Cookies
We use cookies for login, session continuity, performance, and security. Details: Cookie Policy.
9. Updates
This policy may be updated. Material changes may be communicated where practicable.
Sections 10–12 are available in English, Chinese, and Malay. Use the language selector in the page header (top right) to read the matching text.
10. Audit trail, session integrity, and approximated location
To protect accounts and provide an evidentiary baseline after suspected compromise or internal operational disputes, we may record:
- Source IP address and derived coarse geolocation (typically region/city-level, not continuous GPS tracking)
- Device / browser fingerprinting signals and stable device identifiers where used by the product
- Correlated log context (routes, error classes, session lifecycle markers) strictly for security and support
These records are not marketed as courtroom-grade evidence, but they exist to support proportionate investigation, access control, and accountability consistent with our role as a service provider.
10. 审计轨迹、会话完整性与近似定位
为保护账户安全，并在发生疑似盗用或内部操作争议时提供可核查的证据基线，我们可能记录：
- 来源 IP 地址及由其推导的粗略地理位置（通常为区域/城市级别，并非持续 GPS 追踪）
- 设备/浏览器指纹类信号，以及产品层面使用的稳定设备标识符
- 与上述信息相关联的日志上下文（如路由、错误类别、会话生命周期标记），严格用于安全与客服排障
该等记录不承诺达到“司法级证据”标准，但用于在合理范围内支撑调查、访问控制与责任追溯，并与我们作为服务提供者的角色相一致。
10. Jejak audit, integriti sesi, dan anggaran lokasi
Untuk melindungi akaun dan menyediakan asas keterangan selepas kompromi disyaki atau pertikaian operasi dalaman, kami mungkin merakam:
- Alamat IP sumber dan anggaran geolokasi kasar (biasanya peringkat wilayah/bandar, bukan penjejakan GPS berterusan)
- Isyarat cap jari perisian/pelayar dan pengecam peranti stabil jika digunakan oleh produk
- Konteks log yang berkaitan (laluan, kelas ralat, penanda kitaran hidup sesi) untuk keselamatan dan sokongan
Rekod ini tidak dijual sebagai bukti mahkamah mutlak, tetapi wujud untuk menyokong siasatan berkadar, kawalan akses, dan akauntabiliti konsisten dengan peranan kami sebagai penyedia perkhidmatan.
11. Malaysia PDPA 2010 — alignment statement
Where Malaysian law applies, we aim to process personal data consistently with the Personal Data Protection Act 2010 (PDPA), including the general themes of:
- General consent & notice — processing for stated purposes related to service delivery
- Purpose limitation — not repurposing personal data incompatibly without a lawful basis
- Security principle — reasonable measures against loss, misuse, alteration, and unauthorised access
- Retention & disposal — keeping data no longer than needed for legal, security, and operational purposes
- Data integrity — taking reasonable steps to keep data accurate where it is in our control to do so
- Access & correction — responding to requests subject to verification and legal exceptions
This section is a high-level compliance orientation, not an exhaustive legal statement. Your organisation may have additional statutory duties depending on sector and jurisdiction.
11. 马来西亚《2010 年个人资料保护法》(PDPA) — 对齐声明
在适用马来西亚法律的情况下，我们力求按照 PDPA 的一般原则处理个人资料，包括但不限于：
- 一般同意与告知：为与提供服务相关的目的而处理
- 目的限制：不在缺乏合法基础的情况下将个人资料用于不相容目的
- 安全原则：采取合理措施防范丢失、滥用、篡改与未经授权访问
- 保存与处置：在法律、安全与运营需要范围内保存，并适时处置
- 资料完整性：在我们可控范围内采取合理步骤保持准确
- 查阅与更正：在核实身份与法定例外前提下响应请求
本段为高层合规取向说明，不构成穷尽式法律意见。贵司仍可能因行业与司法辖区承担额外法定义务。
11. PDPA 2010 Malaysia — penyelarasan
Di mana undang-undang Malaysia terpakai, kami berusaha memproses data peribadi konsisten dengan Akta Perlindungan Data Peribadi 2010 (PDPA), termasuk tema umum:
- Kebenaran umum & notis — pemprosesan untuk tujuan yang dinyatakan berkaitan penyampaian perkhidmatan
- Had tujuan — tidak menggunakan semula data peribadi secara tidak serasi tanpa asas sah
- Prinsip keselamatan — langkah munasabah terhadap kehilangan, penyalahgunaan, pengubahan, dan akses tidak dibenarkan
- Pengekalan & pelupusan — mengekalkan data tidak lebih lama daripada yang diperlukan untuk tujuan undang-undang, keselamatan, dan operasi
- Integriti data — langkah munasabah untuk mengekalkan ketepatan setakat dalam kawalan kami
- Akses & pembetulan — bertindak balas kepada permintaan tertakluk kepada pengesahan dan pengecualian undang-undang
Seksyen ini ialah orientasi pematuhan peringkat tinggi, bukan kenyataan undang-undang lengkap. Organisasi anda mungkin mempunyai kewajipan statutori tambahan bergantung pada sektor dan bidang kuasa.
12. Data sovereignty: your export right vs anonymised platform analytics
Subject to technical feasibility and legal retention limits, customers generally retain the ability to export their tenant-held business records through product features or agreed support processes.
Separately, Orbita may process aggregated and anonymised telemetry to improve reliability, capacity planning, incident response, and product stability — where this does not re-identify individuals or tenants in a non-permitted way.
Anonymised stability analysis is not a substitute for your statutory record-keeping obligations; it is a platform hygiene activity.
12. 数据主权：导出权与匿名化平台分析
在技术上可行且符合法定保存限制的前提下，客户通常可通过产品功能或约定支持流程导出其租户侧业务记录。
另一方面，在不对个人或租户进行不允许的再识别前提下，Orbita 可能对汇总且匿名化的遥测数据进行处理，以用于可靠性、容量规划、事件响应与产品稳定性改进。
匿名化稳定性分析不能替代贵司法辖区的法定簿记义务；其性质为平台层面的卫生与工程治理活动。
12. Kedaulatan data: hak eksport vs analitik platform tanpa nama
Tertakluk kepada kebolehlaksanaan teknikal dan had pengekalan undang-undang, pelanggan biasanya mengekalkan keupayaan untuk mengeksport rekod perniagaan yang disimpan penyewa melalui ciri produk atau proses sokongan yang dipersetujui.
Berasingan, Orbita mungkin memproses telemetri agregat dan tanpa nama untuk meningkatkan kebolehpercayaan, perancangan kapasiti, tindak balas insiden, dan kestabilan produk — di mana ini tidak mengenal pasti semula individu atau penyewa dengan cara tidak dibenarkan.
Analisis kestabilan tanpa nama bukan pengganti kewajipan rekod statutori anda; ia ialah aktiviti kebersihan platform.
13. Processing purposes, analytics, commercial sale prohibition, and security posture
Subject to applicable law and the relevant sections above, Personal Data may be processed for legitimate business purposes tied to provisioning the Service — including tenancy administration, invoicing workflows, access control, auditing, troubleshooting, abuse prevention, and product analytics aggregated at a level that does not re-identify individuals in a prohibited way.
Unless we notify you separately and obtain any consent required by law where applicable, Orbita does not sell personal or tenant business contact lists as traditional “list sales” inventory. (Commercial subscription fees for the SaaS remain separate.)
Security is implemented using reasonable administrative, technical, and organisational safeguards that evolve with threats. Nonetheless, no hosting environment is immune from attack. We cannot warrant absolute security, continuous confidentiality, or that every incident will never occur. You should maintain your own contingency, backup discipline, breach notification processes, and insurance programmes appropriate for your jurisdiction and sector.
13. 处理目的、分析、商业化出售禁止与安全立场
在适用法律与本政策前述段落约束下，我们可能基于与提供服务密切相关的合法商业目的处理个人资料，包括但不限于租户治理、账务/开票类工作流所需的配套处理、权限与审计、排障与滥用防护，以及在不违反再识别禁令前提下的产品层统计与稳定性分析。
除依法另行征得同意或其他合法基础另有要求外，Orbita不向第三方按“通讯录/名单叫卖”等传统方式出售可用于营销的个人资料或租户业务联系人明细（与客户为使用产品而支付的软件订阅费用无关）。
我们采取合理并随威胁演进的管理、技术及组织层面的安全措施。但任何云平台都无法承诺绝对不发生安全事件或百分之百持续机密性。贵司仍应结合自身司法辖区和行业要求保留备份、应急响应与恰当的保险安排。
13. Tujuan pemprosesan, analitik, larangan penjualan data, dan postur keselamatan
Tertakluk kepada undang-undang yang terpakai dan seksyen terdahulu dalam dasar ini, Data Peribadi boleh diproses untuk tujuan perniagaan sah berkaitan penyampaian Perkhidmatan — termasuk pentadbiran penyewa, aliran kerja invois, kawalan akses, audit, penyelesaian masalah, pencegahan penyalahgunaan, dan analitik produk di peringkat agregat yang tidak mengenal pasti semula individu dengan cara yang dilarang.
Melainkan kami memberitahu anda secara berasingan dan memperoleh sebarang kebenaran yang diperlukan oleh undang-undang (jika terpakai), Orbita tidak menjual senarai hubungan peribadi atau senarai perniagaan penyewa sebagai inventori “penjualan senarai” konvensional. (Yuran langganan SaaS kekal berasingan.)
Keselamatan dilaksanakan melalui langkah pentadbiran, teknikal, dan organisasi yang munasabah dan akan berubah bersama ancaman. Walau bagaimanapun, kami tidak dapat menjamin keselamatan mutlak, sulit berturutan tanpa sekatan, atau bahawa sesuatu insiden tidak akan berlaku. Anda perlu mengurus sandaran anda sendiri, proses maklumat insiden yang sesuai, dan perlindungan insurans.
14. No commercial sale or rental of personal data; permitted disclosures
Orbita does not sell, rent, or share personal data or tenant business data with third parties for commercial marketing purposes (for example traditional “list broker” sales).
User data is used solely for the operation, security, and improvement of the platform and compatible purposes described elsewhere in this Policy (including aggregated analytics where permitted above).
Data may be disclosed only where required by applicable law, legal process, or regulatory obligations, where necessary to protect the rights, safety, and integrity of Users and the Service, or where processed by vetted service providers acting on our instructions under appropriate confidentiality and data-processing terms. For related contractual assurances on “tool-only” capacity and User verification, see also the Terms & Conditions (including Section 38).
14. 不以商业目的出售或出租个人数据；允许的披露情形
Orbita不出售、不出租、不因商业营销目的与第三方共享个人资料或租户业务数据（例如传统的“名单经纪”式销售）。
用户数据仅用于本平台的运营、安全与改进，以及本政策其他相容条款所述目的（包括上文允许范围内的汇总分析）。
仅在适用法律、法定程序或监管义务要求，为保护用户与服务的权利、安全与完整性所必需，或由受适当保密与数据处理条款约束的服务商依指示处理时，方可披露数据。与「仅为工具」及用户核验义务相关的合同性表述，亦见《条款与条件》（含第38条）。
14. Tiada jualan atau sewaan data peribadi untuk tujuan komersial; pendedahan yang dibenarkan
Orbita tidak menjual, menyewa, atau berkongsi data peribadi atau data perniagaan penyewa dengan pihak ketiga untuk tujuan pemasaran komersial (contohnya jualan “broker senarai” konvensional).
Data pengguna digunakan semata-mata untuk operasi, keselamatan, dan penambahbaikan platform serta tujuan serasi yang diterangkan dalam Dasar ini (termasuk analitik agregat di mana dibenarkan di atas).
Data hanya boleh didedahkan apabila dikehendaki oleh undang-undang yang terpakai, proses undang-undang, atau kewajipan kawal selia, apabila perlu untuk melindungi hak, keselamatan, dan integriti Pengguna dan Perkhidmatan, atau apabila diproses oleh pembekal perkhidmatan yang disaring bertindak mengikut arahan kami di bawah kerahsiaan dan terma pemprosesan data yang wajar. Untuk jaminan kontrak berkaitan kapasiti “alat sahaja” dan pengesahan pengguna, lihat juga Terma & Syarat (termasuk Seksyen 38).
14. Data Security & Processing Addendum — System patrols and operational advisory (Atlas framework)
2. SYSTEM PATROLS & OPERATIONAL ADVISORY (ATLAS FRAMEWORK)
The “Atlas” management intelligence layer provides passive workflow patrols and risk signals designed for early operational anomaly detection.
a) Operational Paradigm:
Atlas operates on a strict, read-only paradigm regarding customer-owned underlying inventory values, transactional records, and ledger balances.
b) Authority & Liability Limitation:
Atlas insights, alerts, and automated recommendations are intended exclusively to support operational decision-making and risk identification.
Final execution and override authority remain entirely within the discretion of authorized customer personnel.
Customers retain sole responsibility for validating all operational, financial, inventory, manufacturing, and regulatory actions prior to system commitment.
Orbita assumes no liability for operational or financial variances resulting from corporate actions taken in reliance upon Atlas advisory outputs.
Incident notification
Where required by applicable law, and in the event of a confirmed security breach that materially and adversely affects isolated customer data, Orbita Solutions will notify the designated corporate administrator within 72 hours of verification, providing available technical telemetry and containment steps.
Security controls are designed to reduce risk and minimize unauthorized access through company-scoped logical segregation. No system can guarantee absolute security or immunity from every breach scenario.
Privacy enquiries: info@orbitasolution.com · Terms & Conditions