Privacy Policy

WSS DevLabs ("we", "us", "our") respects your privacy and is committed to protecting your personal data in accordance with the Personal Data Protection Act 2010 (PDPA) of Malaysia. This policy applies to visitors of our website, prospective clients who contact us, and clients we deliver projects for.

By using this website or engaging our services, you acknowledge that you have read and understood how your data is handled as described below. If you do not agree with any part of this policy, please do not submit personal data to us and contact us with your concerns.

This policy covers:

• Data collected through our website, including contact and quotation forms.
• Data shared with us during project discovery calls, briefs, and correspondence.
• Data processed while we build, test, host, or maintain systems on your behalf.
• Data collected via cookies, analytics, and our website chat widget.

It does not cover the internal privacy practices of third-party platforms you may be redirected to (for example, WhatsApp or LinkedIn), which have their own privacy policies.

Depending on how you interact with us, we may collect:

• Contact details: name, email address, phone/WhatsApp number, company name, and job title.
• Project data: business requirements, workflows, existing systems, sample documents, credentials for staging environments, and any files you upload or share to help us scope or build your solution.
• Commercial data: quotation details, invoices, and payment confirmation records (we do not store full card numbers; payments are processed by our banking or payment partners).
• Communications: emails, WhatsApp messages, call notes, and chat widget conversations related to your enquiry or project.
• Technical data: aggregate, non-identifying analytics such as pages visited and general device type, collected only after you accept our cookie notice.

We only collect and process personal data with your knowledge and, where required by law, your explicit consent. Consent is obtained at the point data is given to us — for example, by submitting our contact form, replying to our WhatsApp number, or signing a project proposal that references this policy.

• You may withdraw consent at any time by contacting us; we will stop using your data for the relevant purpose going forward, subject to any legal or contractual retention requirements.
• Where a project agreement requires certain data to deliver the engagement (for example, staging credentials needed to build your system), withdrawing consent for that data may mean we are unable to continue the affected work.
• Cookie-based analytics is opt-in: nothing beyond essential site function loads until you click "Allow cookies" on the consent banner. See our Cookie Policy for details.

We use the data you provide to:

• Respond to enquiries and prepare quotations or proposals.
• Scope, design, build, test, deploy, and maintain the systems or websites you engage us for.
• Communicate project updates, invoices, and support requests.
• Provide after-sales support, bug fixes, and maintenance/subscription services you have signed up for.
• Improve our services and website based on aggregate, anonymised usage patterns.
• Comply with legal, accounting, and tax obligations.

We do not use your data for automated decision-making or profiling that produces legal effects, and we do not send marketing messages unless you have separately opted in.

Business information you share with us during a project — including internal processes, pricing, customer lists, source code, and unreleased product plans — is treated as confidential. Where a project involves sensitive information, we are glad to sign a mutual Non-Disclosure Agreement (NDA) before any details are exchanged, and our standard project agreements already include confidentiality clauses covering both parties.

• Only team members and vetted sub-contractors directly working on your project are given access to your data, strictly on a need-to-know basis.
• Any sub-contractor engaged on your project is bound by the same confidentiality obligations we hold ourselves to.
• Confidential information is never used for any purpose outside the engagement it was shared for, and is not disclosed to other clients or third parties.
• Confidentiality obligations survive the end of a project engagement.

We do not sell your personal data. We only share data with:

• Service providers that help us operate — our form processor (Web3Forms), our hosting/CDN provider (Cloudflare), and our chat widget provider (Botpress) — each solely to deliver the function you are using.
• Sub-contractors who assist on a specific project, bound by confidentiality as described above.
• Authorities, only where required by Malaysian law or a valid legal order.

We apply reasonable technical and organisational measures to protect your data, including access controls limited to the individuals working on your project, encrypted connections (HTTPS/TLS) across our website and client-facing tools, and secure credential handling for staging and production environments. No method of transmission or storage is 100% secure, but we continuously review our practices to reduce risk.

We keep personal data only as long as necessary for the purpose it was collected:

• Enquiries that don't convert: retained for up to 12 months, then deleted unless you ask us to keep in touch.
• Active and completed projects: retained for the duration of the engagement plus the applicable warranty/support period, and thereafter as required for accounting and legal purposes (typically up to 7 years under Malaysian tax law).
• Staging/production credentials: revoked or deleted once no longer needed for maintenance you've engaged us for.

Under the PDPA, you have the right to:

• Request access to the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Withdraw consent to processing, subject to the limitations described in Section 4.
• Request that we limit or stop processing your data for a specific purpose.
• Lodge a complaint with us, or with the relevant Malaysian authority, if you believe your data has been mishandled.

To exercise any of these rights, contact us using the details in Section 14. We will respond within 21 days as required by the PDPA.

Our services are intended for businesses and individuals aged 18 and above. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can delete it.

Some of our service providers (such as our hosting/CDN and chat widget partners) operate infrastructure outside Malaysia. Where this occurs, we rely on providers that maintain appropriate security standards, and data is only transferred as necessary to deliver the relevant function.

We may update this policy from time to time to reflect changes in our practices or the law. The "Last updated" date at the top of this page will always reflect the latest version. Material changes affecting active clients will be communicated directly.

Questions about this policy, or requests relating to your personal data, can be sent to our contact email or by phone at +6011-2720-5895. We're based in Kuala Lumpur, Malaysia.