How we look after your data.

Who we are

elejar.my is run by Paper Art Sdn. Bhd. (registration no. 201501022563 (1147892-V)), a company in Malaysia ("we", "us"). Our address is 2nd Floor, Lot 169, Sublot 6, Section 20, Jalan Tun Ahmad Zaidi Adruce, 93400 Kuching, Sarawak.

For your account, the early-access list and messages you send us, we decide how your personal data is used, so we are its data user under the Act. For the records you keep in your books, such as your customers', suppliers' and employees' details, your business is the data user and we process that data on your behalf, as your data processor.

What we collect

• Your account: your name, email address and password (stored only as a one-way hash), and the secret for your authenticator app.
• Sign-ins: for each sign-in and each wrong password or code, the time, your IP address, your browser and a rough location worked out from the IP address. We keep these for 90 days and show them to you under Your account, so you can spot a sign-in that wasn't you.
• Your books: the business records you enter or import, which can include personal data about your customers, suppliers and employees, such as names, contact details, tax numbers, bank details, salaries and EPF, SOCSO and income tax numbers.
• Early access: your name, work email, company and which kind of business you are, with the time you agreed to hear from us.
• Messages: what you send us through the contact page or by email.
• Technical records: your IP address, browser type and the pages you request, kept in our server logs to run and secure the service.
• Cookies: only the few the site needs to work. See the cookie policy.

We don't buy personal data about you from anyone else.

Why we use it

• To give you the service: signing you in, keeping your books, producing reports and, when you ask, submitting e-invoices.
• To keep it secure: two-step sign-in, the activity log of who changed what, and spotting misuse.
• To reply when you contact us, and to help when something goes wrong.
• To email you about early access, if you agreed to it. You can say no at any time.
• To bill you once paid plans start, and to meet our legal duties, such as tax and accounting records.

We don't sell personal data, and we don't use your books for advertising.

Who sees it

• People you invite: your accountant, bookkeeper or staff see what their role allows.
• LHDN: when you submit an e-invoice, its contents go to LHDN's MyInvois system on your instruction.
• Our service providers: companies that host our servers, deliver our email and, once billing starts, take payments. They act on our instructions under contract and may not use the data for themselves.
• Our staff: only where needed to run the service or to help you, and no more than that.
• Authorities: when the law requires it, or to protect someone's safety.

Where it's stored

Your data is stored on servers run by our hosting provider in hosting country to come. If any of it is stored or processed outside Malaysia, we make sure it is protected to a standard comparable to Malaysian law, as the Act requires.

How long we keep it

• Your account and books: for as long as your account is open. If you close it, you can download everything first. We keep the books for 30 days in case you change your mind, then delete them, and our backup copies roll off within about two weeks after that, unless the law requires us to keep something longer.
• Early access: until 12 months after we launch, or sooner if you ask.
• Messages: for two years, so we have the history if you write again.
• Server logs and sign-in history: for up to 90 days.

Keeping your own accounting records for seven years, as Malaysian law requires of businesses, stays your responsibility; download them before you close your account.

How we keep it safe

Every account uses two-step sign-in. Data travels over encrypted connections. Each company's books are kept in a separate database, every change is recorded with who made it, and the books are backed up daily with each copy checked to prove it can be restored. Our staff's access is limited to what their work needs.

Your rights

Under the Act you can ask us to:

• tell you what personal data we hold about you and give you a copy;
• correct data that is wrong, incomplete or out of date;
• stop using your data for a purpose you agreed to, such as early-access emails;
• limit how we process it; and
• send your data to you, or to another service, in a format a computer can read.

You can download a copy of your personal data yourself, as a file a computer can read, under Your account once you're signed in. For anything else, write to hello@elejar.my . We may need to confirm who you are first, and we'll reply within the time the Act allows. If personal data in your books is about someone else, such as an employee, they should ask your business, and we'll help you answer.

If you're not happy with how we've handled your data, you can complain to the Personal Data Protection Commissioner.

If something goes wrong

If there is a breach of personal data we hold, we'll tell the Personal Data Protection Commissioner and, where it could cause you significant harm, tell you too, as the Act requires. For data in your books, we'll tell your business promptly so you can do the same.

Children

elejar.my is for businesses. It isn't meant for anyone under 18, and we don't knowingly collect their data except where a business records it, for example on payroll.

Changes and languages

If we change this notice, we'll update the date at the top, and tell you by email or in the app if the change matters. A Bahasa Malaysia version of this notice will be published alongside the English one.

Contact us

Questions about privacy, or to use your rights: hello@elejar.my , or the contact page. Our data protection officer can be reached at the same address.