Dawnbreaker Digital privacy notice
Last updated: 3 November 2026
1. Who we are
DAWNBREAKER DIGITAL SDN. BHD. (Registration No. 202601036231 (1698326-A)) ("Dawnbreaker", "we", "us") is a Malaysian company. We build and run staff and payroll systems, business websites and custom business systems, for businesses in Malaysia. We are based in Malaysia, and we handle personal data under Malaysian law wherever you contact us from.
This notice explains how we collect and use personal data for our own business, as a data controller under the Personal Data Protection Act 2010 (PDPA).
2. Who this notice covers
This notice covers:
- visitors to our website, www.dawnbreakerdigital.com;
- people who message, call or e-mail us, including on WhatsApp;
- owners, directors and staff of businesses that ask about, buy or use our services, as our business contacts;
- introducers in our referral programme (accountants, company secretaries, payroll bureaus and clients), and people they introduce to us;
- people we write to by post; and
- our suppliers.
This notice does not cover employees' data inside a client's system. When a company uses our staff and payroll system, it controls its employees' data, and we process that data only on its instructions, as its data processor. If you work for one of our clients, your employer's personal data notice applies, and you should contact your employer. If you contact us instead, we will pass your request to your employer.
3. What personal data we collect
(a) Contact and identity details: your name, company, job title, phone or WhatsApp number, e-mail address and business address.
(b) Messages: the content of your WhatsApp messages and e-mails, and our notes of calls and meetings. This includes your WhatsApp profile name and photo, as WhatsApp shows them to us.
(c) Business information you share with us: for example, your number of staff, how you run payroll today, the tools you use and what you need.
(d) Referral information:
- for everyone, who introduced you to us;
- for introducers, your company's name, registration and tax details, the contact person, the company bank account for paying rewards, and records of introductions and rewards;
- if an introducer is a sole proprietor or partnership, not a company, the owner's or partners' names, IC numbers and income-tax numbers, which we may need to report payments to LHDN.
(e) Website data. Our website uses no analytics or advertising cookies. When you visit it:
- our web server, which Vultr hosts for us in Singapore, receives your IP address and browser details when it sends you the page;
- the page loads fonts from Google Fonts, so Google receives your IP address;
- the demos on the page keep what you tap in them in your own browser's storage, and send us nothing; and
- if you send the enquiry form, we receive what you put in it: your name, your business name, your phone or WhatsApp number, your e-mail address, your number of staff, the systems you are asking about and any message you write. We store it on our server, and a copy is sent to our e-mail inbox. We do not keep your IP address with it, only a scrambled code made from it, which stops the form being misused. Please do not put IC numbers, bank details or your staff's records in the form.
(f) Contract and payment records: quotes, agreements, invoices and payments.
(g) Testimonials and case studies: your name, words, company name or logo, but only with your separate written consent.
4. Where we get it
We get personal data:
- from you;
- from the person or company who introduced you, and we will tell you who that was when we first contact you. We ask introducers to get your permission before they give us your details; and
- from public sources, such as Companies Commission of Malaysia (SSM) records, your company's website and job advertisements your company has published. We use these to address letters to a company's director.
5. Why we use it
We use personal data to:
(a) reply to enquiries and give quotes;
(b) provide our systems, business websites and support;
(c) manage our agreements, invoices, payments and business records, including for tax and accounting;
(d) run our referral programme. This means tracking introductions, working out rewards and paying them to the introducing company, and telling each client introduced by a professional partner, in writing, that we pay that partner a fee;
(e) send you information about our services, where section 9 allows;
(f) keep our systems and records secure, prevent fraud and corruption, and meet our legal duties, such as tax reporting to the Inland Revenue Board (LHDN);
(g) handle complaints and legal claims; and
(h) publish a testimonial or case study, but only with your consent.
We also use it for any purpose directly related to these.
6. Do you have to give us your data?
No, it is voluntary. But without your contact details, we cannot reply to you. We also need certain details to enter into an agreement with you or to pay a referral reward.
7. Who we share it with
We share personal data with the following:
- Our service providers, who act on our instructions:
- WhatsApp, for messaging;
- Google, for our e-mail (Gmail) and for the fonts our website loads;
- Microsoft, for OneDrive storage of our records and encrypted backups;
- Backblaze, for off-site encrypted backup copies stored in the United States;
- Anthropic, for AI tools that help us analyse, draft and organise our work;
- Vultr, for our servers in Singapore, which also host our website;
- GitHub, for our source code; and
- Cloudflare, for domain names and DNS.
- Our accountant, auditor, company secretary, tax agent, legal advisers and bank.
- The person or company who introduced you. We tell them whether you became a client and what reward is due. We do not tell them what your files contain or what we discussed.
- You, if you were introduced by a professional partner. We tell you, in writing, the fee we pay that partner.
- Government bodies, regulators, the police and the courts, where the law requires. These include LHDN and the Personal Data Protection Commissioner.
- A buyer of, or successor to, our business, under a duty of confidentiality.
- Anyone else, with your consent.
We do not sell personal data.
Our providers change from time to time. The version of this notice on our website is always the current list, and the date at the top shows when it last changed.
8. Transfers outside Malaysia
Some of the providers in section 7 process data outside Malaysia. The places are Singapore (our servers and our website) and the United States (our AI tools, our source-code hosting and our off-site encrypted backup copies). Our e-mail (Google) and our OneDrive storage (Microsoft) are held in those companies' data centres, which may be in the United States or in other countries. We transfer personal data outside Malaysia only as section 129 of the PDPA allows. For example:
- where the place has a law substantially similar to the PDPA;
- where we have taken reasonable precautions, through contracts with the provider, to protect the data to the PDPA's standard; or
- where you have consented.
Backup copies are encrypted before they leave our servers, and the storage providers cannot read them.
9. Marketing messages, and how to stop them
- We send information about our services only to people who have asked for it, to our clients, and to people introduced to us with their permission. We may also write once, by post, to a company's director at an address the company has made public (see section 4).
- We do not buy contact lists. We do not send bulk or broadcast WhatsApp messages to people who have not asked for them.
- You can stop our marketing at any time. Reply "STOP" (or "BERHENTI"), or tell us in any other way. We will stop within 7 days. We will keep your number or address on a do-not-contact list, so that we do not contact you again. You have this right under section 43 of the PDPA.
- If we write to you by post and you do not reply, we will not write again.
10. How long we keep it
| Data | Kept for |
|---|---|
| Enquiries that do not lead to business | Up to 24 months after our last contact, then deleted |
| Agreements, invoices, and client and referral records | For the relationship, and 7 years after it ends, to meet tax and accounting duties |
| Do-not-contact list | For as long as we send marketing. We keep only what we need to honour your request |
| Testimonials and case studies | Until you withdraw consent. Printed material already given out cannot be recalled |
| Copies of the above inside our encrypted backups | Daily copies are deleted 61 days after they are made. Monthly copies are kept 13 months. Our off-site copies are locked for their first 30 days and cannot be deleted in that time, even by us |
What that last row means for a deletion request. If you ask us to delete your personal data, we delete it from our live records straight away, and it then disappears from our backups as those backups expire on the cycle above. We cannot pull a single person's data out of an encrypted backup copy, and we cannot delete an off-site copy while it is locked. Those copies are encrypted, we do not read them, and we do not use them for anything except restoring a system after a failure.
11. How we protect it
We take practical steps to protect personal data from loss, misuse, and unauthorised access or disclosure. These steps include:
- backups that are encrypted before they leave the server;
- off-site backup copies that cannot be altered or deleted for 30 days after they are made, so that neither a mistake nor an attacker can destroy them in that time;
- a separate write-only key for each server, so that a server can add backup copies but cannot read them; and
- access limited to the people who need it.
No system is perfectly secure. If a personal data breach affects data covered by this notice, we will notify the Personal Data Protection Commissioner, and you, where the PDPA requires. For data in a client's system, we tell the client, and the client decides.
12. Your rights
Under the PDPA, you may:
- ask for access to the personal data we hold about you (section 30). We will reply within 21 days. We may ask you to prove your identity, and we may charge a fee within the limit set by the Personal Data Protection (Fees) Regulations 2013;
- ask us to correct your personal data (section 34);
- withdraw your consent (section 38). This may limit what we can do for you;
- ask us to stop processing that is causing, or is likely to cause, substantial damage or distress (section 42);
- ask us to stop direct marketing (section 43; see section 9 above);
- ask us to transmit your personal data to another data controller, where this is technically feasible (section 43A); and
- complain to the Personal Data Protection Commissioner (Jabatan Perlindungan Data Peribadi, www.pdp.gov.my).
To make a request, contact us using the details in section 14. For data held in a client's system, we will pass your request to your employer.
13. Data protection contact
Questions about personal data at Dawnbreaker can be sent to our director, using the contact details in section 14.
14. Contact us
DAWNBREAKER DIGITAL SDN. BHD.
E-mail: dawnbreakerdigital@gmail.com
15. Children
Our services are for businesses. They are not aimed at anyone under 18.
16. Changes to this notice
We may update this notice. The date at the top shows the latest version. We will tell our clients about significant changes.
17. Language
This notice is published in Bahasa Malaysia and English. If the two versions differ, the English version prevails.