Privacy Notice

Notis Privasi

Version 1.0 · Effective 24 September 2026

This page is in English, followed by Bahasa Malaysia. If the two versions are inconsistent, the English version prevails.
Halaman ini dalam Bahasa Inggeris, diikuti Bahasa Malaysia. Jika terdapat percanggahan, versi Bahasa Inggeris diguna pakai.

This notice explains how Teras Core Technology Sdn. Bhd. (SSM No. 202601029932 (1692027)), the operator of HRWork, handles personal data under the Personal Data Protection Act 2010 (PDPA), as amended by the Personal Data Protection (Amendment) Act 2024. It is our notice under section 7 of the PDPA.

1. Our role: controller or processor

  • Employee data: your employer is in charge. When a company uses HRWork, it decides what employee data to collect and why. The company is the data controller. We are its data processor: we store and process that data only to run the service for the company, on its instructions. If you are an employee, your employer's own privacy notice applies too, and requests about your employee record should go to your employer first. We will help your employer answer them.
  • Our own customers and visitors: we are in charge. For the people who sign up and manage company accounts, who pay our invoices, who contact us, or who use our website, we are the data controller.

2. What we collect and where it comes from

From company admins and customers (we are controller)

  • Name, work email, phone number, company name and the company's HRWork web address, given when you register.
  • Your password (stored only in scrambled, hashed form) and sign-in records.
  • If you choose Sign in with Google: your name, email address and Google account ID, received from Google.
  • Billing records: invoices, plan, amounts, and the payment confirmation and reference we receive from CHIP. We never receive your full card number or bank login.
  • Messages you send us by email, WhatsApp, phone or our contact form.

Employee data (we are processor for your employer)

Entered by your employer's HR team, by you through employee self-service, or created as you use the app:

  • Identity and contact: name, IC or passport number, date and place of birth, gender, nationality, race, religion, marital status, photo, phone, email and addresses.
  • Family and emergency contacts: spouse and children details, emergency contact details.
  • Employment and pay: job, department, manager, dates of joining and leaving, salary and allowances, bank account, EPF, SOCSO, EIS and income tax numbers, payroll results, payslips, EA forms and zakat settings.
  • Time off and claims: leave records, medical certificates, and expense claims with receipts.
  • Attendance: clock-in and clock-out times, the GPS location at the moment you clock in or out, and a clock-in selfie if your employer turns it on.
  • Work records: documents and e-signatures, offer letters, appraisals and KPIs, tasks, notes and comments.

Some of this is sensitive personal data under the PDPA: health (medical certificates and medical claims) and religious belief. Your employer is responsible for having a lawful basis, including your explicit consent where the PDPA requires it.

From website visitors

  • Contact form: your name, email and message. We send it to our team by email; it is not stored in the app's database.
  • Salary calculator "email me the result": your email address, used only to send you the result.
  • Technical data: IP address, browser type and the pages requested, recorded in our server logs. We use cookies only to keep you signed in and protect forms (session and security cookies). We do not use advertising or analytics trackers on our website.

3. Why we use it

  • To provide HRWork: accounts, payroll and statutory calculations, leave, claims, attendance and the other features your company uses.
  • To verify attendance, when your employer uses location or selfie clock-in.
  • To send service emails, such as invitations, login codes, approvals, notifications and service announcements.
  • To bill customers and record payments.
  • To answer enquiries and give support.
  • To keep the service secure, prevent misuse and fix problems.
  • To meet our legal obligations, such as tax and accounting record keeping.

We do not sell personal data, and we do not use employee data for our own marketing.

4. Do you have to give it?

  • To register: name, email, phone and company name are required. Without them we cannot create or look after your account.
  • Employee data: your employer decides which fields are required, usually those needed for payroll and statutory contributions (such as IC number, bank account and EPF/SOCSO/EIS/tax numbers). If you don't give them, your employer may not be able to pay you or make statutory contributions through HRWork.
  • Location and camera: only needed if your employer requires location or selfie clock-in. If you refuse permission, you cannot clock in from the app; ask your employer about other ways.
  • Everything else (for example Sign in with Google, a profile photo or the calculator email) is optional.

5. Who we share it with

  • People in your company who have access under the roles your employer sets up, such as HR, payroll and your managers.
  • Our service providers (subprocessors) listed below, only as needed for the service.
  • Authorities when the law requires it, or to protect our rights and the safety of others.
  • A buyer or successor, if our business is sold or merged, under the same protections.

Your employer, not us, submits payroll and statutory data to bodies such as KWSP, PERKESO and LHDN, and pays salaries to your bank.

Our subprocessors

ProviderWhat they do for usLocation
DigitalOcean, LLCCloud hosting: the servers, database and file storage that run the HRWork web app, mobile app API and website.Data centre outside Malaysia
CHIP (chip-in.asia)Payment processing for subscription invoices. You enter your card or bank details on CHIP's page, not ours.Malaysia
Zoho Corporation (ZeptoMail)Sending service emails: invitations, login codes, notifications, approvals and replies to enquiries.May be outside Malaysia
Google LLCSign in with Google (optional); Google Maps Platform to find the coordinates of office and home addresses for attendance, and address suggestions in the profile form; Google Fonts for the website's font.Outside Malaysia
BunnyWay d.o.o. (Bunny Fonts)Font delivery on a company's public front page.Outside Malaysia

Face and blink checks at clock-in run on your own device. We do not send your face to any face-recognition service, and we do not store a face template. We will update this list before we add a new subprocessor.

6. Transfers outside Malaysia

Our hosting servers and some of our providers are outside Malaysia, so your data is transferred abroad. Under section 129 of the PDPA, we do this only where the destination has a law substantially similar to the PDPA or gives an adequate level of protection, or where another ground in section 129 applies (for example, the transfer is needed to perform our contract with you). We choose providers that commit to protect the data.

7. How we protect it

  • Data travels over encrypted HTTPS connections.
  • Each company's data is kept separate, and access inside a company follows the roles its admins set.
  • Passwords are stored hashed. In the mobile app, your sign-in token is kept in the phone's secure storage (Keychain or Keystore) and removed when you sign out.
  • Only staff who need access to run and support the service have it.

8. Data breaches

If a personal data breach happens:

  • Where we are the controller, we will notify the Personal Data Protection Commissioner within 72 hours of becoming aware of it. We will also tell affected individuals without undue delay if the breach is likely to cause them significant harm.
  • Where we are the processor, we will tell the affected company without undue delay and give it the information it needs to notify the Commissioner and its employees.

9. How long we keep it

DataHow long
Company account and employee dataWhile the company account is open. After it closes, 30 days (so the company can ask for an export), then deleted, unless the company asks us in writing to keep it longer or the law requires us to.
Payroll records (payroll runs, payslips, EA forms, statutory amounts)Employers must keep payroll records for 7 years under the Income Tax Act 1967. They stay in the account while it is open. When a company closes its account, it should export them first, or ask us in writing to keep them for the rest of the 7 years.
Our invoices and payment records7 years, under the Income Tax Act 1967.
Enquiries and support messagesUp to 2 years after our last contact with you.
Calculator result emailsNot kept; your address is used only to send the email.
Server logsOnly as long as needed for security and troubleshooting.

Your employer can also delete employee records earlier within HRWork.

10. Your rights and how to use them

Under the PDPA you can:

  • Access the personal data we hold about you, and get a copy.
  • Correct data that is wrong, incomplete or out of date. Many details can be updated yourself in the app.
  • Withdraw consent or ask us to limit processing, including for direct marketing.
  • Data portability: ask for your data to be sent to another data controller in a commonly used format, where technically feasible.
  • Deletion: ask us to delete data we no longer need. See also Account Deletion.

How to ask: email hello@hrwork.my from the email address linked to your account, with the subject "PDPA request", and say what you want. We may ask you to confirm your identity. We will respond within 21 days. If we need longer, or can't agree to the request, we will tell you why within that time. Employees: for your employee record, please ask your employer's HR first. If you write to us, we will pass your request to your employer and help it respond.

11. Data Protection Officer

Our Data Protection Officer handles privacy questions, requests and complaints. Contact: Data Protection Officer, Teras Core Technology Sdn. Bhd., No 26-1 Jalan Sunsuria 1B/2, Jasper Square, Bandar Sunsuria, 43900 Sepang, Selangor; email hello@hrwork.my (subject "PDPA request"); phone +60 18-588 2459.

12. Complaints

Please contact us first so we can try to put things right. You also have the right to complain to the Personal Data Protection Commissioner (Jabatan Perlindungan Data Peribadi) at pdp.gov.my.

13. The HRWork mobile app

The app is for employees of companies that use HRWork; accounts are created by the employer. It asks for these device permissions, and only uses them for the reasons shown:

  • Location (while using the app only): read once when you clock in or out, to record where you clocked in. The app does not track your location in the background.
  • Camera: for the clock-in selfie and to photograph claim receipts.
  • Photos: to attach receipt images to a claim or choose a profile photo. Only the pictures you pick are uploaded.

The app collects the data described in section 2 for employees: your account details, attendance times, location and selfie at clock-in, claims and receipts, leave and the records you view. It also records the device name when you sign in. It contains no advertising, uses no advertising ID and does not track you across other companies' apps or websites. It has no third-party analytics SDK.

14. Children

HRWork is a business service. It is not meant for anyone under 18, and we do not knowingly collect children's data through our website or app. Employers may record details of an employee's children (for example, for tax relief); that data is handled as employee data above.

15. Changes to this notice

We will post any update here with a new version number and effective date, and email account admins about important changes.