Privacy Policy

This Privacy Policy explains how Leafloat Robotics Sdn Bhd (Leafloat, we, us) collects, uses and protects personal data when you interact with our website, platforms and services at leafloat.tech. This Policy is governed by the Personal Data Protection Act 2010 (PDPA) of Malaysia and is intended to comply with its requirements.

The data controller responsible for your personal data is Leafloat Robotics Sdn Bhd, D-4-13 One South, Jln OS One South, Seri Kembangan, Selangor 43300, Malaysia — hello@leafloat.tech.

Information We Collect

We collect the following categories of personal data:

• Contact and identity data: full name, job title, employer / company name
• Communication data: email address, phone number, and the content of enquiries submitted via our contact, demo request, and ROI estimate forms
• Professional data: industry sector and areas of interest you indicate when making an enquiry
• Technical data: IP address, browser type, referring URL, pages visited, and time of visit (collected automatically via web analytics)
• Operational telemetry: usage and performance data from deployed systems under contract, where applicable

We do not knowingly collect personal data from individuals under 18 years of age. Our products and services are directed exclusively at business entities and their authorised representatives.

How We Use Information

We use your personal data to operate and improve our platforms, respond to enquiries, fulfil contractual obligations, and produce aggregated analytics for product development. We do not sell personal information. Specifically:

• Responding to your product or service enquiries — Performance of a contract / pre-contractual steps
• Providing quotations, proposals, and technical documentation — Performance of a contract
• Managing ongoing commercial relationships — Performance of a contract
• Sending you relevant updates about products, case studies, or events (where you have consented or where we have a legitimate interest) — Consent / Legitimate interest
• Improving our website, products, and services through analytics — Legitimate interest
• Complying with legal obligations, regulatory requirements, or court orders — Legal obligation

We do not sell, rent, or trade your personal data to third parties. We may share your personal data with:

• Our technology service providers (cloud hosting, CRM, email delivery) acting as data processors under our instruction and bound by appropriate data processing agreements
• Our authorised distributors or resellers where relevant to fulfilling your enquiry in your region, only with your knowledge
• Regulatory authorities or courts where required by Malaysian law or a valid legal order

Where your data is transferred outside Malaysia, we take steps to ensure adequate protections are in place consistent with the PDPA and any applicable guidelines issued by the Personal Data Protection Commissioner.

Data Storage & Security

Customer telemetry and personal data are processed under contractual confidentiality, with role-based access control and audit logging. Storage region is configurable per deployment. We implement appropriate technical and organisational measures — including encrypted data transmission (TLS), access controls, and regular security reviews — to protect personal data against unauthorised access, alteration, disclosure, or destruction. No method of transmission over the internet is completely secure; while we take reasonable precautions, we cannot guarantee absolute security.

We retain personal data only for as long as necessary for the purposes for which it was collected:

• Enquiry records: 3 years from the date of last contact, unless a commercial relationship develops
• Customer and contractual records: 7 years from the end of the contract (for tax and statutory compliance purposes)
• Marketing consent records: until withdrawal of consent
• Web analytics data: 26 months (aggregated; no individual retention)

Our website also uses cookies and similar technologies: strictly necessary cookies required for the website to function (session management, security — cannot be disabled), and analytics cookies used to measure traffic and usage patterns (no personal identifiers stored). You may disable analytics cookies through your browser settings; disabling strictly necessary cookies may affect website functionality.

Your Rights

Under Malaysia's Personal Data Protection Act 2010, you have the following rights:

• Right of access: request a copy of the personal data we hold about you
• Right of correction: request correction of inaccurate or incomplete personal data
• Right to withdraw consent: where processing is based on consent, withdraw it at any time
• Right to limit processing: request that we restrict processing of your data in certain circumstances
• Right to prevent processing for direct marketing: opt out of direct marketing communications at any time

These rights remain subject to legitimate business needs and mandatory legal retention obligations. To exercise any of these rights, contact us at hello@leafloat.tech. We will respond within 21 days. We may need to verify your identity before processing your request.

Contact

Questions about this policy, or requests to exercise your rights, may be sent to our Data Protection Officer: Leafloat Robotics Sdn Bhd, D-4-13 One South, Jln OS One South, Seri Kembangan, Selangor 43300, Malaysia — hello@leafloat.tech.

If you are not satisfied with our response, you have the right to lodge a complaint with the Department of Personal Data Protection Malaysia (Jabatan Perlindungan Data Peribadi).

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or business operations. We will post the updated policy on this page with a revised "Last updated" date. For material changes, we will notify active contacts by email.