Privacy Policy

1. Who we are

This Privacy Policy is issued by SOLVNEX DIGITAL SDN BHD (Registration No. 202101026823 (1427123-P)), a company incorporated in Malaysia, with its office at Level 23, Menara Exchange 106, Lingkaran TRX, Tun Razak Exchange, 55188 Kuala Lumpur ("Solvnex", "we", "us" or "our").

We are the data controller for the personal data described in this policy, within the meaning of the Personal Data Protection Act 2010 as amended by the Personal Data Protection (Amendment) Act 2024 ("PDPA").

2. Who this policy covers

This policy applies to personal data we process about:

• Website visitors: anyone who visits solvnex.com.
• Clients and prospects of our consulting and technology services: including digital transformation consulting, software development and the Solvnex Progress Sprint, and the individuals who work for those organisations and deal with us.
• Talent platform users: Gig Professionals who offer services, and Business users (Clients) who post projects, on the Solvnex talent platform.
• Job applicants, suppliers and partners: and the individuals who represent them.

3. Personal data we collect

Depending on how you deal with us, we may collect:

• Identity data: name, identity card (MyKad) or passport number, date of birth, gender, photograph and, for talent platform verification, a photo or video of you holding your identity document.
• Contact data: email address, mobile and office phone numbers, postal address, company name and job title.
• Professional data: work experience, skills, qualifications, certificates, portfolio, ratings, reviews and feedback.
• Financial data: bank account details for payouts, invoices, payment records, tax identification number and statutory contribution records (for example PERKESO / SOCSO).
• Communications data: emails, enquiries, messages sent through the talent platform, meeting notes and recordings where you have been told a session is recorded.
• Technical data: IP address, browser type, device information and pages visited.
• Sensitive personal data: we do not seek sensitive personal data (such as health information or biometric data) unless it is needed for a specific purpose, for example medical coverage records a Gig Professional chooses to provide. We process sensitive personal data only with your explicit consent or where the PDPA otherwise allows it.

4. How we collect it

• Directly from you, when you email us, send an enquiry or register your interest through a form on our website, message us on WhatsApp, book a call, sign an engagement, register on the talent platform, create a profile, post or accept a project, or apply for a role.
• From your organisation, when it engages us and names you as a contact or project stakeholder.
• From third parties, such as identity verification providers, referees and publicly available professional profiles, where lawful.
• Automatically, when you use our website or platform (see section 9).

5. Why we use it

We process personal data to:

1. Respond to enquiries and provide proposals and quotations.
2. Deliver consulting, software development and Progress Sprint engagements, including workshops, testing and handover.
3. Operate the talent platform: verify identity, match Gig Professionals with projects, manage projects, handle disputes and complaints, and process payments and platform fees.
4. Meet legal and regulatory obligations, including those under the Gig Workers Act 2025, the Employees' Social Security Act 1969 and Self-Employment Social Security Act 2017, tax law and anti-fraud requirements.
5. Keep our services secure, prevent fraud and misuse, and enforce our agreements and Code of Conduct.
6. Improve our website, services and platform through analysis and testing.
7. Send updates and marketing about our services, where you have agreed or where the law allows it. You can opt out at any time (see section 11).
8. Any other purpose you consent to at the time we collect the data.

6. What happens if you do not provide it

Where data is marked as required, or is needed to verify identity, pay you or meet a legal obligation, we may not be able to provide the service, register you on the talent platform or process payments without it.

7. Who we share it with

We share personal data only as needed for the purposes above, with:

• Our related companies, subsidiaries and associated companies.
• Service providers who process data on our behalf (data processors), such as cloud hosting, email, identity verification, payment and accounting providers. They must protect the data and use it only on our instructions.
• Other platform users, to the extent needed for a project: for example, a Client sees a Gig Professional's profile, and names appear on project invoices and purchase orders.
• Government and regulatory bodies, such as PERKESO / SOCSO, the Inland Revenue Board (LHDN), the Personal Data Protection Commissioner and law enforcement, where required by law.
• Professional advisers, such as lawyers, auditors and insurers.
• A buyer or successor, if all or part of our business is sold or restructured, subject to this policy.

We do not sell personal data.

8. Transfers outside Malaysia

Some of our service providers store or process data outside Malaysia, for example cloud infrastructure in Singapore. When we transfer personal data outside Malaysia, we do so in line with the PDPA and the Commissioner's guidelines on cross-border transfer, and we require the recipient to provide a level of protection comparable to the PDPA.

9. Cookies and similar technologies

The Solvnex website does not set cookies. Its fonts and images are served from our own website, so loading a page does not send your IP address to third-party font or image services. The talent platform may use cookies that are needed to keep you signed in and secure.

We use Vercel Web Analytics to count page visits and clicks on buttons such as "Send enquiry", so we can see which pages and campaigns are useful. It does not use cookies, does not identify you and does not follow you across other websites. It records the page, the referring site, your approximate location (country and city), and your device type, operating system and browser. Visitors are distinguished using a value calculated from the incoming request, which is discarded after 24 hours, and results are shown to us only as totals. We also use Vercel Speed Insights to measure how quickly our pages load for real visitors. It does not use cookies and records only the page, your device type and loading-time measurements. When you arrive through a link that carries a campaign tag (for example from a LinkedIn post), we store that tag with any enquiry you send, so we know which campaign it came from.

If we add non-essential cookies, we will update this section and, where required, ask for your consent first. You can block or delete cookies in your browser settings; some platform features may then stop working.

10. How we protect it

We use administrative, technical and physical safeguards, including encryption of data in transit (TLS), encrypted cloud storage, access controls limited to staff who need the data, and security monitoring.

If a personal data breach is likely to cause significant harm, we will notify the Personal Data Protection Commissioner within 72 hours of becoming aware of it, and notify affected individuals without unnecessary delay, as required by the PDPA.

11. Your rights

Subject to the PDPA, you have the right to:

• Access the personal data we hold about you and receive a copy.
• Correct personal data that is inaccurate, incomplete, misleading or out of date.
• Withdraw consent or limit our processing, including for direct marketing.
• Data portability: ask us to transmit your personal data to another data controller, where technically feasible and the data is in a compatible format.
• Prevent processing likely to cause damage or distress.

To make a request, email hello@solvnex.com with the subject "Personal Data Request". We may need to verify your identity and may charge a fee permitted by law for access requests. We will respond within the time the PDPA requires (currently 21 days for access and correction requests).

To stop marketing emails, click "unsubscribe" in any marketing email or tell us by email.

12. How long we keep it

We keep personal data only as long as needed for the purposes in section 5, or as required by law (for example, financial and tax records are generally kept for at least 7 years). Enquiries and interest registrations sent through our website that do not lead to an engagement are deleted 24 months after our last contact with you. Talent platform accounts that are inactive for 6 months or more may be closed, after which we keep only what we need for legal, tax, dispute or audit purposes. When data is no longer needed, we delete or anonymise it securely.

13. Your responsibilities

Please make sure the personal data you give us is accurate and up to date. If you give us personal data about someone else (for example a colleague or referee), you confirm that you are allowed to do so and that they know about this policy.

14. Children

Our services are not intended for individuals under 18. We do not knowingly collect personal data from them. The talent platform is open only to individuals who can form a legally binding contract.

15. Changes to this policy

We may update this policy from time to time. We will post the updated version on this page with a new "Last updated" date. If a change materially affects how we use your personal data, we will notify registered users by email or through the platform before the change takes effect.

16. Contact us and complaints

For questions, requests or complaints about personal data, contact our Data Protection Officer:

• Email: hello@solvnex.com (subject: "Attention: Data Protection Officer")
• Post: Data Protection Officer, SOLVNEX DIGITAL SDN BHD, Level 23, Menara Exchange 106, Lingkaran TRX, Tun Razak Exchange, 55188 Kuala Lumpur

If you are not satisfied with our response, you may complain to the Personal Data Protection Commissioner of Malaysia.

17. Language

This policy is available in English and Bahasa Malaysia. If there is any inconsistency, the English version prevails, unless the law requires otherwise.