Privacy Policy

Last updated: 14 October 2026

This Privacy Policy explains how PASSIVE ALTITUDE SDN. BHD. (Registration No. 201701005502 (1219667-X)) ("Passive Altitude", "we", "us") collects, uses, discloses and protects personal data under Malaysia's Personal Data Protection Act 2010 (the "PDPA"). It covers our website, our dealings with clients and prospective clients, and the platforms we build and operate. Where a signed client agreement sets out different data protection terms, that agreement applies to the data it covers.

Our role

For our website, enquiries and client relationships, we decide how personal data is used, so we are the data controller.

When we run a platform for a client, such as event registration, ticketing, check-in, attraction booking, an online shop or hotel software, the client (the organiser, operator, merchant or hotel) is the data controller and we are their data processor. We handle that data only on the client's instructions. If you bought a ticket, registered or placed an order through one of these platforms, the client's privacy notice applies and the client is your first point of contact. We will help them with your request.

Personal data we collect

• Website enquiries: your name, company, email, phone number, area of interest and message. With each contact form message we also record the time, your IP address, browser details and the page you sent it from, to prevent spam and abuse.
• Clients and their staff: names, job titles, business contact and billing details, contracts, correspondence, and platform login details.
• People using client platforms: registration and attendee details, ticket and order records, check-in records, badge and delivery details, and anything else the client's forms ask for.
• Payments: online payments are processed by third-party payment gateways. Passive Altitude does not receive or store your full card details. We may receive a transaction reference, amount, payment status and limited details such as the card type or last four digits.

We collect data directly from you, from our clients (for example, an attendee list an organiser uploads), automatically when you use our website or platforms, and from third parties such as payment gateways.

We do not seek sensitive personal data, such as health information, for our own purposes. If a client's form asks for it (for example, dietary or accessibility needs), the client is responsible for obtaining the explicit consent the PDPA requires.

Fields marked as required are needed for us to respond or provide the service; without them we may not be able to. Everything else is optional.

Why we use it

• To respond to enquiries and prepare quotations.
• To provide, set up, support and improve our services.
• To process orders, invoices, payments and refunds.
• To deliver tickets, confirmations and service messages by email or WhatsApp.
• To keep our systems secure and prevent fraud.
• To send business updates about our services where you have agreed or the law permits. You can opt out at any time.
• To meet our legal, tax and regulatory obligations.

Who we share it with

We do not sell personal data. We share it only as needed for the purposes above, with:

• the client on whose behalf we process it, such as the organiser of an event you registered for;
• hosting, cloud, email and messaging providers, including WhatsApp;
• payment gateways and banks;
• couriers, installers and subcontractors who help us deliver services;
• professional advisers, such as auditors and lawyers;
• authorities, regulators or courts, where the law requires it;
• a buyer or successor, if our business is transferred.

Anyone who processes personal data for us must keep it confidential and secure.

Transfers outside Malaysia

Some of our providers store or process data outside Malaysia, for example in Singapore and other locations used by our cloud and messaging providers. We transfer personal data abroad only as the PDPA allows, such as where the destination gives comparable protection, or where the transfer is needed to perform a contract with you or you have consented.

How long we keep it

• Enquiries that do not lead to business: 24 months after our last contact.
• Client records: for the relationship and 7 years after it ends. Accounting and tax records are kept for at least seven years, as Malaysian law requires.
• Data we process for clients: as our agreement with the client sets out, or otherwise deleted or returned within 90 days after the agreement ends.
• Backups: overwritten on a rolling cycle of 30 days.

How we protect it

We use encrypted connections (HTTPS), role-based access controls, strong authentication for administrative access, staff confidentiality obligations and checks on our providers. No system is completely secure, but we review our measures regularly. If a personal data breach occurs, we will notify the Personal Data Protection Commissioner and affected people where the law requires, and tell affected clients promptly.

Your rights

Under the PDPA you can:

• ask for access to, and a copy of, the personal data we hold about you;
• ask us to correct data that is inaccurate, incomplete, misleading or out of date;
• withdraw consent, or ask us to limit how we process your data;
• ask us to stop processing likely to cause you substantial damage or distress;
• ask us to stop using your data for direct marketing;
• where the PDPA provides for it, ask us to transmit your data to another data controller.

We will reply within 21 days of receiving a complete request, as the PDPA requires, or tell you within that time if we need longer. We may ask you to verify your identity. Requests are free of charge. If we cannot meet a request, for example because the law requires us to keep the data, we will explain why. Requests about data we process for a client are passed to that client, and we help them respond.

Withdrawing consent

Email [email protected] with the subject "Withdraw consent", or use the unsubscribe link in any marketing email. We will act on your request within 14 days. Withdrawing consent may mean we can no longer provide some services. It does not affect processing already carried out, or processing the law requires.

Cookies and analytics

This website does not use advertising cookies or third-party analytics. It stores one setting in your browser's local storage to remember whether you have chosen reduced motion, which you can clear in your browser settings. Our web host keeps standard server logs (IP address, time, pages requested and browser type) for security, for 30 days. If we add analytics or other cookies, we will update this policy and ask for consent where required.

Client platforms such as ticketing pages and online shops use cookies needed for logins, carts and checkout, and may use analytics chosen by the client, as described in the client's own notice.

Language

This notice is published in English. A Bahasa Malaysia version is available on request.

Notis Privasi ini juga boleh didapati dalam Bahasa Malaysia. Sila hubungi kami di [email protected] untuk mendapatkan salinan.

Changes to this policy

We may update this policy. The date at the top shows when it last changed, and we will tell clients directly about significant changes.

Contact us about your data

• Data Protection Officer, PASSIVE ALTITUDE SDN. BHD.
• Phone: +603 7890 2655
• Email: [email protected] (subject: "Personal data request")
• Post: PASSIVE ALTITUDE SDN. BHD., A-05-05, Block A, Ativo Plaza, No. 1, Jalan PJU 9/1, Damansara Avenue, Bandar Sri Damansara, 52200 Kuala Lumpur