Personal Data Protection Notice (PDPA 2010)

1. Scope & Identity of Data Controller

This Notice informs subscribers, law firms, legal practitioners, and authorized representatives regarding how CEC AUTOMATION AI SOLUTIONS ("Company", "we", "us", or "our"), as a relevant data user and cloud processor, collects, records, holds, manages, and protects personal data in connection with the CecAI Studio™ software platform.

2. Categories of Personal Data Processed

In operating our conveyancing automation and legal document intelligence engine, we process:

• Subscriber Account & Administrative Data: Full name of legal practitioner or firm manager, professional work email, firm registered name, Bar Council membership number (where provided), contact telephone number, billing address, and corporate tax identification;
• Conveyancing Matter Documents & Party Data: Scanned documents uploaded by subscribers for automated optical character recognition, including Land Titles (*Geran Hakmilik*), MyKad / Identity Cards, International Passports, SSM corporate entity profiles, developer sale agreements, and bank facility letters containing individual names, identity numbers, addresses, and property valuations;
• Technical Telemetry & Audit Logs: Access timestamps, IP addresses, browser user-agent signatures, API transaction hashes, and error logs required for forensic security monitoring.

3. Lawful Purposes of Data Processing (Section 6 PDPA)

We process personal data strictly for lawful purposes directly related to our business operations:

1. To provision, maintain, and deliver our optical character recognition and conveyancing document synthesis services;
2. To extract title details, proprietor names, and restrictions on interest for automated insertion into National Land Code instruments (Borang 14A, Borang 16A);
3. To verify billing transactions, administer monthly subscriptions, and generate official tax invoices via Stripe;
4. To provide technical assistance, legal engineering support, and platform outage troubleshooting;
5. To comply with legal, regulatory, taxation, and statutory requirements under Malaysian law.

4. Adherence to the 7 Statutory PDPA Principles

4.1 General Principle

Personal data is processed solely with customer consent, for contract fulfillment, or in compliance with legal obligations. We do not collect personal data beyond what is strictly necessary to perform document extraction.

4.2 Notice and Choice Principle

Subscribers are informed in writing through this Notice of the nature of data collected, purpose of processing, and communication choices. Subscribers may opt out of promotional updates while retaining essential operational notifications.

4.3 Disclosure Principle

Personal data is NEVER rented, sold, bartered, or disclosed to third parties. We share data solely with verified infrastructure sub-processors (Stripe for payment processing, Cloudflare for DDoS protection and edge SSL) bound by strict confidentiality and data protection agreements.

4.4 Security Principle

We maintain comprehensive technical, physical, and organizational safeguards:

• 256-bit AES encryption at rest across all databases and object storage buckets;
• TLS 1.3 encryption in transit for all web and API communications;
• Strict multi-tenant cryptographic isolation ensuring zero cross-tenant visibility;
• Role-based access controls (RBAC) ensuring our engineering personnel cannot inspect customer document contents without explicit customer authorization.

4.5 Retention Principle

We retain personal data only for as long as necessary to fulfill subscription services or satisfy statutory accounting and tax retention periods. Customer document files may be permanently deleted by the subscriber at any time via the web console.

4.6 Data Integrity Principle

Our platform provides side-by-side human-in-the-loop verification interfaces allowing legal clerks to review, verify, and correct extracted entities before compiling final instruments.

4.7 Access Principle

Pursuant to Section 30 of the PDPA, data subjects retain the right to request access to and correction of personal data held by us, upon payment of the statutory fee (if applicable).

5. Legal Professional Privilege & Zero AI Foundation Training Covenant

We recognize that legal documents often embody privileged solicitor-client communications under Section 126 of the Evidence Act 1950. Company formally covenants that uploaded customer documents, scanned deeds, and generated contracts are NEVER utilized to train, fine-tune, or calibrate public artificial intelligence models. Inferences occur strictly within isolated, private inference pipelines.

6. ASEAN Data Residency & Cross-Border Transfer

In compliance with Section 129 of the PDPA, all core production databases, document processing nodes, and backup systems are situated strictly within the ASEAN geographical zone (Malaysia and Singapore). We do not transfer conveyancing matter documents to offshore jurisdictions outside ASEAN.

7. Data Subject Access Requests (DSAR) Protocol

To submit a statutory Data Subject Access Request or Data Correction Request under the PDPA, email our designated Data Protection Officer at privacy@cecaiautomation.my. We will process and respond to verified statutory requests within twenty-one (21) calendar days of receipt.

8. Data Protection Officer (DPO) Contact Details