Notis Privasi BossBaju
Versi 2026-10-19b · Berkuat kuasa: 19 Oktober 2026
Notis ini menerangkan bagaimana data peribadi diproses dalam aplikasi web BossBaju, selaras dengan Akta Perlindungan Data Peribadi 2010 (Akta 709) seperti yang dipinda oleh Akta Perlindungan Data Peribadi (Pindaan) 2024 (Akta A1727).
1. Siapa kami
BossBaju dikendalikan oleh NSEVEN DIGITAL MARKETING (No. Pendaftaran SSM: 202503053645 (AS0491593-P)), 28, Jalan Uda Utama 4/6, Bandar Uda Utama, 81200 Johor Bahru, Johor ("kami").
- Bagi data akaun anda (pemilik kedai dan staf), kami ialah pengawal data.
- Bagi data yang peniaga masukkan tentang pelanggan dan pekerja mereka, peniaga ialah pengawal data dan kami ialah pemproses data yang memproses data itu bagi pihak peniaga sahaja.
2. Data peribadi yang kami proses
| Jenis data | Contoh | Sumber |
|---|---|---|
| Data akaun | Nama, alamat e-mel, kata laluan (disimpan dalam bentuk selamat oleh penyedia log masuk), peranan dalam kedai (pemilik / staf / Akaun) | Anda sendiri; Google (jika anda log masuk dengan Google) |
| Data perniagaan | Nama kedai, produk, gambar produk, stok, jualan, belanja, laporan | Peniaga dan staf |
| Data pelanggan peniaga | Nama, nombor telefon, sejarah pembelian, baki hutang | Peniaga dan staf |
| Data pekerja peniaga | Nama, tarikh lahir, kewarganegaraan, status LINDUNG 24 Jam, kadar gaji, rekod kedatangan, pendahuluan, potongan, slip gaji, caruman KWSP / PERKESO / SIP | Peniaga dan staf Akaun |
| Suara (ciri Cakap) | Rakaman suara semasa anda menekan butang Cakap, dan teks (transkrip) arahan itu | Anda sendiri / staf yang menekan Cakap |
| Gambar resit & invois (ciri Baca resit) | Gambar resit belanja atau invois pembekal, dan maklumat yang dibaca daripadanya (jumlah, tarikh, no. resit, nama kedai) | Anda sendiri / staf yang mengambil atau memilih gambar |
| Data teknikal | Rekod log masuk dan rekod ralat server yang diperlukan untuk keselamatan | Peranti anda semasa menggunakan aplikasi |
Kami tidak meminta nombor kad pengenalan, nombor akaun bank, atau data peribadi sensitif (kesihatan, agama, pendapat politik, kesalahan, biometrik).
3. Tujuan
- Menyediakan dan mengendalikan BossBaju: rekod jualan, stok, pelanggan, belanja, laporan, gaji dan caruman.
- Mengurus akaun, log masuk, peranan dan jemputan staf.
- Menjaga keselamatan, mengesan dan membaiki ralat.
- Menjawab pertanyaan dan aduan anda.
- Mematuhi undang-undang.
Kami tidak menjual data peribadi. Kami tidak menggunakan data pelanggan atau pekerja peniaga untuk tujuan kami sendiri atau untuk pemasaran.
4. Kepada siapa data didedahkan
- Google LLC / Google Cloud (Firebase) — penyedia pelayan, pangkalan data, log masuk dan simpanan gambar yang kami gunakan.
- OpenAI, L.L.C. — hanya bila anda menggunakan ciri Cakap atau Baca resit: rakaman suara ditukar menjadi teks, dan teks itu bersama senarai nama produk, saluran dan kategori belanja kedai disusun menjadi draf untuk anda semak; gambar resit atau invois dibaca (bersama senarai kategori belanja atau nama pembekal kedai) untuk mengisi draf borang. Menurut OpenAI, data yang dihantar melalui API tidak digunakan untuk melatih model mereka.
- Ahli kedai yang sama — ikut peranan yang ditetapkan oleh pemilik kedai (contoh: staf biasa tidak nampak gaji; hanya pemilik dan staf Akaun nampak gaji).
- Pihak berkuasa — jika dikehendaki oleh undang-undang atau perintah mahkamah.
Laman web jualan (bossbaju.com): laman ini menggunakan Meta Pixel (Meta Platforms, Inc.) untuk mengukur keberkesanan iklan kami — contohnya bila anda membuka laman atau menekan butang chat. Meta Pixel menggunakan kuki dan maklumat pelayar anda. App BossBaju sendiri (tempat data kedai anda disimpan) tidak menggunakan Meta Pixel.
5. Pemindahan data ke luar Malaysia
Data disimpan oleh Google Cloud di luar Malaysia:
- Singapura — pangkalan data dan pelayan aplikasi;
- Amerika Syarikat — gambar produk, gambar resit belanja dan gambar invois pembekal; dan pemprosesan suara serta gambar resit oleh OpenAI bila ciri Cakap atau Baca resit digunakan.
Tujuan pemindahan ialah untuk menyimpan dan memproses data supaya BossBaju dapat berfungsi. Dengan menanda kotak persetujuan semasa mendaftar, anda bersetuju dengan pemindahan ini (Akta 709 seksyen 129). Persetujuan anda direkod.
6. Keselamatan
Kami mengambil langkah praktikal untuk melindungi data, antaranya: sambungan HTTPS, log masuk wajib, kunci pangkalan data yang mengasingkan setiap kedai, dan akses ikut peranan. Jika berlaku pelanggaran data yang boleh menyebabkan kemudaratan ketara, kami akan memaklumkan Pesuruhjaya Perlindungan Data Peribadi dan pihak yang terjejas seperti yang dikehendaki undang-undang, dan memaklumkan peniaga yang terlibat tanpa kelewatan.
7. Tempoh simpanan
Data disimpan selagi akaun kedai aktif. Selepas akaun ditutup, peniaga diberi 30 hari untuk memuat turun data, kemudian data dipadam secara kekal, kecuali jika undang-undang mewajibkan simpanan lebih lama. Salinan sandaran (backup) harian disimpan sehingga 98 hari, kemudian dipadam sendiri secara automatik — data yang telah dipadam mungkin masih ada dalam salinan sandaran sehingga tempoh itu tamat. Rakaman suara (ciri Cakap) tidak disimpan oleh BossBaju — ia hanya dihantar untuk ditukar menjadi teks; transkrip disimpan bersama rekod penggunaan Cakap. Gambar resit dan invois disimpan bersama rekod belanja / pembelian sebagai bukti, selagi akaun kedai aktif. Menurut OpenAI, teks dan gambar yang dihantar boleh disimpan oleh OpenAI sehingga 30 hari untuk pemantauan penyalahgunaan. Nota kepada peniaga: undang-undang buruh mewajibkan majikan menyimpan rekod gaji pekerja sekurang-kurangnya 6 tahun — sila muat turun rekod anda sebelum menutup akaun.
Kedai demo (demo.bossbaju.com): data dalam kedai demo dikunci 24 jam selepas demo dimulakan dan dipadam kekal secara automatik 24 jam kemudian. Tiada salinan sandaran dibuat untuk kedai demo.
8. Hak anda
- Akses — minta salinan data peribadi anda.
- Pembetulan — minta data yang salah atau tidak lengkap dibetulkan. Kebanyakan data boleh diubah sendiri dalam aplikasi.
- Tarik balik persetujuan dan hadkan pemprosesan — melalui notis bertulis. Jika persetujuan ditarik balik, akaun mungkin tidak dapat digunakan lagi.
- Kebolehpindahan data — minta data dihantar kepada pihak lain, tertakluk kepada kebolehlaksanaan teknikal.
Hantar permintaan secara bertulis ke e-mel di bahagian 11. Kami akan menjawab dalam tempoh 21 hari. Fi permintaan akses (jika dikenakan) tidak melebihi kadar dalam Peraturan-Peraturan Perlindungan Data Peribadi (Fi) 2013.
Pelanggan atau pekerja kepada peniaga: sila hubungi peniaga berkenaan dahulu kerana mereka ialah pengawal data anda. Kami akan membantu peniaga menjawab permintaan anda.
9. Wajib atau sukarela
Alamat e-mel (atau akaun Google) adalah wajib untuk membuka akaun. Tanpanya, anda tidak boleh menggunakan BossBaju. Data lain diberi mengikut ciri yang anda gunakan — contohnya tarikh lahir dan kewarganegaraan pekerja diperlukan untuk mengira caruman; jika tidak diberi, ciri gaji tidak dapat digunakan untuk pekerja itu. Ciri Cakap (suara) dan Baca resit (gambar) adalah sukarela — semua kerja boleh dibuat melalui borang biasa.
10. Tanggungjawab peniaga
Sebagai pengawal data, peniaga bertanggungjawab memberi notis privasi sendiri dan, jika perlu, mendapatkan persetujuan pelanggan dan pekerja mereka sebelum memasukkan data mereka ke dalam BossBaju — termasuk persetujuan ibu bapa atau penjaga bagi sesiapa yang berumur bawah 18 tahun. BossBaju bertujuan untuk pengguna berumur 18 tahun ke atas.
11. Hubungi kami
Pegawai yang dihubungi: Pemilik perniagaan
E-mel: nsevendigitalmarketing@gmail.com
Telefon: [NO. TELEFON]
Alamat: 28, Jalan Uda Utama 4/6, Bandar Uda Utama, 81200 Johor Bahru, Johor
Anda juga boleh membuat aduan kepada Jabatan Perlindungan Data Peribadi (www.pdp.gov.my).
12. Perubahan notis
Kami mungkin mengemas kini notis ini. Versi dan tarikh terkini dinyatakan di atas. Jika perubahan penting dibuat, anda akan diminta membaca dan bersetuju semula semasa log masuk.
BossBaju Privacy Notice
Version 2026-10-19b · Effective: 19 October 2026
This notice explains how personal data is processed in the BossBaju web application, in accordance with the Personal Data Protection Act 2010 (Act 709) as amended by the Personal Data Protection (Amendment) Act 2024 (Act A1727).
1. Who we are
BossBaju is operated by NSEVEN DIGITAL MARKETING (SSM Registration No.: 202503053645 (AS0491593-P)), 28, Jalan Uda Utama 4/6, Bandar Uda Utama, 81200 Johor Bahru, Johor ("we").
- For your account data (shop owners and staff), we are the data controller.
- For data that merchants enter about their customers and employees, the merchant is the data controller and we are a data processor processing that data solely on the merchant's behalf.
2. Personal data we process
| Type of data | Examples | Source |
|---|---|---|
| Account data | Name, email address, password (stored securely by the sign-in provider), role in the shop (owner / staff / Accounts) | You; Google (if you sign in with Google) |
| Business data | Shop name, products, product photos, stock, sales, expenses, reports | Merchant and staff |
| Merchant's customer data | Name, phone number, purchase history, outstanding balance | Merchant and staff |
| Merchant's employee data | Name, date of birth, citizenship, LINDUNG 24 Jam status, pay rates, attendance records, salary advances, deductions, payslips, EPF / SOCSO / EIS contributions | Merchant and Accounts staff |
| Voice (Speak feature) | Voice recording when you press the Speak button, and the text (transcript) of that instruction | You / the staff member who presses Speak |
| Receipt & invoice photos (Read receipt feature) | Photos of expense receipts or supplier invoices, and the details read from them (amount, date, receipt number, shop name) | You / the staff member who takes or selects the photo |
| Technical data | Sign-in records and server error logs needed for security | Your device when using the app |
We do not ask for identity card numbers, bank account numbers, or sensitive personal data (health, religion, political opinions, offences, biometrics).
3. Purposes
- To provide and operate BossBaju: recording sales, stock, customers, expenses, reports, payroll and statutory contributions.
- To manage accounts, sign-in, roles and staff invitations.
- To keep the service secure and to detect and fix errors.
- To respond to your enquiries and complaints.
- To comply with the law.
We do not sell personal data. We do not use merchants' customer or employee data for our own purposes or for marketing.
4. Who we disclose data to
- Google LLC / Google Cloud (Firebase) — the hosting, database, sign-in and photo storage provider we use.
- OpenAI, L.L.C. — only when you use the Speak or Read receipt feature: the voice recording is converted to text, and that text together with the shop's product, channel and expense category names is organised into a draft for you to check; a receipt or invoice photo is read (together with the shop's expense category or supplier names) to fill a draft form. According to OpenAI, data sent through its API is not used to train its models.
- Members of the same shop — according to the roles set by the shop owner (e.g. ordinary staff cannot see payroll; only the owner and Accounts staff can).
- Authorities — where required by law or court order.
Sales website (bossbaju.com): this site uses the Meta Pixel (Meta Platforms, Inc.) to measure the effectiveness of our ads — for example when you open the page or tap the chat button. The Meta Pixel uses cookies and your browser information. The BossBaju app itself (where your shop data is stored) does not use the Meta Pixel.
5. Transfer of data outside Malaysia
Data is stored by Google Cloud outside Malaysia:
- Singapore — database and application servers;
- United States — product photos, expense receipt photos and supplier invoice photos; and voice and receipt photo processing by OpenAI when the Speak or Read receipt feature is used.
The purpose of the transfer is to store and process data so that BossBaju can operate. By ticking the consent box when registering, you consent to this transfer (Act 709 section 129). Your consent is recorded.
6. Security
We take practical steps to protect data, including HTTPS connections, mandatory sign-in, database rules that separate each shop, and role-based access. If a data breach occurs that is likely to cause significant harm, we will notify the Personal Data Protection Commissioner and affected persons as required by law, and notify the affected merchants without undue delay.
7. Retention
Data is kept while the shop account is active. After an account is closed, the merchant has 30 days to download their data, after which it is permanently deleted, unless the law requires longer retention. Daily backup copies are kept for up to 98 days and are then deleted automatically — deleted data may remain in backup copies until that period ends. Voice recordings (Speak feature) are not stored by BossBaju — they are only sent to be converted to text; the transcript is kept with the Speak usage record. Receipt and invoice photos are kept with the expense / purchase record as evidence while the shop account is active. According to OpenAI, text and images sent to it may be retained by OpenAI for up to 30 days for abuse monitoring. Note to merchants: employment law requires employers to keep wage records for at least 6 years — please download your records before closing your account.
Demo shops (demo.bossbaju.com): data in a demo shop is locked 24 hours after the demo starts and permanently deleted automatically 24 hours later. No backup copies are made of demo shops.
8. Your rights
- Access — request a copy of your personal data.
- Correction — request correction of inaccurate or incomplete data. Most data can be edited directly in the app.
- Withdraw consent and limit processing — by written notice. If consent is withdrawn, the account may no longer be usable.
- Data portability — request that your data be transmitted to another party, subject to technical feasibility.
Send requests in writing to the email in section 11. We will respond within 21 days. Any data access request fee will not exceed the rates in the Personal Data Protection (Fees) Regulations 2013.
Customers or employees of a merchant: please contact the merchant first, as they are your data controller. We will assist the merchant in responding to your request.
9. Obligatory or voluntary
An email address (or Google account) is obligatory to open an account. Without it, you cannot use BossBaju. Other data is provided according to the features you use — for example, an employee's date of birth and citizenship are needed to calculate statutory contributions; if not provided, the payroll feature cannot be used for that employee. The Speak (voice) and Read receipt (photo) features are voluntary — everything can be done through the normal forms.
10. Merchant responsibilities
As data controller, the merchant is responsible for giving their own privacy notice to, and where required obtaining consent from, their customers and employees before entering their data into BossBaju — including consent from a parent or guardian for anyone under 18. BossBaju is intended for users aged 18 and above.
11. Contact us
Contact person: Business owner
Email: nsevendigitalmarketing@gmail.com
Phone: [PHONE NO.]
Address: 28, Jalan Uda Utama 4/6, Bandar Uda Utama, 81200 Johor Bahru, Johor
You may also lodge a complaint with the Department of Personal Data Protection (www.pdp.gov.my).
12. Changes to this notice
We may update this notice. The current version and date are shown above. If material changes are made, you will be asked to read and agree again when signing in.