Privacy Policy

1. Introduction

Tunjang Jaya Graftek Sdn Bhd ("we", "us", or "our") is committed to protecting and respecting your privacy. This Privacy Policy sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us. Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it.

This policy applies to all services operated under the Bizlink platform and our corporate website www.tunjangjaya.com.

2. Information We Collect

We may collect and process the following personal data about you:

• Account information: Username and password when you register for an account.
• Profile information: Name, email address, phone number, company name, job title, address, and profile photo you choose to provide.
• Contact exchange data: Name and phone number shared by visitors who download your digital business card.
• Technical data: IP address, browser user-agent, approximate geographic location (city, region, country) derived from IP at the time a card is downloaded.
• Usage data: Pages visited, interactions within the application.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Bizlink service.
• Generate your digital business card profile accessible via your unique short link.
• Record and display analytics about who has downloaded your contact card.
• Respond to your enquiries and provide customer support.
• Improve our platform based on usage patterns.
• Comply with legal obligations under the Personal Data Protection Act 2010 (Malaysia).

4. Legal Basis for Processing

We process your personal data on the basis of your consent (given when you register and use the service), performance of a contract (to provide the service you have requested), and our legitimate interests (to improve and secure our platform).

5. Data Sharing and Disclosure

We do not sell, trade, or rent your personal data to third parties. We may share data with:

• Service providers: Hosting and infrastructure providers who process data on our behalf under strict confidentiality agreements.
• Geolocation: We use ipinfo.io to resolve approximate geographic location from IP addresses. No personal profile data is shared with this service.
• Legal requirements: Where required by law or to protect our legal rights.

Your public business card profile (name, company, phone, email, and profile photo) is intentionally accessible to anyone who has your unique short link or QR code, as this is the core purpose of the service.

6. Data Retention

We retain your account and profile data for as long as your account is active or as needed to provide you the service. Contact exchange records (downloads) are retained to provide you with analytics and contact management features. You may delete individual contact records at any time from the Contacts page. To request full account deletion, please contact us at the address below.

7. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include:

• Passwords stored as bcrypt hashes — never in plain text.
• Session-based authentication with HTTP-only, secure cookies.
• HTTPS enforced in production with HSTS headers.
• Content Security Policy and other browser security headers.
• Rate limiting on authentication endpoints.

No method of transmission over the internet is 100% secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee absolute security.

8. Your Rights

Under the Personal Data Protection Act 2010 (Malaysia) and applicable laws, you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Request erasure of your personal data (subject to legal obligations).
• Withdraw consent for processing at any time (this may affect your ability to use the service).
• Lodge a complaint with the relevant supervisory authority.

To exercise any of these rights, please contact us using the details in Section 10.

9. Cookies

Bizlink uses a single session cookie to maintain your authenticated login state. This cookie is:

• HTTP-only (not accessible via JavaScript).
• Secure flag set in production (only transmitted over HTTPS).
• SameSite=Lax to prevent cross-site request forgery.
• Expires after 7 days of inactivity.

We do not use advertising, tracking, or analytics cookies.

10. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your rights, please contact:

11. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated revision date. Your continued use of the service after any changes constitutes acceptance of the new policy.