Privacy Policy

This Privacy Policy explains how OSPROV SDN BHD (“OSPROV”, “we”, “us”) collects, uses, shares and protects personal data, in line with Malaysia’s Personal Data Protection Act 2010 (“PDPA”). It replaces the privacy policy previously published by BASIC INCEPTION SDN BHD, which operated OSPROV before OSPROV SDN BHD was set up to run it.

Who we are

OSPROV SDN BHD (202601022598 / 1684695-U) builds and operates OSPROV, a low-code platform for digital forms, approval workflows and business process automation. Our office is at A-G-14, CoPlace 1, 2270 Jalan Usahawan 2, Cyber 6, 63000 Cyberjaya, Selangor, Malaysia.

What this policy covers

This policy applies to:

our website at osprov.com and our documentation at wiki.osprov.com;
the OSPROV platform when we host it (including the web app at app.osprov.com and the mobile app); and
sales, demo, partner and support conversations with us.

If your employer or another organization uses OSPROV: that organization decides which forms and workflows exist, what information they ask for and who can see it. For that content, the organization is responsible for your personal data, and we process it on its behalf and on its instructions. We remain responsible for our own obligations under the PDPA, including keeping that data secure. Please contact the organization first with questions about how it uses your data; we will help it respond.

For on-premise installations, the organization hosts and controls the data. Our access to it is governed by the organization’s authorization and its support arrangements with us. Integrations the organization configures may separately send data to the providers it chooses.

Personal data we collect

When you visit our website

Our website has no sign-up, contact forms, advertising or analytics trackers. Like any website, our web server automatically records basic technical information for each request: your IP address, browser and device type, the page requested, the referring page and the date and time. We use this to run, secure and troubleshoot the website.

When you contact us

When you email us, message us on WhatsApp, book a demo, contact us through Facebook or open a support ticket, we receive the details you choose to give us, such as your name, job title, organization, email address, phone number and the content of your message.

When you use the OSPROV platform

Account and profile data: name, username, email address, phone number, employee ID, division, department, section, position, grade and role.
Sign-in data: your password (stored only in hashed form) or the sign-in details from your organization’s single sign-on provider, and session and access tokens.
Content: form answers, attachments, signatures, comments, approvals and other information entered into forms and workflows, whether by you or by other users about you.
Activity and audit data: sign-in records, actions taken on submissions and records, and timestamps. These make up the audit trails that organizations rely on.
Technical and device data: IP address, browser and device information, error and diagnostic information, and, if you allow notifications in the mobile app, a device token used to send them.

Where we get it from

We collect personal data from you; from your organization, its administrators and its staff directory; from single sign-on providers your organization uses; from other users who enter information about you in forms and workflows; and automatically, from your use of our website and platform.

Business contacts

We keep the contact details of people at our customers, partners and suppliers so that we can manage our relationship with them.

Which data is required

Your name and a way to reach you are needed for us to answer an enquiry or provide support. On the platform, required details depend on your account, how you sign in and the form you are filling in: an account needs at least your name and email address, and your organization decides which form fields are mandatory. Technical and security information is collected automatically. If you don’t provide required details, we or your organization may not be able to create your account, process your submission or answer your request.

How we use personal data

We use personal data to:

provide, operate, maintain and support the OSPROV platform and website;
create and manage user accounts, including sign-in and single sign-on;
process form submissions and run workflows, approvals and notifications for your organization;
respond to enquiries, arrange demos and provide customer support;
send service messages, such as workflow notifications, security alerts and important changes;
keep the platform secure, prevent fraud and abuse, and diagnose errors;
improve our products and services, mainly using technical, usage and support information;
manage our relationships with customers, partners and suppliers, including billing; and
meet our legal and regulatory obligations and protect our legal rights.

We process the content of your organization’s forms and workflows on its instructions. We do not sell personal data, and we do not use that content for marketing.

Cookies and device storage

Our website does not use cookies. The OSPROV platform uses essential cookies to keep you signed in, remember your session and protect against cross-site request forgery. The mobile app and installable web app also store preferences, notification information and cached pages and files on your device, so that they load quickly and work with a weak connection. You can clear this data in your browser or device settings, but the platform will not work without its essential cookies.

We share personal data only as needed for the purposes above, with:

Service providers who help us run OSPROV, under contracts that require them to protect the data and use it only to provide their services. These cover cloud hosting and file storage (Microsoft Azure), email delivery, error monitoring, real-time and push notifications, and our support desk (Freshdesk). Notification and error-monitoring providers may receive identifiers, notification content and diagnostic information, depending on how the service is set up.
Sign-in providers your organization chooses, such as Google, Microsoft or Okta, when you sign in with them.
AI providers your organization connects. AI-assisted features work only when your organization turns them on and connects an AI provider using its own account and API key. When you use these features, your prompts and the conversation for that feature are sent to that provider, under your organization’s agreement with it.
Meta (WhatsApp and Facebook), when you choose to contact us through those services. Their own privacy policies apply to those conversations.
Our authorized partners and resellers, where they help deliver, implement or support OSPROV for your organization.
Your organization, for the data held in its OSPROV account.
Authorities, courts and professional advisers, where the law requires it, or where needed to establish, exercise or defend legal claims.
A buyer or successor, if our business or assets are sold or merged, who must continue to protect the data in line with this policy.

Where data is stored and transfers outside Malaysia

We host the OSPROV platform on Microsoft Azure in its Southeast Asia region, located in Singapore. Some of our other service providers may process data in other countries. Before we transfer personal data outside Malaysia, we make sure the transfer meets a condition allowed under section 129 of the PDPA, such as the destination having data protection law substantially similar to Malaysia’s, or the transfer being necessary to provide the service you or your organization asked for, and we put the safeguards that condition requires in place.

How long we keep personal data

We keep personal data only as long as needed for the purposes it was collected for, or as required by law. Platform data is kept while your organization’s account is active and is then returned or deleted in line with our agreement with that organization. Copies in backups are kept for a limited time before they are removed. Enquiry and support records are kept while they are useful for follow-up questions and our business records. Web server logs are kept for a short period for security and troubleshooting. When personal data is no longer needed, we take reasonable steps to delete or anonymize it.

How we protect personal data

We take practical technical and organizational steps to protect personal data against loss, misuse and unauthorized access, alteration or disclosure. For the platform we host, these include encryption in transit (HTTPS), role-based access controls, audit trails, backups and limiting staff access to those who need it. No system is completely secure, but we work to keep these protections appropriate to the data we handle.

Your rights and choices

Under the PDPA, you can:

ask whether we hold your personal data and request a copy of it;
ask us to correct personal data that is inaccurate, incomplete, misleading or out of date;
withdraw your consent, or ask us to limit how we process your personal data;
ask us to stop processing that is likely to cause you substantial damage or distress;
ask us to stop using your personal data for direct marketing; and
ask us, in writing and electronically, to send your personal data directly to another data controller of your choice, where this is technically feasible and the data format is compatible.

To make a request, email us using the details below. We may need to verify your identity first, and we will respond within the time the law requires. If your request concerns data held in your organization’s OSPROV account, we may refer it to your organization. If we send you marketing emails, you can opt out at any time through the link in the email or by contacting us. Your organization’s administrators control platform notification settings. Service messages such as workflow and security notifications are part of the service and can’t be turned off completely while you use it. Withdrawing consent or limiting processing may mean we, or your organization, can no longer provide some services to you.

Data breaches

We assess every personal data breach and notify the Personal Data Protection Commissioner and affected individuals when the PDPA requires it, within the timeframes it sets. Where the breach involves data we process for a customer organization, we notify that organization without unnecessary delay and give it the information it needs to respond.

Children and sensitive data

Our website and platform are intended for businesses and organizations and are not directed at children. We do not knowingly collect personal data from children for our own purposes. Organizations that use OSPROV to collect personal data about children, or sensitive personal data such as health information, must make sure they have the required notices and consents, including parent or guardian consent where needed. Our own obligations as their service provider continue to apply.

Changes to this policy

We may update this policy from time to time. The latest version will always be on this page, with the “Last updated” date at the top. If we make significant changes, we will let customers know through the platform or by email.

Contact us

For questions, requests or complaints about your personal data, contact us:

Privacy contact, OSPROV SDN BHD
Email: [email protected]
A-G-14, CoPlace 1, 2270 Jalan Usahawan 2, Cyber 6, 63000 Cyberjaya, Selangor, Malaysia

If you are not satisfied with our response, you may contact the Personal Data Protection Commissioner of Malaysia.

This policy is published in English and Bahasa Malaysia. If there is any inconsistency between the two versions, the English version prevails.