Privacy Notice

Codemax Sdn Bhd (trading as HalalSuite, “we”, “us”, “our”) respects your privacy. This notice explains how we collect, use, disclose, and protect personal data through this marketing website at halalsuite.com, in line with Malaysia’s Personal Data Protection Act 2010 (Act 709), as amended by the Personal Data Protection (Amendment) Act 2024. In this notice, “personal data” has the meaning given to it under the PDPA, and we act as the data controller for the personal data described here.

1. Who we are

The data controller responsible for your personal data is:

Entity: Codemax Sdn Bhd
Company registration no.: 201101019262 (947395-T)
Registered address: 12F-1, Level 12, PFCC @ Tower 4, Bandar Puteri Puchong, 47100 Selangor
Country: Malaysia

For any question about this notice or your personal data, or to exercise your rights, contact our data protection team at info@halalsuite.com. Where we are required to appoint and register a Data Protection Officer with the Personal Data Protection Commissioner under the Amendment Act 2024, that officer’s details will be published here.

2. Scope of this notice

This notice applies only to the public HalalSuite marketing website (halalsuite.com) and to people who visit it or contact us through it.

It does not cover the separate, authenticated HalalSuite application, which runs on a different domain and is governed by its own in-product privacy terms and subscription agreement.
This website holds no login, no account, and no payment details.
Other websites we link to (for example the official MYeHALAL portal) have their own privacy notices, for which we are not responsible.

3. What personal data we collect

The only personal data we collect on this website is what you choose to give us through our contact form:

Full name (required) — so we know who we are replying to;
Company name (optional);
Work email address (required) — so we can reply;
Your message (required) — the enquiry you send us; and
a record that you gave consent by ticking the consent box when you submitted the form.

We do not collect account credentials, payment or billing data, government identifiers, sensitive personal data, or biometric data on this website, and we do not knowingly collect personal data from children. The site is intended for business and adult users.

4. How we collect it, and its source

We collect personal data directly from you when you complete and submit the contact form. We do not obtain it from any third-party source.
Your submission is delivered to our company mailbox (and, if and when we introduce a customer-relationship/lead-management tool, will be routed there — we will update this notice before doing so).
Our hosting provider may generate standard server logs for security and reliability. We do not use these for tracking, profiling, or advertising.
We run no analytics, advertising pixels, or automated tracking or profiling on this website.

5. Why we use it, and our legal basis

We use the personal data you submit for one purpose only:

to receive, read, respond to, and follow up on your enquiry, and to contact you about the HalalSuite products or services you asked about.

Our legal basis is your consent, which you give by ticking the consent box on the contact form (the General Principle, section 6, and the Notice and Choice Principle, section 7, of the PDPA). We will not use your details for any unrelated purpose, and we will not add you to a marketing list without a separate, clear basis. We do not currently send marketing from this website. If we ever introduce analytics or marketing tools, they will be consent-based and we will update this notice before deploying them.

6. Whether you must provide it, and the consequences

Providing your personal data through the contact form is entirely voluntary. The required fields (name, work email, message) are needed only so that we can identify you and reply. If you choose not to provide them, the only consequence is that we will be unable to receive or respond to your enquiry — there is no other detriment. You may also contact us by emailing info@halalsuite.com directly instead of using the form.

We do not sell your personal data, and we do not share it with anyone for their own marketing. We disclose it only to the following classes of recipients, and only as needed to handle your enquiry:

Our cloud hosting provider (Microsoft Azure), which hosts this website as our data processor;
Our email/mail provider, which delivers the mailbox that receives your enquiry;
A future customer-relationship/lead-management provider, if and when we introduce one (we will name it here before relying on it); and
Authorities or regulators, where we are required to disclose by law.

Our processors act only on our instructions, are bound by contract, and are themselves subject to the PDPA’s Security Principle. We disclose your data only for the purpose for which you provided it, consistent with the Disclosure Principle (section 8).

8. Cross-border data transfer

Our website is hosted on Microsoft Azure (Asia-Pacific region). Where any personal data is processed or stored outside Malaysia — for example by our email provider or a future tool — we transfer it under the PDPA’s cross-border transfer regime (the amended section 129, in force from 1 April 2025).

The mechanism we rely on is your consent, given when you voluntarily submit the contact form knowing that we will use an email provider to reply to you. The form is optional, you choose to send it, and we use what you send only to answer you.

As a second layer — not instead of consent — we engage only processors that are contractually bound to protect your data to a standard comparable to the PDPA, and we assess a destination’s data-protection regime and the processor’s safeguards before relying on it. We will disclose the destinations and safeguards involved on request.

9. Cookies and similar technologies

This website uses only a single essential browser storage item, halalsuite_consent, which records that you acknowledged our privacy banner so we do not show it to you again.

We use no analytics cookies, advertising or tracking pixels, or third-party tracking scripts.
There is no cross-site tracking and no automated profiling. The only other data embedded in our pages is non-tracking structured data (JSON-LD) that helps search engines understand the site.
You can clear this storage at any time through your browser settings; doing so simply causes the banner to appear again.
If we ever introduce analytics or marketing technologies, they will be consent-based and we will update this notice first.

10. How we protect your data

In line with the Security Principle (section 9), we take practical steps to protect your personal data:

the website is served over HTTPS/TLS, so your form submission is encrypted in transit;
access to received enquiries is limited to authorised personnel on a need-to-know basis;
we use reputable providers (Microsoft Azure and our mail provider) that maintain their own security controls and are bound to protect the data.

These measures are proportionate to the limited, low-sensitivity data this website collects.

11. How long we keep your data

In line with the Retention Principle (section 10), we keep your contact-form data only for as long as necessary to handle and follow up on your enquiry, plus any short period needed for our records or to meet a legal obligation. In practice we retain enquiry data for 180 days from our last correspondence with you, after which we securely delete it or irreversibly anonymise it. We do not keep enquiry data indefinitely. You may ask us to delete your data earlier, subject to anything we are required to keep by law.

12. Keeping your data accurate

In line with the Data Integrity Principle (section 11), we take reasonable steps to keep the limited data we hold accurate and up to date for its purpose. You may ask us to correct your details at any time using the contact channel above.

13. Your rights under the PDPA

Subject to the conditions and exceptions in the PDPA, you have the right to:

Access (section 30) — ask whether and what personal data we hold about you, and obtain a copy;
Correct (section 34) — have inaccurate, incomplete, misleading, or out-of-date data corrected;
Withdraw consent (section 38) — withdraw the consent you gave on the contact form, after which we stop processing your data;
Prevent direct marketing (section 43) — require us to stop processing your data for direct marketing (we do not currently market from this site); and
Data portability (section 43A, in force from 1 June 2025) — request that your personal data be transmitted to another data controller, subject to technical feasibility and format compatibility.

To exercise any of these rights, email info@halalsuite.com. We may need to verify your identity first. We will respond within the timeframe required by the PDPA, and a prescribed fee may apply to an access request where the law permits.

14. Personal data breach handling

We assess any suspected personal data breach and, where required under the breach-notification rules in force from 1 June 2025, notify the Personal Data Protection Commissioner as soon as practicable and in any event within 72 hours of becoming aware of it. Where a breach is likely to cause significant harm to you, we will also notify you without undue delay, and within 7 days of notifying the Commissioner. Given the limited and low-sensitivity nature of the data this website collects, the risk is low — but we are committed to following this process.

15. Changes to this notice

We may update this notice from time to time. The “last updated” date at the top shows the current version, and we will reflect any material change here — for example, introducing analytics, a new tool, or a new purpose — before it takes effect.

16. Complaints and the regulator

If you have any concern about how we handle your personal data, please contact us first at info@halalsuite.com so we can put it right. You also have the right to lodge a complaint with Malaysia’s data-protection regulator, the Department of Personal Data Protection (Jabatan Perlindungan Data Peribadi, JPDP):

Website: pdp.gov.my
Online complaints: daftar.pdp.gov.my/p_aduan
Email: aduan@pdp.gov.my

17. Contact us

For any privacy question or to exercise your rights, contact our data protection team:

Email: info@halalsuite.com
Entity: Codemax Sdn Bhd
Company registration no.: 201101019262 (947395-T)
Address: 12F-1, Level 12, PFCC @ Tower 4, Bandar Puteri Puchong, 47100 Selangor