Legal
How Praxis Systems Sdn. Bhd. collects, uses and protects personal data when you use our platform and website.
Last updated: 29 September 2026
Baca Notis Privasi ini dalam Bahasa Malaysia · This Notice is published in full in both English and Bahasa Malaysia.
Key points of this Notice, in brief. Read the full Notice below for detail.
This Privacy Notice explains how Praxis Systems Sdn. Bhd. collects, uses, discloses, stores and protects Personal Data when Praxis acts as a Data Controller. We collect personal data and process it only as described in this Notice. It also explains your rights and how to contact us.
Praxis Systems Sdn. Bhd. (202601029878 (1691973-D)) is the Data Controller responsible for this Notice.
Registered address: 7-2, Plaza Danau 2, Jalan 2/109F, Taman Danau Desa, Kuala Lumpur, Wilayah Persekutuan Kuala Lumpur, Malaysia.
Data Protection Officer, for privacy enquiries, rights requests and complaints: legal@praxissystems.my
In this Notice, Praxis, we, us and our refer to Praxis Systems Sdn. Bhd.
This Notice applies to Personal Data Praxis processes as Data Controller in connection with our websites; accounts; subscriptions, billing and payments; communications and support; sales and business enquiries; events and programmes; security and fraud prevention; business administration; Praxis Integrity and other verification services where Praxis determines the continuing purpose; and other interactions where Praxis determines why and how Personal Data is processed.
It does not generally govern Personal Data within customer assessments, uploaded evidence, client matters or regulatory workspaces where Praxis acts only on a customer's instructions. That processing is governed by the Data Processing Agreement and the customer's own privacy obligations.
Applicable Data Protection Law means the Malaysian Personal Data Protection Act 2010 as amended, including the Personal Data Protection (Amendment) Act 2024, and any other privacy or data-protection law that applies to the relevant processing.
Data Controller means the person that determines the purposes and means of processing Personal Data, including a data controller under the Malaysian Personal Data Protection Act 2010.
Data Processor means a person that processes Personal Data on behalf of a Data Controller.
Personal Data means information relating directly or indirectly to an identified or identifiable individual.
Sensitive Personal Data has the meaning in Applicable Data Protection Law and may include information concerning health, physical or mental condition, political opinions, religious or similar beliefs, the commission or alleged commission of an offence, biometric data, and other categories designated by law.
Praxis is a business-to-business regulatory intelligence platform for businesses, professional practices, law firms, consultants, privacy and compliance professionals, corporate teams and other institutional users. The Services are not primarily intended for personal, domestic or household use and are not directed to children.
We collect personal data and process it in the following categories, depending on how you interact with Praxis:
Payment card or banking credentials may be collected directly by payment providers. Praxis normally receives only limited confirmation, reference, amount and method information.
Information marked as required on our forms is obligatory. All other information is voluntary, and you may leave it blank without affecting your access to the Services. Marketing consent is always voluntary and is never a condition of purchasing the core Services.
Consequences of not providing obligatory data: if you do not supply the obligatory information, we will be unable to create your account, provide the requested Service, process your payment, issue invoices, maintain the business relationship or respond to your enquiry.
We give you this Notice at the time of collection, that is, when we first ask you for personal data or when we first collect it. Every form that collects personal data (account sign-up, contact and demonstration requests, Design Partner applications and checkout) links to this Notice at the point of collection, in English and Bahasa Malaysia. Where we obtain personal data from another source, or propose to use it for a purpose not described here, we will give you this Notice, or an updated one, as soon as practicable and before that use.
Customers may submit information about employees, clients, customers, suppliers or other individuals for privacy assessments, Data Protection Impact Assessments, transfer assessments, regulatory research, breach management, audits, compliance workflows, questionnaires, documents and evidence.
Where the customer decides why that Personal Data is processed, the customer is the Data Controller or a Data Processor for another Controller, and Praxis is its Data Processor or Subprocessor. Praxis does not become the Data Controller merely because the information passes through our technology.
If your information was entered by a Praxis customer, direct your request to that organisation. If you contact Praxis, we may refer the request to the relevant customer unless law requires otherwise.
We obtain Personal Data directly from you; from your organisation when it creates or manages an account; from payment and service providers supporting our operations; from limited publicly available professional sources used for legitimate business communications; and automatically through use of the websites and Services.
We collect and process your personal data for the following purposes. Each purpose is paired with the legal basis we rely on under Applicable Data Protection Law. We will not use your personal data for a purpose that is not listed here, or directly related to one listed here, without first telling you and, where required, obtaining your consent.
| Purpose of processing | Legal basis |
|---|---|
| Create and administer accounts; authenticate users and manage permissions; provide purchased Services; enforce capacity entitlements | Performance of a contract, or steps taken at your request before entering into a contract |
| Prepare quotations and invoices; collect payments; maintain financial, tax and accounting records | Performance of a contract; compliance with a legal obligation |
| Provide support and respond to enquiries | Performance of a contract; your consent when you contact us |
| Operate, secure and troubleshoot systems; prevent fraud and misuse; keep security logs | Legitimate purpose that is not prejudicial to your rights; compliance with a legal obligation (security principle) |
| Improve reliability and usability, using aggregated or anonymised information where practicable | Legitimate purpose that is not prejudicial to your rights |
| Send operational, security, billing and contractual notices | Performance of a contract; compliance with a legal obligation |
| Send marketing about products, research, events and publications | Your consent, which you may withdraw at any time |
| Comply with law, regulatory requests and court orders | Compliance with a legal obligation; administration of justice |
| Establish, exercise or defend legal rights | Administration of justice; legitimate purpose |
| Issue and maintain Praxis Integrity verification records | Performance of a contract with the issuing customer; legitimate purpose of allowing reports to be verified |
| Protect the vital interests of an individual in an emergency | Protection of vital interests |
Customer Personal Data and Customer Confidential Information are not used to train Praxis or third-party general-purpose artificial intelligence models.
We only collect what is necessary for the purpose stated at the point of collection, and no more than is required for that purpose. Forms ask only for the fields needed for the task, optional fields are clearly optional, and we do not build profiles from data collected for a different purpose.
We may offer information about products, updates, research, events, programmes and publications. Where consent is required, we ask separately and never pre-tick the box.
You can withdraw your consent as easily as you gave it, using the same channel: the unsubscribe link in every marketing email, the marketing preference in your account settings, or an email to legal@praxissystems.my. Withdrawal takes effect promptly and does not affect processing that took place before it. Operational, security, billing and contractual messages may continue where necessary.
Certain Services use artificial intelligence and automated systems to support regulatory research, extraction, classification, assessment and generation of Outputs. Production inference may use models operated on infrastructure controlled by Praxis. If a hosted third-party AI provider is used to process Customer Personal Data, it will be governed by the DPA and subprocessor notice process.
Praxis does not sell Customer Personal Data to AI providers and does not permit Customer Personal Data or Customer Confidential Information to train third-party general-purpose AI models.
Praxis systems support professional human decision-making. They may generate assessments, classifications, scores, research results or recommendations, but are not intended by themselves to make legally binding or similarly significant decisions about individuals. Customers remain responsible for human review and decisions using Outputs.
Where Praxis itself uses automated decision-making or profiling in circumstances that give you rights under Applicable Data Protection Law, we will provide required information, a means to object or refuse where applicable, and access to human review.
Praxis does not seek Sensitive Personal Data in ordinary account, sales or support interactions. Please do not include it unless necessary. It may nevertheless be provided incidentally, or appear in customer workspaces because regulatory assessments concern such processing.
Where Praxis acts as Data Controller, we will obtain explicit consent or rely on another condition permitted by law before processing Sensitive Personal Data. Where Praxis acts as Data Processor, the customer is responsible for the necessary notices, explicit consent or other lawful condition, and Praxis applies the DPA safeguards.
We will not disclose your personal data without your consent, except to the classes of third parties listed below, for the purposes listed below, or where Applicable Data Protection Law otherwise permits disclosure without consent (for example, where required by law or court order, or for preventing or detecting crime). We do not sell Personal Data or disclose it for third-party behavioural advertising.
The classes of third parties to whom we may disclose personal data, and the purpose for which your data may be disclosed to each, are:
| Class of third party | Purpose of disclosure |
|---|---|
| Infrastructure, network and security service providers, including Cloudflare | To deliver, protect and secure the websites and Services |
| Business email providers, including Namecheap Private Email | To send and receive business correspondence and notices |
| Payment service providers and banks, including HitPay and Airwallex | To process payments, refunds and reconciliation |
| Professional advisers, auditors and insurers, subject to confidentiality | To obtain legal, audit, tax and insurance services |
| Courts, regulators (including the Personal Data Protection Commissioner), law-enforcement and governmental authorities | To comply with a legal obligation, binding request or court order, or to establish or defend legal rights |
| A successor, investor or transaction counterparty | For legitimate due diligence, financing, investment, reorganisation, merger or sale, subject to confidentiality and data-protection safeguards |
When we disclose information in response to a legal request, we limit the disclosure to what is required and notify the affected person where legally permitted and appropriate.
Material processors of Customer Personal Data are identified in Schedule 3 of the Praxis Data Processing Agreement, which is the single source of truth for the current subprocessor list. Locally operated software and AI models are not separate recipients or subprocessors.
Data processors. Under the amended Personal Data Protection Act 2010, data processors are directly subject to the Security Principle and are legally obliged to protect the personal data they process. In addition, we:
Praxis is established and primarily operates in Malaysia. Our core production systems and locally operated AI inference are hosted on infrastructure controlled by Praxis in Malaysia. Some providers may process or transmit limited Personal Data outside Malaysia, namely internet-edge (Cloudflare), email and payment data.
We transfer personal data outside Malaysia only on a lawful basis under section 129 of the Personal Data Protection Act 2010, as amended, and the Cross-Border Personal Data Transfer Guidelines 2025. The basis we rely on is one of the following:
Foreign laws may require additional mechanisms. You may ask us which basis applies to a particular transfer.
Our public website uses essential technologies needed to provide pages, secure sessions and remember basic preferences. It does not currently use non-essential analytics or advertising cookies. Authenticated products may use essential session, security and preference technologies needed to provide the Services.
If Praxis introduces non-essential analytics, advertising or similar tracking that requires notice or consent, we will update the applicable cookie information and obtain consent where required. Customer Personal Data is not used for third-party behavioural advertising.
See our Cookie Notice for further detail on how this website uses cookies.
We maintain reasonable administrative, technical and organisational measures designed to protect Personal Data against loss, misuse, unauthorised or accidental access or disclosure, alteration, destruction and other unlawful processing. These measures include:
Measures are proportionate to the nature of the data, foreseeable threats and available technology. No method is completely secure. You must protect your credentials, use available multi-factor authentication and notify us promptly of suspected compromise.
We maintain processes for identifying, assessing and responding to Personal Data Breaches. Where Praxis is the Data Controller and a breach causes or is likely to cause significant harm, we will notify the Personal Data Protection Commissioner as soon as practicable and within 72 hours after becoming aware, and notify affected individuals without unnecessary delay and within seven days after notifying the Commissioner, subject to Applicable Data Protection Law and official guidance.
Where Praxis acts as Data Processor for Customer Personal Data, we will notify the affected customer without undue delay and in any event within 24 hours after becoming aware of a suspected breach, to the extent legally permitted, and provide available information under the DPA.
We retain Personal Data only as long as necessary for the stated purpose, legal requirements, security and claims. Our retention period for each category of data, that is, how long we keep it, is set out below. Unless a longer or shorter period is required by law or reasonably necessary for a documented legal, security or claims reason, the retention periods are:
Destruction when the purpose is exhausted. When a retention period ends, or personal data is no longer required for the purpose for which it was collected, we securely destroy or permanently delete it from active systems, or anonymise it so that it can no longer identify you. Deletion extends to our processors under the contract terms described in section 16.
After termination, Praxis uses reasonable efforts to email a Customer Data export link within 48 hours after the termination process is completed. The customer has 30 days from the email to download it. Customer Personal Data is then deleted from active systems unless a lawful exception applies. Backup copies are deleted or overwritten no later than 60 days after the 30-day retrieval period ends.
Subject to conditions and exemptions under Applicable Data Protection Law, you have the following rights:
How to make a request. Send a data access request, correction request or other rights request to legal@praxissystems.my with enough detail to identify the information. Account holders may also correct most account details directly in their account settings. We may verify your identity before acting. We will respond to access and correction requests within 21 days of receiving a complete request, or within any extended period the Act allows, and to other requests within the applicable statutory period. We may charge only a fee permitted by law. If the information is controlled by a customer, we will normally refer you to that customer.
We take reasonable steps to keep Personal Data accurate, complete, not misleading and up to date for its purpose. Please update account details or contact us when information changes.
The Services are not directed to children and we do not knowingly collect Personal Data from a person under 18 in our independent Data Controller capacity. If we ever need to process a child's personal data as Data Controller, we will obtain consent from the parent, guardian or person who has parental responsibility for the child before doing so.
A parent or guardian may request access to, and request correction of, a child's personal data on the child's behalf using the channels in section 22. If you believe a child has provided personal data to us, contact us and we will delete it.
Customer workspace data involving a child remains the customer's responsibility as Controller, including parental consent or other lawful authority.
Praxis does not sell Personal Data; does not disclose it to data brokers or advertisers for their independent marketing; does not use Customer Personal Data for third-party behavioural advertising; and does not permit Customer Personal Data or Customer Confidential Information to train general-purpose AI models.
Praxis has voluntarily appointed a Data Protection Officer (DPO) before any mandatory threshold under section 12A of the Act has been reached. Our DPO is our Founder, who is responsible for privacy enquiries, rights requests and complaints, and for overseeing our compliance with Applicable Data Protection Law.
Contact our Data Protection Officer at legal@praxissystems.my, or by post to the registered address in section 1, marked "Attention: Data Protection Officer".
We monitor our position against the thresholds in the Data Protection Officer Guidelines 2025, including the number of data subjects, volume of Sensitive Personal Data and any regular and systematic monitoring. If appointment becomes mandatory, we will formalise the appointment and notify the Commissioner within the required period.
We may update this Notice as our practices, Services or the law change. The updated date will show the current version. Where a change materially affects existing processing, we will provide appropriate notice before it takes effect where practicable and legally required.
Please send complaints first to legal@praxissystems.my so we can investigate. You may also complain to the Personal Data Protection Commissioner or the Personal Data Protection Department through www.pdp.gov.my.
This Notice is issued in full in English and in Bahasa Malaysia (Notis Privasi) to comply with section 7(3) of the Act. Both versions have the same substance. If an inconsistency arises, the English version prevails to the extent permitted by law.
This page is published in an accessible format: it uses semantic headings for screen readers, a summary at the top, and machine-readable structured data (schema.org JSON-LD). You may request this Notice in another format by contacting us.
Contact: legal@praxissystems.my
Seven applications on one knowledge engine — Praxis DPIA, Frontier, Privacy Audit, Breach, Schema, Passport and Integrity — built on Malaysia's PDPA for law firms, enterprise DPOs and the businesses that handle personal data.
