PRIVACY POLICY

1. Introduction

Modulaur by N6N (“Modulaur”, the “Platform”, “we”, “us” or “our”) is a cloud-based appointment, facility and service booking platform operated by N6N Consultancy Services Sdn. Bhd. (16278859-P), a company incorporated under the laws of Malaysia with its registered address at Unit 32-01, Level 32, The Vertical Corporate Office Tower B, Avenue 10, Bangsar South No.8 Jalan Kerinchi 59200 Kuala Lumpur Malaysia. (“N6N”, the “Company”).

This Privacy Policy explains how personal data is collected, used, disclosed, stored, retained and protected when businesses that subscribe to Modulaur (“Organizations”) and the customers who book through them (“End Users”) use the Platform. It is written to comply with the Personal Data Protection Act 2010 [Act 709] (“PDPA”), as amended by the Personal Data Protection (Amendment) Act 2024 (which came into force in three phases on 1 January 2025, 1 April 2025 and 1 June 2025), and the regulations, standards, guidelines and circulars issued under it by the Jabatan Perlindungan Data Peribadi / Department of Personal Data Protection (“JPDP”) and the Personal Data Protection Commissioner (the “Commissioner”).

This Policy should be read together with our Terms of Use. Where a term is capitalised but not defined in this Policy, it has the meaning given to it in the Terms of Use.

2. Definitions

• “Organization” / “Business Customer” means the business, clinic, firm, club, institute or other entity that subscribes to Modulaur to manage bookings for its own customers.
• “Organization User” means an administrator, staff member, or other personnel of an Organization who accesses the Modulaur dashboard.
• “End User” means an individual who books, or on whose behalf a booking is made for, an appointment, facility or service with an Organization through Modulaur.
• “Personal Data” has the meaning given in Section 4 of the PDPA: information in respect of commercial transactions which relates directly or indirectly to a living individual who is identified or identifiable from that information. Following the 2024 amendment, data relating to a deceased individual is excluded.
• “Sensitive Personal Data” has the meaning given in Section 4 of the PDPA: personal data consisting of information on physical or mental health, political opinions, religious beliefs, the commission or alleged commission of an offence, and, following the 2024 amendment, biometric data, defined as any personal data resulting from technical processing relating to the physical, physiological or behavioural characteristics of a person.
• “Data Controller” (formerly “Data User”) refers to a person who either alone or jointly processes personal data or has control over or authorises the processing of personal data.
• “Data Processor” refers to a person, other than an employee of the data controller, who processes personal data solely on behalf of, and under the instructions of, a data controller.
• “Booking Data” means personal data submitted to make, manage or record a booking (e.g., name, contact details, appointment details, notes, booking history).
• “Uploaded Documents” means any file, form, image or document uploaded to Modulaur by an End User or an Organization in connection with a booking.

3. Scope; Who This Policy Covers

Modulaur is licensed on a business-to-business (B2B) basis to Organizations, which in turn use it to manage business-to-consumer (B2C) bookings with their own End Users, across the following supported industries:

This Policy applies to

• (a) Organization Users, in respect of the account, billing and platform-usage data N6N holds about them, and
• (b) End Users, in respect of the Booking Data and Uploaded Documents processed through an Organization's use of Modulaur, regardless of which of the above industries the Organization operates in.

4. Roles Under the PDPA

Because Modulaur is a shared platform used by many independent Organizations, different parties act in different data protection capacities:

N6N as Data Processor

In relation to End User personal data submitted through an Organization's use of Modulaur, including Booking Data, Uploaded Documents and speech-to-text output, N6N acts as a data processor. N6N processes this data solely on the documented instructions of the relevant Organization, which remains the data controller of its own End Users' personal data and is responsible for establishing a lawful basis for its collection and use.

Organization as Data Controller

Each Organization determines the purposes and means of processing its End Users' personal data (for example, what booking or intake information to collect, and how long to retain client records) and is independently responsible for complying with the PDPA, including any sector-specific registration and Code of Practice obligations that apply to it (see Section 19).

N6N as Data Controller

In relation to Organization Account Data (business contact and billing details, admin login credentials) and platform usage/analytics data, N6N acts as a data controller in its own right.

Where required, N6N and an Organization enter into a separate Data Processing Agreement / Addendum governing N6N's processing of End User personal data on the Organization's behalf, consistent with the engagement-of-processor requirements in paragraph 14 of the Security Standard for Personal Data Processed Electronically (Personal Data Protection Standard 2015).

5. Personal Data We Collect

• 5.1 Organization Account Data including business/legal name, registration number, billing and contact details, admin names, emails, phone numbers, login credentials, and role/permission settings.
• 5.2 Booking Data including an End User's name, contact number, email address, the appointment, facility or service selected, date and time, notes given at booking, and booking/cancellation/no-show history.
• 5.3 Uploaded Document including any document, form, image or file an End User or Organization uploads in connection with a booking, for example, referral letters or intake forms (clinics), signed consent forms (wellness/beauty), vehicle registration documents (automotive workshops), or matter-related documents (law firms). See Section 8.
• 5.4 Speech-to-Text Data where the voice-input feature is used, spoken audio is processed in real time to generate a text transcript. See Section 9.
• 5.5 Sensitive Personal Data depending on the Organization's industry, Booking Data or Uploaded Documents may include sensitive personal data under Section 40 of the PDPA, for example, health information (Health Clinics & Hospitals) or information disclosed for the purpose of obtaining legal advice (Law Firms). See Section 6.
• 5.6 Device & Usage Data including IP address, device and browser type, log data, and platform interaction data, collected for security, analytics and service-improvement purposes.
• 5.7 Payment Data where Modulaur facilitates online payment for a booking, limited transaction-level data (e.g., amount, reference number, status) is processed; card and bank details are handled directly by our licensed payment gateway partner(s) and are not stored on N6N's own systems.

6. How We Use Personal Data — General Principle

Consistent with the General Principles of data processing under PDPA, personal data submitted through Modulaur is used only to:

• create, manage, confirm, reschedule and record bookings, appointments, reservations and service requests;
• verify identity or eligibility for a service where the Organization requires this (for example, a clinic confirming a returning patient);
• send booking confirmations, reminders and service-related communications;
• enable Organization staff to prepare for and deliver the booked service;
• process payments for bookings, where applicable;
• maintain booking history and client records on the Organization's behalf;
• operate, secure, support and improve the Modulaur platform; and
• comply with applicable legal and regulatory obligations.

Personal data is not used for direct marketing, or for any purpose incompatible with the purpose for which it was collected, unless separate, specific consent is obtained or another lawful basis under the PDPA applies.

7. Sensitive Personal Data — Explicit Consent

Where a booking involves sensitive personal data, such as health information provided to a Health Clinic or Hospital, or biometric data, the Organization, as data controller, is responsible for obtaining the End User's explicit consent before that information is entered into Modulaur, unless a Section 40(1) exemption applies. N6N processes such data strictly on the Organization's instructions and does not itself determine the purpose for which sensitive personal data is collected.

Organizations operating in regulated sectors remain separately responsible for their own sector's confidentiality and record-keeping rules — for example, the Private Healthcare Facilities and Services Act 1998 and the Personal Data Protection Code of Practice for Private Hospitals in the Healthcare Industry (healthcare Organizations), or the Legal Profession Act 1976 and applicable rules of legal professional privilege (law firm Organizations) — in addition to, and independently of, the PDPA.

8. Uploaded Documents and Storage

• 8.1) Segregated storage. Documents uploaded through Modulaur — by an End User directly, or by Organization staff on an End User's behalf — are stored in an isolated, Organization-specific folder within N6N's Amazon Web Services (AWS) S3 cloud storage environment. Each Organization's documents are logically segregated from every other Organization's data and are not accessible to any other Organization.
• 8.2) Access control. Access to an Organization's document folder is restricted to authorized users of that Organization and to N6N personnel who require access to provide support or maintain the Service, subject to role-based access control, authentication and audit logging of access events.
• 8.3) Encryption. Uploaded documents are encrypted in transit (TLS) and at rest, consistent with the Security Standard for Personal Data Processed Electronically under the Personal Data Protection Standard 2015.

Where Personal Data Protection Standard 2015, Security Standard for Personal Data Processed Electronically, para. 14: a data controller must bind an appointed third party by contract for operating and carrying out personal data processing activities, to ensure the safety of personal data from loss, misuse, modification, unauthorized access and disclosure; and cloud-computing transfers of personal data require the prior written consent of an officer authorised by the data controller's top management, must be recorded, and must comply with the personal data protection principles in Malaysia and, where relevant, of other countries.

• 8.4 Cloud engagement. In accordance with the paragraph above, N6N's engagement of AWS S3 to store Uploaded Documents is authorised in writing by an officer authorised by N6N's top management, is recorded, and is carried out under a written agreement with AWS that requires appropriate technical and organisational security measures. Documents are stored in the [● — e.g., AWS Asia Pacific (Singapore/Kuala Lumpur)] region. [provide actual region(s).] Where documents are stored on servers located outside Malaysia, Section 16 (Cross-Border Data Transfer) applies.
• 8.5 Retention and deletion of Uploaded Documents are managed in accordance with each Organization's instructions and Section 13 below. Organizations are responsible for configuring retention periods appropriate to the documents they collect, including any sector-specific record-keeping minimums (for example, medical record retention requirements applicable to healthcare Organizations).

9. Speech-to-Text Feature

• 9.1 No audio retention. Where Modulaur's speech-to-text feature is used, for example, for voice note-taking during or after a booking, the audio captured is processed in real time solely to generate a written transcript. The underlying audio recording is not stored, retained or reused by N6N once the corresponding text has been produced. Only the resulting text output is saved to the relevant booking or record, in accordance with the Organization's instructions.
• 9.2 Not used for voice identification. The speech-to-text feature is used solely for transcription. It is not used to identify, verify or profile a speaker from their voice pattern. Because the underlying audio is not retained and is not processed to extract characteristics for identification, N6N does not treat this transcription activity, on its own, as the processing of biometric data as defined under the PDPA. Should this functionality change to include voice-based identification or verification, N6N will update this Policy and, where sensitive personal data would result, obtain explicit consent as required under Section 40 of the PDPA before doing so.
• 9.3 Accuracy. As with any speech-to-text technology, the resulting transcript may not be a perfectly accurate record of what was said. End Users and Organization staff should review transcribed text before relying on it, particularly where it forms part of a health, legal or other sensitive record.

10. Notice and Choice

Notice and Choice Principle; Section 7, PDPA 2010 provides that a data controller must, by written notice, inform a data subject that personal data is being processed, describe the personal data and its purpose, the data subject's right to request access to and correction of the data, any third-party class of recipients, whether the supply of data is voluntary or obligatory, and the consequences of not supplying it — provided in both Bahasa Malaysia and English.

This Policy, together with the specific consent or notice presented at the point of booking, constitutes the written notice required under Section 7. Organizations that operate their own booking pages or forms on top of Modulaur are responsible for ensuring their End User-facing notices meet this requirement, including presenting the notice in both Bahasa Malaysia and English.

11. Disclosure of Personal Data

We do not sell personal data. We disclose personal data only:

• I. to the relevant Organization, for End User data collected through that Organization's use of Modulaur;
• II. to sub-processors and service providers who support the operation of Modulaur — for example, cloud hosting (AWS), payment gateway providers, SMS/email notification providers, the speech-to-text processing engine, and customer support tooling — each bound by a written contract requiring data protection standards at least equivalent to this Policy;
• III. where required or authorized by law, regulation, court order, or a lawful request from the Commissioner or another competent authority;
• IV. to professional advisers (legal, audit, insurance), bound by confidentiality, where necessary;
• V. in connection with a merger, acquisition, financing or sale of business assets, subject to confidentiality safeguards; or
• VI. with the data subject's consent.

12. Security

Consistent with the Personal Data Protection Standard 2015, N6N maintains technical and organisational measures including: encryption of data in transit and at rest; role-based access control and unique user credentials, terminated promptly when no longer required; logging and monitoring of access to personal data; confidentiality undertakings from personnel who handle personal data; written contracts with sub-processors requiring equivalent security measures; and a documented incident response process. No method of transmission or storage is completely secure, and N6N cannot guarantee absolute security.

13. Retention

Organizations, as data controllers, are responsible for configuring retention periods and deletion schedules for their End Users' data within Modulaur, taking into account applicable Malaysian legal or regulatory retention requirements (for example, healthcare record-keeping rules or tax and accounting record requirements). N6N provides the platform tools to give effect to those instructions and will securely delete or anonymize data upon expiry of the applicable retention period, upon a validly authorized deletion request, or upon termination of the Organization's subscription (subject to any legally required retention), whichever applies.

14. Data Integrity

Organizations and N6N take reasonable steps to keep personal data processed through Modulaur accurate and current, including by allowing End Users to review their booking details and request correction through the Organization or, where applicable, directly within the Platform.

15. Your Rights

Subject to the PDPA and any applicable exemptions, End Users and Organization Users have the right to:

• 1. Access: request confirmation of, and access to, personal data held about them (Section 30).
• 2. Correction: request correction of personal data that is inaccurate, incomplete, misleading, or not up to date (Section 34).
• 3. Withdraw consent: withdraw consent to processing at any time, by written notice (Section 38), subject to any resulting contractual or legal consequences.
• 4. Object to processing: require that processing likely to cause damage or distress be stopped (Section 42), and object to direct marketing (Section 43).
• 5. Data portability: request that N6N transmit their personal data to another service provider in a structured, commonly used format, where technically feasible. This right applies from 1 June 2025 under the amended PDPA.
• 6. Complain: lodge a complaint with N6N, with the relevant Organization, or directly with the Personal Data Protection Commissioner of Malaysia (see Section 24).

Because Organizations are the data controller of their own End Users' data, requests relating to a specific booking or client relationship should generally be directed to the relevant Organization in the first instance. N6N supports Organizations in fulfilling such requests within Modulaur, and responds directly to requests concerning Organization Account Data that N6N itself controls.

16. Cross-Border Data Transfer

Personal data may be transferred to, stored in, or processed in a location outside Malaysia only where:

• the recipient jurisdiction has in force a law substantially similar to the PDPA, or otherwise ensures a level of protection at least equivalent to the PDPA, as assessed through a Transfer Impact Assessment; or
• another ground under Section 129(3) applies — for example, the data subject has consented to the transfer; the transfer is necessary for the performance of a contract between the data subject and the data controller; the transfer is necessary to protect the data subject's vital interests; or the data controller has taken reasonable steps and exercised due diligence to ensure the data will not be processed in a manner that would breach the PDPA.

17. Data Breach Notification

N6N maintains a data breach response procedure consistent with the Guideline. Where a personal data breach involving End User data occurs on the Platform, N6N will notify the affected Organization without undue delay so that the Organization, as data controller, can assess the breach and, where required, notify the Commissioner, as soon as practicable, and in any event within the timeframe prescribed by the Guideline, and notify affected data subjects where the breach is likely to cause significant harm. Where N6N is independently obligated to notify (for example, in respect of Organization Account Data that N6N itself controls), it will do so directly and without undue delay.

18. Data Protection Officer

N6N has assessed its processing activities against these thresholds. [State appointment status: e.g., “N6N has appointed a Data Protection Officer, registered with the Commissioner, who can be contacted at [●].” or “N6N does not currently meet the mandatory appointment thresholds and will appoint a Data Protection Officer if and when it does; data protection enquiries can in the meantime be directed to [●].”]

Organizations that independently meet these thresholds in respect of their own End Users are separately responsible for appointing and registering their own Data Protection Officer; Modulaur does not do this on an Organization's behalf.

19. Registration and Sectoral Obligations of Organizations

Organizations operating in these regulated sectors; which, on Modulaur, includes Health Clinics & Hospitals and Hospitality (Restaurants, Hotels & Travel), are independently required to register as a data controller with the Commissioner and to comply with any applicable Code of Practice, such as the Personal Data Protection Code of Practice for Private Hospitals in the Healthcare Industry. This is a registration obligation of the Organization itself; it is not, and cannot be, fulfilled by the organization, N6N holds no liability for any such negligence on Organization’s part.

Organizations in sectors without a dedicated sector Code of Practice, including Clubs, Law Firms, Automotive, Selfcare, Showroom, Training, Shop and Public/Nonprofit, remain subject to the PDPA's general obligations and the General Code of Practice, where applicable to their class of data controller.

20. Children's and Minors' Data

Modulaur is not directed at children. Where an Organization (for example, a Training school/institute, or a Health Clinic) collects personal data of an individual under 18 in connection with a booking, the Organization, as data controller, is responsible for obtaining consent from the minor's parent or legal guardian before submitting that data to Modulaur.

21. Cookies and Similar Technologies

Where Modulaur is accessed through a web-based booking widget, cookies and similar technologies may be used for authentication, security, remembering preferences, and analytics. [ further detail, or a link to a separate Cookie Notice, if a booking widget or public-facing website is offered.]

22. Third-Party Services and Links

Modulaur may link to, or integrate with, third-party services (for example, payment gateways, calendar integrations, or mapping services). This Policy does not cover the privacy practices of those third parties, and N6N encourages Organizations and End Users to review the relevant third party's own privacy notice.

23. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices, the Platform, or applicable law (including further guidelines issued under the PDPA). Where changes are material, we will provide reasonable notice to Organizations, and, where applicable, refresh End User consent before the change takes effect. The “Last Updated” date at the top of this Policy indicates when it was last revised.

24. How to Contact Us / Lodge a Complaint

Questions, requests, or complaints about this Policy or N6N's handling of personal data may be directed to:

N6N's Data Protection Officer / Privacy Team: contact@n6n.my / Unit 32-01, Level 32, The Vertical Corporate Office Tower B, Avenue 10, Bangsar South No.8 Jalan Kerinchi 59200 Kuala Lumpur Malaysia.

If you are not satisfied with our response, you may lodge a complaint directly with:

Department of Personal Data Protection (Jabatan Perlindungan Data Peribadi), Level 8, Galeria PjH, Jalan P4W, Persiaran Perdana, Precinct 4, Federal Government Administration Centre, 62100 Putrajaya, Malaysia.

25. Governing Law

This Policy is governed by, and construed in accordance with, the laws of Malaysia, including the Personal Data Protection Act 2010 and its subsidiary legislation, regulations, standards and guidelines, without regard to their conflict-of-law provisions.