Baca dalam Bahasa MalaysiaIssued pursuant to the Personal Data Protection Act 2010 as amended by the Personal Data Protection (Amendment) Act 2024Please read this Privacy Notice ("Notice") carefully. It explains how MOCHI Technologies Sdn Bhd ("MOCHI", "we", "us" or "our") collect, use, disclose, store and protect your personal data, and what choices and rights you have, in compliance with the Personal Data Protection Act 2010 and its 2024 amendments ("PDPA").This Notice applies to: (a) visitors to our websites and users of our mobile applications; (b) prospects, customers and business contacts who interact with us; and (c) authorized users of the MOCHI Business Growth Software and related products (collectively, the "Subscription Service"). Together, we refer to these individuals as "you" in this Notice.Where you, as a MOCHI customer, collect and process personal data of your own customers, employees or other individuals through the Subscription Service ("Customer Data"), you act as the data controller of that data, and MOCHI acts only as a data processor acting on your instructions. Section 9 of this Notice explains this distinction further. If you do not agree with this Notice, please do not use our websites or the Subscription Service.
MOCHI is Malaysia's Business Growth Software, providing CRM, point-of-sale, loyalty, marketing, HR and AI automation products to businesses. The data controller responsible for your personal data under this Notice is:
MOCHI Technologies Sdn Bhd (1557696-T) 50-2, Jalan Kuchai Maju 10, Kuchai Entrepreneurs Park, Off Jalan Kuchai Lama, 58200 Kuala Lumpur. Tel: +603-7972 4699
We collect personal data directly from you, automatically through your use of our websites and the Subscription Service, and occasionally from third parties. The categories below describe what we collect and from whom.
Information you give us
Website and enquiry forms: name, email address, phone number, job title and company details when you fill in a contact, demo or enquiry form.
Account and sign-up information: name, email, phone number, company name and login credentials when you or your organization registers for a MOCHI account.
Billing and payment information: billing address, billing contact details and payment-related information when you subscribe to a paid plan. Card and bank details are collected and processed directly by our licensed third-party payment processors; MOCHI does not store full payment card numbers.
Event and marketing information: name, contact details and dietary or accessibility preferences when you register for a MOCHI event, roadshow or webinar.
Communications: any information you provide when you contact our support team, give feedback, or provide a testimonial (which we will only publish with your consent).
Information collected automatically
Device and log data: IP address, browser type, device identifiers, operating system, referring website addresses and access timestamps, collected when you visit our websites or use our mobile applications.
Usage data: how you and authorized users in your organization interact with the Subscription Service, such as features used and session activity, used to support and improve the product.
Location data: with your device permission, we may collect approximate or precise location data to enable location-based features (for example, attendance check-in or field-sales tracking) within the Subscription Service.
Cookies and similar technologies: as described in Section 8 below.
Information from third parties
Service providers, business partners and publicly available sources, such as company registries or LinkedIn, for legitimate business development purposes.
Third-party integrations that you or your organization choose to connect to your MOCHI account. You are responsible for reviewing the permissions you grant to any third-party integration.
Sensitive personal data
Where our HR-related products (MOCHI HRMS/HRPS) are used by an employer to process employee data such as bank account details, NRIC/passport numbers, or health-related leave information, this constitutes sensitive personal data under the PDPA. MOCHI processes such data strictly as a data processor on the instructions of the employer (our customer), who is responsible for obtaining the explicit consent of their employees prior to such processing.
We only process personal data where we have a valid legal basis to do so under the PDPA — generally because you have given consent, because processing is necessary to perform a contract with you, or because we have a legitimate business interest that does not override your rights. We use your personal data for the following purposes:
To provide, operate and maintain our websites and the Subscription Service, including creating and managing your account.
To process payments and manage billing for paid subscriptions.
To communicate with you about your account, transactions, security incidents, and changes to our terms or this Notice.
To provide customer support and respond to enquiries or complaints.
To send you marketing communications about MOCHI products and services, where you have consented to receive these (you may withdraw this consent at any time — see Section 7).
To organize and manage your participation in MOCHI events, roadshows and webinars.
To monitor, analyze and improve the performance, security and functionality of our products, generally using aggregated or de-identified data.
To detect, investigate and prevent fraud, unauthorized access, or misuse of the Subscription Service, and to enforce our Acceptable Use Policy and Customer Terms of Service.
To comply with our legal and regulatory obligations, including obligations under the PDPA, tax and corporate law.
For any other purpose disclosed to you at the time of collection, or with your consent.
Where we rely on your consent for a particular purpose, you have the right to withdraw that consent at any time by contacting us using the details in Section 11. Withdrawing consent will not affect the lawfulness of any processing carried out before withdrawal, and may limit our ability to continue providing certain features of our products to you.
We do not sell your personal data. We disclose personal data only for the purposes described in this Notice, or with your consent, to the following classes of recipients:
Service providers and sub-processors: engaged to provide hosting, cloud infrastructure, payment processing, analytics, customer support, and communication services on our behalf, under written confidentiality and data protection obligations.
Business and integration partners: third-party applications or platforms you or your organisation choose to connect to your MOCHI account. We are not responsible for the data practices of these third parties once data is shared at your direction.
Co-marketing partners: where you engage with joint marketing content, we will identify the partner and provide a link to their privacy policy before sharing your data.
Professional advisers and authorities: lawyers, auditors, regulators, or law enforcement agencies, where required or permitted by law, or to protect our legal rights, your safety, or the safety of others.
Corporate transactions: in connection with a merger, acquisition, financing, or sale of business assets, subject to confidentiality arrangements. We will notify you of any material change in ownership or use of your personal data.
All third parties who process personal data on our behalf are required by contract to use it only for the agreed purposes and to apply security measures consistent with this Notice and the PDPA.
Some of our service providers and cloud infrastructure may be located outside Malaysia. Where we transfer your personal data outside Malaysia, we will only do so in accordance with Section 129 of the PDPA — that is, where the recipient country has a law substantially similar to the PDPA, ensures an adequate level of protection, or where one of the statutory exceptions under the PDPA applies (for example, with your consent, or where the transfer is necessary to perform a contract with you). Where required, we put in place appropriate contractual safeguards with the recipient to protect your personal data to a standard comparable to the PDPA.
Security
We implement appropriate technical and organizational measures to protect personal data against loss, misuse, unauthorized access, modification or disclosure, as required under the Security Principle of the PDPA. These measures include encryption in transit, access controls, network security monitoring, and staff confidentiality obligations. While we take reasonable steps to protect your personal data, no method of electronic storage or transmission is completely secure, and we cannot guarantee absolute security.
Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy any legal, accounting or reporting obligations, in line with the Retention Principle of the PDPA. As a general guide:
Account and Subscription Service data is retained for the duration of your contractual relationship with MOCHI and for a reasonable period afterwards to address any legal claims or obligations.
Marketing data is retained until you withdraw consent or unsubscribe, or after a reasonable period of inactivity.
Customer Data processed on behalf of our customers is retained in accordance with the applicable Customer Terms of Service and Data Processing Agreement.
When personal data is no longer required, we will securely delete or anonymize it. Where immediate deletion is not technically possible, we will securely isolate the data from further processing until deletion can be completed.
Subject to any applicable exceptions under the PDPA, you have the following rights in relation to your personal data:
Right of access: to request confirmation of whether we process your personal data, and to obtain a copy of it.
Right to correction: to request that we correct any personal data that is inaccurate, incomplete, misleading or outdated.
Right to withdraw consent: to withdraw any consent previously given for the processing of your personal data, by written notice to us.
Right to limit processing: to request that we cease or limit processing your personal data for purposes you no longer agree to, including direct marketing.
Right to data portability: to request, where technically feasible, that your personal data be transmitted directly to another data controller.
Right to complaint: to lodge a complaint with us, or with the Personal Data Protection Commissioner of Malaysia, if you believe we have breached the PDPA.
To exercise any of these rights, please contact our Data Protection Officer using the details in Section 11. We will respond to your request within the timeframe required under the PDPA. We may need to verify your identity before processing your request, and certain requests may be subject to a prescribed fee or statutory exceptions.If your enquiry relates to personal data that a MOCHI customer controls and manages using the Subscription Service (i.e. Customer Data), please contact that customer/organization directly, as MOCHI acts only as their data processor and will assist them in fulfilling your request where required.
Our websites and the Subscription Service use cookies, pixels and similar tracking technologies to operate properly, remember your preferences, and understand how our websites are used. These may include strictly necessary, performance/analytics, and marketing cookies. You can manage or withdraw your cookie preferences at any time through your browser settings or our cookie consent tool. Disabling certain cookies may affect the functionality of our websites.
Many of our customers use the Subscription Service to manage their own customers, employees or members. If you are a customer, employee, or contact of a business that uses MOCHI's products, that business is the data controller of your personal data, and MOCHI is only the data processor, processing such Customer Data strictly on that business's documented instructions and under a Data Processing Agreement. MOCHI does not control, and is not responsible for, the purposes for which our customers collect or use Customer Data. If you wish to exercise any data protection right in relation to such data, please contact the relevant business directly.
In the event of a personal data breach that causes or is likely to cause significant harm to affected data subjects, we will notify the Personal Data Protection Commissioner and affected individuals as soon as practicable, and in any event within the timeframe prescribed under the PDPA and its guidelines, together with information on the nature of the breach and the steps we are taking to address it.
If you have any questions, concerns, or requests relating to this Notice or our handling of your personal data, or if you wish to make a complaint, please contact our Data Protection Officer:Data Protection Officer (DPO) Mochi Technologies Sdn Bhd Address: 50-2, Jalan Kuchai Maju 10, Kuchai Entrepreneurs Park, 58200 Kuala Lumpur, Malaysia Email: dpo@gobsglobal.com Telephone: 603-7972 4699 Website: www.mochi.globalWe will acknowledge and investigate all complaints regarding our handling of personal data.
Our websites and the Subscription Service are intended for business use and are not directed at children. We do not knowingly collect personal data from individuals under the age of 18 without the consent of a parent or legal guardian. If we become aware that we have unintentionally collected personal data from a child without appropriate consent, we will take steps to delete such data promptly.
We may update this Notice from time to time to reflect changes in our practices, products, or applicable law. We will post the updated Notice on this page with a revised "Last updated" date, and where changes are material, we will provide additional notice, such as by email or an in-app notification. We encourage you to review this Notice periodically.This Privacy Notice was last updated on 1st September 2026.
This Privacy Notice is provided in both English and Bahasa Malaysia. In the event of any discrepancy or inconsistency between the two versions, the English version shall prevail.