Privacy notice for staff

What we keep about you

ARUNEXA SDN. BHD. (202401051256 (1597099-K)) keeps your display name, sign-in e-mail, the card's issuer and last four digits, every card spend you log (merchant, amount, purpose), receipt images, approval notes, the devices you sign in with (browser, system, times) and, if you connect it, your Telegram chat. Your entries may name clients or partners you met: type names only, never phone numbers or ID numbers.

Source: you, your sign-in account, the card authorisation letters of 19 October 2026 and the BDM card expense tracker sheet. Obligatory: sign-in account, display name, card last four digits, spend details and receipts. Voluntary: Telegram (reminders then arrive in the app only) and form language.

Why, who sees it, and for how long

Purposes: expense control, approval, audit and statutory record keeping. A BDM sees their own card and spends; the Owner and approvers see every spend; the operator account can read for support. Receipts and approval evidence are kept 7 years from the end of the financial year of the charge (Income Tax Act s.82, Companies Act s.245).

Where it is processed: Amazon Web Services in Malaysia (database, files, backups, logs). Outside Malaysia: Telegram (message text with your name, amounts, merchant, dates and approver notes; never purpose text, e-mails or receipt images), Google (sign-in identity, if used), Sentry (error reports with personal data removed) and Cloudflare (encrypted traffic in transit).

To see or correct your data, ask the Owner; you will get an answer within 21 days. Continuing at your first sign-in records that you have read this notice.