Legal · B2B · Technical Governance

Data Processing Policy

This policy describes the technical and organisational measures Zenta Technologies Sdn. Bhd. applies when processing personal and business data through the GetZenta platform. It is intended for audit firms, enterprise clients, and procurement teams evaluating GetZenta's data governance approach.

Last updated: 23 October 2026 Role: Processor for customer records (Zenta Technologies Sdn. Bhd. 202501060152) Governing law: Malaysia (PDPA 2010, as amended) Audience: B2B / Procurement / Legal
Section 01

Scope & Purpose

This policy outlines the technical and organisational measures used by Zenta Technologies Sdn. Bhd. to process personal and business data submitted by Users of the GetZenta platform. It supplements the Privacy Policy and is intended for procurement, legal, and IT audiences evaluating GetZenta for enterprise or audit firm deployment.

What GetZenta Processes

  • Receipt and invoice images and extracted structured fields
  • Account and identity data for platform users (Auditors, SMEs, Staff)
  • Audit trail and review decision records
  • Credit and subscription transaction records
  • Usage metadata for platform security and operational monitoring

Roles

For customer records submitted through the platform, Zenta generally acts as a Data Processor and the User as the Data User, processing on the User's instructions to deliver the service. For Zenta's own account administration, billing, security, support and legal-compliance purposes, Zenta acts as a Data User. See Privacy Policy Section 01.

Processing Basis

Data is processed on the basis of contractual necessity — to deliver the GetZenta service as described in the Terms of Service — and to fulfil legal obligations under Malaysian law, including the Income Tax Act 1967 and PDPA 2010, as amended.

Zenta Technologies does not process customer data for purposes beyond those disclosed in this policy and the Privacy Policy. We do not sell or rent customer data. We do not use customer content to train AI models; AI provider terms and settings apply and may change.

PDPA 2010, as amended Contractual Necessity Basis Malaysia-First Design
Section 02

Infrastructure & Architecture

GetZenta is built on a multi-layer architecture designed to support data separation, regional processing, and traceability.

🗄️
Database
Managed Relational Database
Organisation-scoped access controls, including database-level policies. Southeast Asia regional infrastructure.
🔐
Auth & Access
Managed Authentication
Short-lived authenticated sessions. MFA intended to be available. Organisation-scoped role assignment.
📁
File Storage
Private Object Storage
Receipt images and document files are intended to be stored with organisation-scoped access policies.
🤖
AI / OCR
Cloud AI Services
AI-assisted OCR and field extraction. Provider terms and settings govern provider-side retention.
🔧
Backend Logic
Server-Side Orchestration
Controlled backend functions for materiality calculation and workflow orchestration.
💳
Payments
Third-Party Payment Processor (where used)
Not designed to receive or store card data. Payment arrangements are confirmed during Alpha.

Organisation-Scoped Access Controls

Database requests in GetZenta are intended to be evaluated against organisation-scoped access controls tied to the authenticated user's organisation context. This is designed to mean:

  • One organisation's records are designed to be kept separate from another's, in addition to application-layer filtering
  • Database-level controls are intended as defence-in-depth if an application-layer control fails. They are not a guarantee against every failure mode.
  • Each user's role (Auditor, SME, Staff) further restricts which records and actions are permitted within their own organisation

Data Residency

Primary data storage and processing runs on Southeast Asia regional infrastructure. This supports regional processing for Malaysian compliance workflows. AI processing may involve cross-border transmission — see Section 04 for details.

Section 03

Sub-Processor List

The following categories of third-party sub-processors are currently engaged by Zenta Technologies in the delivery of the GetZenta platform. This list reflects our current production arrangements as of the last updated date above. We will notify changes as described below.

Sub-processors are described by category and by the standards the provider itself states it holds. Names and processing locations can be requested through the DPA process in Section 08.

Sub-Processor Purpose Data Processed Jurisdiction Provider's Standards
Managed Platform Infrastructure Provider Database, authentication, file storage, and server-side functions Platform data including receipts, user records, and audit trail Southeast Asia regional infrastructure SOC 2 Type II
Cloud AI Provider Receipt OCR, field extraction, and evidence signal generation Receipt images and extracted text, processed for each request; provider terms apply Global infrastructure ISO 27001 SOC 2
Payment Processor (where used) Payment processing and billing, where card or online payments are used Transaction reference, amount, and status — GetZenta is not designed to receive card data Global infrastructure PCI-DSS SOC 2
ℹ️

Standards and orchestration: The standards shown are those the providers themselves state they hold. They are not certifications of Zenta, and the current reports should be checked with the provider. Workflow orchestration and compliance processing are intended to run through GetZenta-controlled backend infrastructure. If any additional vendor processes production customer data, it will be added to this list.

Sub-Processor Change Notification

Zenta Technologies will provide advance notice of any new sub-processor engagement or material change to an existing sub-processor via email to registered account holders and update to this page. Notice will be provided at least 14 days before the change takes effect, except in cases of urgent security requirements.

Section 04

AI Processing Disclosure

GetZenta uses third-party cloud AI services for optical character recognition (OCR) and evidence signal generation. This section supports transparency under the Notice and Choice Principle of PDPA 2010 and is intended for procurement and legal review.

How AI Processes Your Data

  • When a User submits a receipt or invoice, the image is transmitted to a cloud AI service via an encrypted API connection
  • The AI service returns structured extracted fields: merchant name, date, total, tax values, and confidence score
  • The image and extracted data are then stored in GetZenta's own platform environment under the User's organisation scope
  • The AI provider processes the image for inference. Provider-side retention is governed by the provider's terms and settings; where configuration options are available, we aim to limit it.

Human Override Design

GetZenta is designed so that AI output is not treated as a final compliance determination. Extracted records are designed to be in one of three states:

  • Evidence Ready: High-confidence extraction, no risk flags — presented to the User for final confirmation
  • Review Gate: Low-confidence extraction, high-value threshold, or risk signal — designed to be routed to the human reviewer queue before any further action
  • Exception: Extraction failed or record incomplete — held pending User input

The AI is not designed to issue compliance status, audit opinions, or LHDN submission readiness independently. These determinations remain with the User or their appointed professional.

Cross-Border AI Processing

Cloud AI inference may occur on infrastructure outside Malaysia and Singapore. Cross-border processing is part of how the service works. As Data User, the User is responsible for giving the notices and obtaining the consents, or having another lawful basis, for the transfer of their clients' and staff members' personal data. Where configuration options are available, we aim to limit data retention by the provider beyond the immediate inference request. We review AI sub-processors before engagement.

⚠️

Specific AI model versions are not listed in this policy. They may change as our technical stack is updated. Procurement teams requiring specific model disclosures for contractual purposes should request this via the DPA process in Section 08.

Section 05

Access Controls & Security Measures

We take steps designed to protect data through the measures below. They describe our current approach; no system is completely secure. See also the Security Statement.

Enc
Encryption at Rest & in Transit
Data is intended to be protected by industry-standard encryption at rest and modern transport encryption in transit, including API calls to AI sub-processors and payment gateways. Encryption is provided at the infrastructure layer by our hosting providers.
Iso
Organisation-Scoped Access Controls
Database requests are intended to be evaluated against organisation-scope and role-membership controls. These are designed to keep records separate across organisations, in addition to application-layer restrictions.
RBAC
Role-Based Access Control
Three distinct role tiers — Auditor, SME, Staff — with different permission scopes for data read, write, review, and export. Role assignments are organisation-scoped and administrator-controlled.
MFA
Multi-Factor Authentication
MFA is intended to be available for platform users, and we intend to require it for Zenta Technologies administrative infrastructure access. Authenticated sessions are short-lived and refreshed on re-authentication.
Audit
Traceable Audit Trail
Evidence decisions — AI extraction output, human review actions, override reasons, and timestamps — are designed to be recorded in an audit log. Changes to locked records are designed to generate a visible audit event. This is intended to support ISA 230 documentation workflows.
Access
Administrative Access Controls
Production database and infrastructure access is intended to be limited to authorised Zenta Technologies personnel. Access is intended to be logged, reviewed periodically, and revoked on role change.
Section 06

Data Retention Schedule

The following schedule describes how long different categories of data are retained by Zenta Technologies in connection with the GetZenta platform.

Data Category Retention Period Basis Post-Period Action
Evidence records & audit trail Duration of active subscription Contractual necessity; ITA 1967 support Available for export 90 days post-closure, then securely deleted or anonymised
Account & identity data Duration of active subscription + 90 days Contractual necessity; PDPA 2010 Securely deleted or anonymised 90 days after account closure
Receipt & document images Duration of active subscription Contractual necessity Securely deleted with evidence records
Payment transaction records 7 years Companies Act 2016; tax compliance Retained in anonymised form for financial audit purposes
Security & access logs 12 months rolling Security incident investigation Purged after 12 months
AI extraction logs Governed by the AI provider's terms and settings Processing for each request Extracted fields stored in GetZenta's database; provider-side retention follows the provider's terms and configured settings
⚠️

GetZenta's 90-day post-closure window is shorter than the 7-year retention period under the Income Tax Act 1967. Users are responsible for exporting compliance records before account closure or arranging extended retention in writing before termination.

Section 07

Breach Response SLA

Zenta Technologies maintains a structured breach response process with defined service-level commitments for notification and remediation.

Detection & Containment

  • Detection: Monitoring through infrastructure logs; our detection capabilities will develop over time
  • Containment target: We aim to isolate affected access within 4 hours of confirmed breach identification

Notification SLA

  • User notification: Within 24 hours of internal confirmation of a breach affecting User data
  • Regulator and individual notification: Where required by law, notification to the Personal Data Protection Commissioner and affected individuals is the User's obligation as Data User. Our 24-hour notice is intended to support it within the period required by law.
  • Ongoing updates: We aim to provide updates every 24 hours during an active incident until resolution

Breach Notification Content

Each breach notification will include: nature of the breach, categories and approximate volume of data affected, likely consequences, measures taken and proposed, and data protection contact details for further enquiries.

Post-Incident Review

Following resolution of any significant breach, Zenta Technologies will conduct a post-incident review and provide affected Users with a summary of findings and remediation measures within 30 days of incident closure.

ℹ️

To report a suspected security incident or data breach: dpo@getzenta.com.my or hello@getzenta.com.my. Urgent security matters should be submitted through verified email channels with clear incident details.

Section 08

DPA Request Process

Audit firms, enterprise clients, and organisations with contractual data processing requirements may request a formal Data Processing Agreement (DPA) from Zenta Technologies. A DPA may supplement this policy with organisation-specific terms and, where agreed, audit rights.

When to Request a DPA

  • Your organisation's procurement policy requires a formal DPA with all SaaS vendors
  • You are deploying GetZenta across multiple client workspaces under a branded intake arrangement
  • You require sub-processor names, locations or specific AI model disclosure for contractual purposes
  • Your organisation requires additional security evidence beyond this policy
  • You are an audit firm subject to ISQM 1 or other professional body data governance requirements

Request a Data Processing Agreement

📧 Email: hello@getzenta.com.my — subject line: "DPA Request — GetZenta"
📞 Contact channel: verified email request only
⏱ Initial response: within 3 business days  ·  DPA draft: we aim to provide within 10 business days
📋 Please include in your request: organisation name, registration number, nature of deployment, and specific DPA requirements or template if applicable

This Data Processing Policy describes Zenta Technologies' processing practices as of the last updated date above. It does not constitute legal advice, certification or regulatory approval, and does not replace a formal Data Processing Agreement where one is required. Zenta Technologies reserves the right to update this policy to reflect changes in technology, law, or business practice. Material sub-processor changes will be communicated with a minimum of 14 days' advance notice.

For DPA requests or technical enquiries: hello@getzenta.com.my  ·  Updated 23 October 2026

🔒 Privacy Policy → 🛡️ Security Statement → 📄 Terms of Service →