This policy explains how Zenta Technologies Sdn. Bhd. collects, uses, protects, and retains personal data in connection with the GetZenta platform — and what rights you may have under Malaysian law.
Effective: 31 March 2026Last updated: 23 October 2026Operator: Zenta Technologies Sdn. Bhd. (202501060152)Governing law: Malaysia (PDPA 2010, as amended)
Section 01
The Gatekeeper Principle: Data User vs. Data Processor
Under Malaysia's Personal Data Protection Act 2010, as amended (PDPA 2010), roles in data handling are legally defined. Roles depend on the processing activity, and the distinctions below describe how we generally approach them.
For customer records, you are generally the Data User
The User — the Auditor, SME owner, or business entity operating on GetZenta — is generally the "Data User" under PDPA 2010 for the records it submits. You determine the purpose for which that personal data is collected and processed. You are responsible for the lawfulness of your data inputs and for giving the notices and obtaining the consents, or having another lawful basis, that apply to your own clients, staff and other data subjects before processing their information through the platform.
For customer records, we generally act as Data Processor
Zenta Technologies Sdn. Bhd. generally acts as a "Data Processor" for customer records. We process that personal data on your instructions and for the purposes of delivering the service to you. We do not sell or rent customer data.
For our own business purposes, we are a Data User
For account administration, billing, security, support, service improvement and legal compliance, Zenta processes limited personal data, such as account holders' contact details and usage data, for its own business purposes. For that data, Zenta acts as a Data User.
Your Warranty
By using GetZenta, you confirm that you have the consents, notices or other lawful basis required to submit your clients', staff members' and other data subjects' documents for processing through the platform. You acknowledge responsibility for the lawfulness of your data inputs under applicable law, including PDPA 2010.
Data User / Processor RolesPDPA 2010, as amended
Section 02
What Data We Collect
GetZenta aims to apply data minimisation — we seek to collect only what is needed to deliver the service you have requested.
Account & Identity Data
Full name, email address, and mobile number for account creation
Organisation name, registration number (if provided), and business type
Role assignment within the platform: Auditor, SME, or Staff
Authentication credentials — stored in hashed form
Receipt & Document Data
Images and files of receipts, invoices, and supporting documents you submit
AI-extracted fields: merchant name, transaction date, total amount, tax values, and transaction reference numbers
Confidence scores and risk signals generated during AI extraction
Business purpose notes and descriptions you add to records
Audit Trail & Review Data
Human review decisions, override reasons, and approval timestamps
Compliance state changes and exception routing history
Reviewer identity associated with each decision (organisation-scoped)
Usage & Technical Data
Session metadata, platform interaction logs, and feature usage patterns
Credit consumption records and subscription status
Device type, browser, and security metadata, including IP address where required for security monitoring
Error logs used to diagnose and resolve technical issues
We do not intentionally use document content for purposes beyond delivering the extraction and review workflow you initiate, security, support and legal compliance. Beyond what you submit, we collect only the usage and technical data described above.
Section 03
How We Use Your Data
Personal data is used for the following purposes. We do not use customer data for advertising or third-party profiling.
Platform Delivery
To operate GetZenta, process receipts, generate evidence trails, manage your workspace, and deliver the features described in our Terms of Service.
Compliance Support
To support LHDN MyInvois-related workflows and to help structure records that support ISA 230 and ISA 500 documentation, as directed by you as the Data User.
Security & Integrity
To detect and respond to security incidents, prevent abuse, enforce access controls, and maintain organisation-scoped access controls.
Service Communications
To send transactional notices: account verification, password resets, credit usage alerts, and subscription status updates. We do not send marketing communications without your explicit consent.
Legal & Regulatory Obligations
To comply with applicable Malaysian law, respond to lawful regulatory requests, and maintain records required under the Income Tax Act 1967 and PDPA 2010.
ℹ️
We do not use customer content to train AI models. We choose and configure AI services with the intention that customer content is not used to train the provider's general-purpose models; provider terms and settings apply and may change.
Section 04
AI & Automated Processing Disclosure
To support transparency under the Notice and Choice Principle of PDPA 2010, we disclose that GetZenta uses authorised third-party AI services, including optical character recognition (OCR) and document understanding processors — to extract structured data from documents you submit.
What AI Does in GetZenta
Reads receipt and invoice images to extract structured fields
Generates confidence scores to indicate extraction reliability
Identifies risk signals such as high-value transactions or unclear merchants
Routes low-confidence or high-risk records to a human review queue
What AI Does Not Do
AI is not designed to make final compliance determinations or to confirm LHDN submission or validation status
AI does not certify audit evidence, issue professional opinions, or replace professional judgment
AI is not intended to approve high-risk records — these are routed to human review
AI output is not legally binding and is intended to be reviewed by a person
Human-in-the-Loop Architecture
GetZenta is designed to reduce reliance on solely automated decisions on compliance-critical matters. Extracted records are intended to be reviewed, and approved or overridden by the User, before they are treated as Evidence Ready. Review thresholds and routing rules may change as the product develops.
AI Sub-Processors
AI processing is performed through third-party cloud AI services. We do not list specific model versions in this policy because they may change. Categories of sub-processors are described in the Data Processing Policy, which we aim to update when a material change occurs.
Where configuration options are available, we aim to limit retention by the AI provider beyond the scope of the immediate processing request.
⚠️
AI outputs are evidence signals, not professional advice. For all tax, audit, or compliance decisions, consult a qualified Malaysian tax agent or MIA-registered auditor.
Section 05
Payment & Credit Data
GetZenta uses Evidence Credits to measure use of platform services. During Alpha, commercial and payment arrangements are confirmed directly with the founding team. Where card or online payments are used, they are intended to be processed through third-party payment gateways. GetZenta is not designed to receive or store card numbers, bank credentials, or full payment instrument details.
What GetZenta May Receive from Payment Processors
Transaction reference number and payment status (succeeded / failed / refunded)
Amount charged, currency, and timestamp
Account identifier used for credit allocation
Subscription tier and renewal status confirmation
What GetZenta Is Not Designed to Store
Card numbers or CVV codes
Card expiry dates
Bank account numbers
Online banking credentials
FPX transaction PIN or OTP
e-Wallet login credentials
Payment Processor
Where a payment processor is used, card and banking data is intended to be handled by the processor under its own PCI-DSS programme. GetZenta is intended to receive payment confirmation, not payment credentials.
Processor
Purpose
Jurisdiction
Compliance Standard
Third-party payment processor (where used)
Card payments and subscription billing
Global infrastructure
Processor's own PCI-DSS programme (not a Zenta certification)
Additional local payment methods (FPX, e-wallet) may be added in future. This section will be updated before any new gateway is activated.
Credit Balance Data
Your Evidence Credit balance, top-up history, and consumption records are stored within GetZenta's platform database under the same organisation-scoped access controls as other user data. Credit validity, expiry and transferability are set out in your order or agreement with Zenta.
🛡️
If you believe an unauthorised transaction has been charged to your account, contact us promptly at hello@getzenta.com.my. We will investigate and liaise with the payment processor where required.
Section 06
Security Measures
We take steps designed to meet our security obligations under PDPA 2010, as amended, through the following technical and organisational measures. They describe our current approach; no system is completely secure. See also the Security Statement.
01
Data Minimisation
We aim to extract only the fields required for the defined LHDN MyInvois-related and audit evidence workflow, and to avoid retaining additional fields beyond what the User submits for processing.
02
Encryption at Rest & in Transit
Data is intended to be protected by encryption in transit and at rest, using controls provided by our infrastructure providers and industry-standard practices. Specific controls are described in the Security Statement.
03
Organisation-Scoped Access Controls
GetZenta uses organisation-scoped access controls, including database-level row-level security policies, designed to keep each organisation's records separate. Access is scoped to the authenticated user's organisation and role.
04
Role-Based Access Control
Platform access is governed by three role tiers — Auditor, SME, and Staff — each with distinct permission scopes. Administrative infrastructure access is limited to authorised Zenta Technologies personnel and is intended to be protected by multi-factor authentication.
05
Managed Infrastructure and Sub-processor Review
Primary infrastructure runs on managed platform services in a Southeast Asia regional environment. We review sub-processors, including cloud AI services and payment processors, before engagement. Any certifications are those of the provider, not of Zenta.
06
Traceable Evidence Decisions
Once an evidence record is locked, changes to the decision trail — AI extraction output, reviewer identity, override reason, and timestamp — are designed to be recorded as visible audit events. This is intended to support accountability and ISA 230 documentation workflows.
07
Human-in-the-Loop Review Gate
High-risk, high-value, or low-confidence records are designed to be routed to human review before they are treated as export-ready. This is intended to reduce reliance on automated decisions on matters with material compliance consequences.
Section 07
Data Retention & the 7-Year Rule
Retention at GetZenta is governed by two intersecting obligations: the PDPA 2010 principle that data should not be kept longer than necessary, and the requirement under the Income Tax Act 1967 that tax-related records be retained for seven years.
Active Subscription
Zenta Technologies retains your evidence records, audit trail data, and account information for the duration of your active subscription. Records are intended to remain accessible to you during this period, subject to the applicable agreement.
Post-Termination
Upon account closure, you are responsible for exporting your compliance records before deactivation. GetZenta retains your data for 90 days following account closure to allow for data export, after which records are securely deleted or anonymised unless:
An extended retention arrangement has been separately agreed in writing
A legal hold or regulatory requirement prevents deletion
Anonymised aggregate data (no personal identifiers) is retained for internal service improvement
The 7-Year Compliance Window
GetZenta's default 90-day post-closure window is intentionally shorter than the 7-year statutory requirement under the Income Tax Act 1967. You, as the Data User, remain responsible for maintaining any archive you are legally required to keep. Export your records before closing your account, or contact us to discuss an extended retention arrangement prior to termination.
⚠️
Export your data before closing your account. GetZenta's 90-day post-closure window is shorter than the 7-year retention period under Malaysian tax law. Maintaining your own archive is your responsibility as Data User.
Section 08
Cross-Border Data Transfers
GetZenta's primary infrastructure is hosted in a Southeast Asia regional environment, supporting regional data processing for Malaysian compliance workflows. However, some platform functions involve cross-border data processing.
Where Your Data May Travel
AI processing: Receipt images and extracted fields are transmitted to cloud AI services for OCR processing. These services may operate on infrastructure outside Malaysia and Singapore.
Payment processing: Where payment gateways are used, transaction data is processed by the payment processor under its own jurisdictional framework and security programme.
Our Safeguards
Cross-border processing of the personal data in your submissions is part of how the service works. As Data User, you are responsible for giving the notices and obtaining the consents, or having another lawful basis, for the processing and transfer of your clients' and staff members' personal data. For our own account and usage data, we rely on the notices in this policy. We seek contractual and other safeguards from material sub-processors intended to provide an appropriate level of protection, taking into account PDPA 2010, as amended, and the nature of the processing. We do not guarantee that protection will be identical in every jurisdiction.
Where configuration options are available, we aim to limit retention by the AI provider beyond the scope of the immediate request.
Categories of sub-processors and the jurisdictions we currently disclose are described in the Data Processing Policy. Contact the data protection contact below for further information.
Section 09
Your Rights Under PDPA 2010
Under the Personal Data Protection Act 2010, as amended, you may have the following rights in relation to personal data Zenta Technologies holds about you. These rights apply to your own personal data — not to the personal data of your clients, which you control as the Data User.
Right of Access S.30
Request a copy of the personal data we hold about you and information about how it is being processed.
Right of Correction S.34
Request correction of inaccurate, incomplete, misleading, or outdated personal data we hold.
Withdraw Consent S.38
Withdraw consent to processing of your personal data at any time, subject to any legal or contractual obligations requiring continued retention.
Prevent Processing S.42
Request that we cease or not begin processing your personal data for purposes likely to cause substantial damage or distress.
Data Portability Platform
Export your evidence records, audit trail, and account data in standard formats (CSV / JSON) via the platform's export function.
Right to Complain PDPC
Lodge a complaint with the Personal Data Protection Commissioner of Malaysia if you believe your rights have been violated.
How to Exercise Your Rights
Submit a written request to our data protection contact at dpo@getzenta.com.my. We acknowledge within 3 business days and aim to respond substantively within 21 days. We may verify your identity before processing access or correction requests to protect your data from unauthorised access.
ℹ️
These rights apply to your own personal data held by Zenta Technologies. If you are an Auditor or SME managing your clients' data, those obligations are governed by your role as Data User.
Section 10
Cookies & Analytics
GetZenta's web presence at getzenta.com.my uses cookies and similar technologies where needed for the site and platform to function. We do not use cookies for advertising targeting or cross-site tracking.
Essential Cookies
Required for the platform to function. Cannot be disabled without breaking core features:
Session cookies — maintain your authenticated session within the platform
Security cookies — support CSRF protection and platform security mechanisms
Preference cookies — remember your display preferences within the interface
Analytics
We may use privacy-respecting analytics tools to understand aggregate usage patterns — which features are most used and where users encounter friction. Where analytics are deployed, tools are configured to anonymise IP addresses and are not connected to advertising networks. You may opt out via your browser settings or a tracking-blocker extension.
No Advertising Cookies
GetZenta does not use advertising cookies, remarketing pixels, or third-party tracking for commercial targeting. We do not sell advertising space on the platform or on getzenta.com.my.
In the event of a suspected or confirmed personal data breach, Zenta Technologies follows a structured notification process designed to protect affected individuals and support obligations under PDPA 2010, as amended.
Our 24-Hour Internal Commitment
In the event of a suspected breach affecting your organisation's data, Zenta Technologies will notify the affected User(s) within twenty-four (24) hours of internal confirmation. This is intended to help you, as the Data User, assess and meet your own notification obligations, including any notification to the Commissioner within the period required by law.
What a Breach Notification Will Include
Nature of the breach and categories of data affected
Approximate number of records or individuals affected, where known
Likely consequences of the breach
Measures taken or proposed to address the breach
Contact details of our data protection contact for further enquiries
Scope of This Commitment
This commitment covers the GetZenta platform and data under our control as Data Processor. It does not extend to breaches originating from:
The User's own hardware, devices, or local network
Compromised login credentials caused by the User's own security practices
Unencrypted transmission of data by the User outside of the platform
Third-party services accessed independently by the User
🔐
If you suspect unauthorised access to your account: Change your password immediately, revoke active sessions, and contact dpo@getzenta.com.my or hello@getzenta.com.my.
Section 12
Data Protection Contact
Zenta Technologies Sdn. Bhd. maintains a data protection contact to oversee data governance, handle access and correction requests, and serve as the primary point of contact for PDPA-related matters.
📞Privacy and security matters are handled through verified email channels only
📍Kuala Lumpur, Malaysia
⏱Acknowledgement within 3 business days · Substantive response within 21 days
Responsibilities
Handling data access and correction requests
Managing consent withdrawal requests under Section 38
Coordinating breach notification and incident response
Liaising with the Personal Data Protection Commissioner of Malaysia
Overseeing sub-processor review and Data Processing Agreements
Filing a Complaint with the PDPC
If you are dissatisfied with our response to a data-related concern, you have the right to file a complaint directly with the Personal Data Protection Commissioner of Malaysia:
This Privacy Policy reflects GetZenta's data governance practices as of the last-updated date above. It is product information and does not represent certification or regulatory approval. It does not constitute legal advice. Zenta Technologies reserves the right to update this policy to reflect changes in law, technology, or business practice. Material changes will be communicated to registered Users via email or in-platform notice with a minimum of 14 days' prior notice.