Commitment to PDPA Compliance & Data Protection Standards
MACSBIT SOLUTIONS designs and operates MACSBIT eKYC in strict adherence to the Personal Data Protection Act 2010 (PDPA) of Malaysia, incorporating the seven core PDPA data protection principles into our technical architecture and data handling workflows.
We serve as a specialized technology infrastructure provider and Data Processor to our business clients. While client organisations maintain statutory responsibility for their own onboarding decisions, our systems implement enterprise-grade technical safeguards, automated retention controls, and audit trails adhering to Malaysian data protection and verification benchmarks.
Who we are and our role
MACSBIT eKYC is a software service operated by MACSBIT SOLUTIONS (Company No. 202003277735 (NS0242924-K)). Businesses use it to verify the identity of their customers over WhatsApp and to manage WhatsApp conversations. We act in two different roles:
- Business customers and their staff (people who register for a dashboard account): we decide how this account data is used, so we are the data user for it.
- End customers being verified (people who open a verification link sent by a business): the business that requested the verification decides why and how your data is used. We process your data on that business's behalf, as its data processor. If you have questions about why a business asked you to verify, contact that business first.
What data we collect
Dashboard account data (business customers and staff)
- Name, email address, company name and role.
- Password, stored only as a salted bcrypt hash — we cannot read it.
- Subscription plan, usage counts and billing status. Payments are completed with our payment processor; we do not ask for or store full card numbers.
- Credentials a business chooses to connect, such as its Meta (WhatsApp) access token and AI API keys. These are encrypted at rest using AES-256-GCM.
WhatsApp conversation data
- Phone numbers, WhatsApp profile names, message content and timestamps for conversations handled through a business's connected WhatsApp Business number.
- Contact labels a business adds, such as a company name or role.
Identity verification data (end customers)
- Photographs of the identity document you submit (MyKad, MyPR, driving licence or passport) — front and, where applicable, back.
- A live selfie.
- Details read from the document: full name, ID or passport number, date of birth, gender, address, nationality, and for driving licences the licence number, vehicle classes and validity period.
- The verification outcome (verified or rejected), a face-match score, a liveness result, the reason for any rejection, the date and time, and a session reference.
Images and extracted details are stored for both successful and unsuccessful attempts. The document and selfie are biometric-related and sensitive; we handle them as such.
How a verification works
- A business sends you a one-time link on WhatsApp. The link's session is single-use and expires after 15 minutes.
- Your browser asks for camera access. You photograph your document and take a selfie. A short liveness challenge (for example a blink or smile) is checked on your own device by a face-landmark model that runs in your browser. The model files are served from our own site.
- The captured photos are processed by our automated document OCR and face-comparison engine to read the document text and evaluate whether the selfie matches the identity document and satisfies liveness verification.
- We apply simple rules to that assessment (for example a minimum face-similarity score) and record the result. We then send you a confirmation message on WhatsApp through the Meta WhatsApp Cloud API and show the result in the business's dashboard.
AI Verification & Human Oversight
Document OCR, face matching, and liveness assessments are powered by advanced machine learning models to assist business decision-making. In accordance with eKYC best practices, deploying businesses maintain complete administrative control with human-in-the-loop review capabilities to evaluate any verification edge cases or customer appeals.
Why we use data
- To provide the service: delivering verification links, running the verification, showing results to the requesting business, and operating the WhatsApp inbox.
- To operate dashboard accounts, authenticate users, manage subscriptions and take payment.
- To keep the service secure, prevent abuse and fix faults.
- To meet our legal obligations, such as keeping financial records.
We do not sell personal data, we do not use it for advertising or profiling, and we do not use identity images to train AI models.
The verification page does not currently show its own consent screen. The business that sends you a verification link is responsible for telling you why it is collecting your identity data and for having a lawful basis to do so.
How long we keep data
- Identity verification data (images and extracted details): a nightly job replaces this data on a contact record with a deletion marker once the last message activity with that contact is more than 90 days old. Because the countdown follows message activity, an ongoing conversation delays deletion. The period is fixed today and is not yet configurable per business.
- WhatsApp messages: an hourly job deletes messages older than 90 days.
- Dashboard account data: kept while the account is active and deleted on request or when the account is closed.
- Billing and invoice records: kept for as long as Malaysian law requires, commonly up to seven years.
Copies may remain for a limited time in infrastructure-level snapshots or backups, if any, until they rotate out. To ask for earlier deletion, see our data deletion page.
Security & Technical Safeguards
We maintain comprehensive technical and organizational safeguards designed to protect personal data against unauthorized access, loss, alteration, or disclosure in accordance with the Security Principle of the PDPA:
- Encryption in transit: All data exchanged between users, WhatsApp webhooks, and our servers is strictly transmitted over secure TLS/HTTPS channels.
- Credential encryption at rest: Connected third-party API credentials (Meta access tokens and AI API keys) are encrypted at rest using industry-standard AES-256-GCM.
- Cryptographic authentication: Dashboard credentials are protected using salted bcrypt password hashing, and active sessions are managed using signed, tamper-resistant tokens.
- Ephemeral verification sessions: End-user verification links use single-use cryptographic tokens with automated expiry (15 minutes) to prevent unauthorized reuse.
- Privacy-centric liveness analysis: Real-time liveness checks execute directly in the applicant’s local browser sandbox, avoiding unnecessary biometric video streaming.
- Logical tenant isolation: Strict multi-tenant data boundaries ensure each business can only access its own authorized records, preventing cross-tenant data leakage.
- Automated data lifecycle management: Rigorous scheduled purging routines automatically expunge conversation records and verification data after 90 days in strict compliance with the PDPA Storage Limitation principle.
We continually review, monitor, and upgrade our infrastructure to adhere to modern security practices and evolving regulatory standards.
Your rights
Under the PDPA you may ask to:
- access the personal data we hold about you,
- correct data that is inaccurate,
- withdraw consent, and
- limit or stop processing, or ask for deletion, subject to legal retention requirements.
Email billing@macsbit.com. We aim to respond to access requests within 21 days. If you were verified for a business, that business decides how your data is used, so we may refer your request to it or act on its instructions. If you are unhappy with our response you may complain to the Personal Data Protection Commissioner of Malaysia.
Children
The service is meant for businesses and for adults presenting their own identity documents. It is not directed at children under 18.
Changes to this policy
We will update this page when the service or our practices change and will change the "last updated" date above. Material changes will be notified to business account holders by email or in the dashboard.
Contact
MACSBIT SOLUTIONS (Company No. 202003277735 (NS0242924-K))
Email: billing@macsbit.com