Privacy Notice

Effective date: 28 July 2026 Last updated: 28 July 2026 Applies to: aarorn.com and all associated services

1Who we are

This Privacy Notice is issued by AaroRn Technologies Sdn Bhd ("Aarorn", "we", "us", "our"), a company incorporated in Malaysia with its office at Suite 33-01-30, 203, Jalan Bukit Bintang, Bukit Bintang, 55100 Kuala Lumpur. For the purposes of the Personal Data Protection Act 2010 ("PDPA"), as amended by the Personal Data Protection (Amendment) Act 2024, Aarorn is the data controller of the personal data described in this notice. (The 2024 amendment renamed "data user" to "data controller"; the two terms mean the same thing.)

2Scope of this notice

This notice explains how we handle personal data collected through our website (aarorn.com), our enquiry and contact forms, our built-in AI assistant, email and telephone correspondence, and in the course of providing our products and services. It applies to prospective customers, customers, website visitors, job applicants and business contacts. Where we act as a data processor on behalf of a customer (for example, when hosting a sovereign AI deployment), the customer's own privacy notice governs that data and our handling is set out in the relevant services agreement.

3Personal data we collect

We collect only the personal data we need for the purposes below. Depending on how you interact with us, this may include:

• Identity & contact data — name, job title, company, email address and telephone number you provide via our contact form or by email/phone.
• Enquiry content — the subject and message of any enquiry you send us, and questions you type into our AI assistant.
• Recruitment data — where you apply for a role, your CV, work history and any information you choose to share.
• Technical data — IP address, browser type, device information and pages visited, collected automatically through standard server logs and cookies.

Providing personal data is voluntary. However, if you choose not to provide the data marked as required on a form, we may be unable to respond to your enquiry or provide the service you request.

4How and why we use your data

We process personal data on the following bases: with your consent; where processing is necessary for the performance of a contract with you; where we have a legitimate interest in running and promoting our business (balanced against your rights); and where we are under a legal obligation. Specifically, we use personal data to:

• respond to your enquiries and provide the information, quotes or services you request;
• operate, secure and improve our website and AI assistant;
• manage our relationship with you as a customer, supplier or business contact;
• assess job applications;
• send you service updates and, where you have consented, marketing communications (which you can opt out of at any time); and
• comply with our legal and regulatory obligations.

5Our AI assistant

6The seven PDPA principles

We handle personal data in accordance with the seven Personal Data Protection Principles under the PDPA:

• General Principle — we process personal data only with consent or another lawful basis.
• Notice & Choice Principle — we tell you what we collect and why, through notices like this one.
• Disclosure Principle — we disclose personal data only for the purposes stated here, or as permitted by law.
• Security Principle — we take practical steps to protect personal data (see section 11). Under the 2024 amendment, our data processors are also directly bound by this principle.
• Retention Principle — we keep personal data only as long as necessary (see section 10).
• Data Integrity Principle — we take reasonable steps to keep personal data accurate, complete and up to date.
• Access Principle — you may request access to, and correction of, your personal data (see section 12).

7Sensitive personal data

"Sensitive personal data" includes information about your physical or mental health, political opinions, religious beliefs, the commission of any offence, and — following the 2024 amendment — biometric data. We do not ordinarily collect sensitive personal data. Where we do, we will obtain your explicit consent first, unless the law otherwise permits.

8Disclosure to third parties

We do not sell your personal data. We may share it with:

• Service providers who process data on our behalf — for example, hosting, email, analytics and AI-inference providers — under contracts that require them to protect it and use it only on our instructions;
• Professional advisers such as auditors and lawyers, where necessary;
• Authorities and regulators, where required by law or to protect our legal rights.

9Cross-border transfers

As a sovereign-AI provider, our preference and default is to keep Malaysian data in Malaysia. Where personal data is transferred outside Malaysia (for example, to a service provider hosted abroad), we do so in line with the amended cross-border transfer rules — that is, where the receiving jurisdiction has laws substantially similar to the PDPA or ensures an adequate level of protection, or where another legal ground under the PDPA applies. We will take reasonable steps to ensure your data remains protected to a comparable standard.

10How long we keep your data

We do not collect personal data through this website unless you actively provide it to us — for example, by completing and submitting our contact form. Where you submit an enquiry through the contact form, we retain the information you provide as part of our records for audit-trail and accountability purposes. Any conversation you have with our AI assistant is not used to train artificial-intelligence models and is not retained for longer than 30 days, after which it is securely deleted or anonymised.

11Security & data breach notification

We take practical technical and organisational measures to protect personal data against loss, misuse, unauthorised access, disclosure or alteration — including access controls, encryption in transit, and keeping our own AI infrastructure under our control wherever possible.

In line with the 2024 amendment, if a personal-data breach occurs that causes or is likely to cause significant harm, we will notify the Personal Data Protection Commissioner as soon as practicable, and where required will also notify affected individuals without undue delay.

12Your rights

Subject to the PDPA, you have the following rights over your personal data:

Access	Request a copy of the personal data we hold about you.
Correction	Ask us to correct data that is inaccurate, incomplete or out of date.
Withdraw consent	Withdraw consent to processing at any time, where processing is based on consent.
Limit processing	Ask us to limit the processing of your personal data for a specified purpose, such as direct marketing.
Data portability	Where technically feasible, ask us to transmit your personal data to another data controller — a new right introduced by the 2024 amendment.

To exercise any of these rights, contact us using the details in section 16. We may need to verify your identity before acting on a request, and we will respond within the timeframe required by law.

13Cookies

Our website uses a small number of cookies and similar technologies: strictly necessary cookies that make the site work, and preference cookies that remember choices such as your language (English or Bahasa Malaysia). We use these to operate the site and understand, in aggregate, how it is used. You can control or delete cookies through your browser settings; disabling some cookies may affect how the site works.

14Children

Our website and services are intended for businesses and professionals and are not directed at children. We do not knowingly collect personal data from anyone under the age of 18 without appropriate consent.

15Changes to this notice

We may update this notice from time to time to reflect changes in our practices or the law. When we do, we will revise the "Last updated" date above and, where changes are significant, take reasonable steps to inform you.

16How to contact us

If you have any questions about this notice, wish to exercise your rights, or want to make a complaint about how we handle your personal data, please contact our Data Protection Officer:

If you are not satisfied with our response, you have the right to lodge a complaint with the Personal Data Protection Department Malaysia (Jabatan Perlindungan Data Peribadi, JPDP) at www.pdp.gov.my.