Privacy notice: Malaysia

1. Who this covers

People in Malaysia whose personal data a Malaysian business processes through the service in a commercial transaction, and account holders in Malaysia.

The law: Personal Data Protection Act 2010 (Act 709), reprint 2026; Personal Data Protection (Amendment) Act 2024 (Act A1727).

2. Who is responsible

• For the people a business calls or chats with, that business (the workspace) decides why and how the data is used. We process it on its instructions, under our Data Processing Agreement. Under the Act the workspace is the data controller and we are its data processor. Since 1 April 2025 the Security Principle binds data processors directly. (s. 9)
• For the accounts of people who sign up with us, we are the data controller.

3. Why we may use the data

• Account data is processed to run the service, bill for it, keep accounts secure and answer requests. Our privacy notice tells you what we collect, why, where it comes from, who it goes to, and how to reach us. (s. 7, Notice and Choice Principle)
• People a workspace contacts: the workspace must give its own notice and have the consent the Act requires.
• Every call an agent makes or answers opens with a spoken statement that it is an automated AI assistant, and that the call may be recorded if recording is on. No workspace setting removes it.
• We do not sell personal data, use it for advertising, or train models on calls or chats.

4. Your rights

• Access to your personal data, answered within 21 days. (ss. 30, 31)
• Correction. (s. 34)
• To withdraw consent. (s. 38)
• To stop processing likely to cause you damage or distress. (s. 42)
• To stop direct marketing. Saying so on a call, replying STOP on WhatsApp or using the opt-out link puts your number on that business's do-not-call list. (s. 43)
• Since 1 June 2025, to have your data sent to another controller where that is technically feasible. (s. 43A)

If a business called or messaged you through Dialora AI, ask that business first: it decides what happens to your data, and the workspace has the tools to find, export and erase it. If you do not know which business it was, write to privacy@aicall.vitrano.in with the number that contacted you and the date, and we will pass your request on. If you hold an account with us, write to the same address.

5. Data leaving your country

• Our servers are in Ahmedabad, India, so using the service moves data to India. Services a workspace connects with its own account, such as Twilio, Deepgram, ElevenLabs or a hosted AI model, are mostly in the United States.
• Since 1 April 2025 a data controller may transfer personal data out of Malaysia where the destination has a law substantially similar to the Act or protection at least equivalent to it, or where one of the exceptions in the Act applies, such as consent or the performance of a contract. (s. 129)

Where each service is: sub-processor list. Terms for businesses: Data Processing Agreement.

6. If there is a breach

• We tell the workspace without undue delay after we become aware of a breach of its data.
• The data controller tells the Commissioner as soon as practicable, and the people affected where the breach is likely to cause significant harm. The Commissioner's circular asks for notice within 72 hours and to the people affected within 7 days after that. (s. 12B; Commissioner's circular)

7. Complaints

• Write to us, or to the business that contacted you, first. You can also complain to the Personal Data Protection Commissioner. (Commissioner)

8. Still open