Privacy Policy

Last updated: 27 June 2026

Introduction

EngageXS ("EngageXS", "we", "us" or "our") provides a multi-tenant, business-to-business software-as-a-service platform that helps companies manage their sales, inventory and finance operations. This Privacy Policy explains how we collect, use, share and protect personal data when you visit our website, create an account or use our services.

We serve customers in Malaysia and internationally. This policy applies to the EngageXS website and application. It does not cover third-party websites or services that we may link to. This document is provided for general information and is not legal advice.

Information we collect

We collect the following categories of information:

Account information — your name, work email address, password, role, company name and contact details that you provide when you register or manage your account.
Company and tenant data — the business records you and your team enter into the platform, such as customers, contacts, leads, quotes, orders, invoices, products, inventory and accounting entries. This data belongs to your organisation, and we process it on your behalf.
Usage and log data — technical information generated when you use the service, including IP address, browser and device type, pages viewed, actions taken, timestamps and diagnostic logs.
Cookies and similar technologies — we use cookies and local storage to keep you signed in, remember preferences such as language and theme, and understand how the service is used.

How we use your information

We use the information we collect to:

provide, operate and maintain the service;
improve, develop and personalise features and performance;
process billing, subscriptions and payments;
respond to support requests and communicate with you about your account;
monitor for security, prevent fraud and ensure platform integrity;
comply with legal and regulatory obligations.

Legal bases for processing

Where applicable law requires a legal basis for processing personal data, we rely on one or more of the following:

Consent — where you have given us clear permission to process your data for a specific purpose.
Contract — where processing is necessary to provide the service you have requested under our terms.
Legitimate interests — where processing is needed to run, secure and improve our business, balanced against your rights and interests.

Sharing and sub-processors

We do not sell your personal data. We share information only with trusted service providers who help us deliver the service, and only as needed for them to perform their functions. These sub-processors include:

cloud hosting and infrastructure providers;
email and notification delivery providers;
payment and billing providers.

Each sub-processor is bound by appropriate confidentiality and data-protection obligations. We may also disclose information where required by law or to protect our rights, users or the public.

Data retention

We retain your account and company data for as long as your account remains active and for a reasonable retention window thereafter, to meet legal, accounting and operational requirements. You can configure purge settings within the platform, and you may request deletion of your data subject to applicable legal retention obligations.

Security

We take the protection of your data seriously and apply technical and organisational measures designed to safeguard it, including:

encryption of data in transit;
role-based access controls and least-privilege principles;
logical tenant isolation so each organisation's data is kept separate;
audit logs to record key actions and access.

No method of transmission or storage is completely secure, but we work continuously to protect your information and review our practices.

Your rights

Depending on where you are located, you may have rights over your personal data, including the right to:

access the personal data we hold about you;
request correction of inaccurate or incomplete data;
request deletion of your data;
export or receive a copy of your data in a portable format;
object to or restrict certain processing.

These rights reflect protections under the Personal Data Protection Act 2010 (PDPA) in Malaysia and the General Data Protection Regulation (GDPR) in the European Union, among other laws. To exercise any of these rights, please contact us using the details below.

International transfers

As a global platform, we may process and store data in countries other than the one in which you are located. Where we transfer personal data across borders, we take steps to ensure it remains protected and that transfers comply with applicable data-protection laws, including the use of appropriate safeguards.

Children

EngageXS is a business tool intended for use by organisations and their staff. It is not directed at children and is not intended for anyone under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can remove it.

Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology or legal requirements. When we make material changes, we will update the date at the top of this page and, where appropriate, notify you through the service. We encourage you to review this policy periodically.

Contact

If you have any questions about this Privacy Policy or how we handle your data, please contact us at privacy@engagexs.com.