Privacy notice

Effective date: 19 July 2026

Language

This notice is provided in English, Bahasa Melayu, and Simplified Chinese for accessibility. The English version controls if a translation conflicts with it.

Who is responsible for your personal data

You may contact the data controller at contact [at] boinkergy [dot] com.

Scope

This notice covers boinkergy.com, direct enquiries, and Workflow Study application information collected through app.boinkergy.com. Additional notices may be provided before an interview, recorded session, pilot, or product-access stage.

Personal data collected and its sources

The Workflow Study application collects personal data directly from the applicant: company name, contact name, work email, company MYeHALAL account ID, and phone number. These fields are mandatory. Without them, we cannot assess the application or conduct founder-led qualification and follow-up.

The application also automatically collects the applicant’s IP address and user agent for service security, abuse prevention, troubleshooting, and record integrity. If you contact us, we receive the information contained in your message and related correspondence.

The marketing site does not use analytics. The application may use a session cookie only to maintain an authenticated login session. We do not use advertising or behavioural-tracking cookies on the marketing site.

Please do not submit certificates, portal credentials, client lists, formulations, or other confidential or sensitive operational material through the public application form or ordinary email.

Purposes of processing

We process personal data to:

• receive and assess Workflow Study applications;
• use the company MYeHALAL account ID as a qualification reference;
• contact applicants and conduct founder-led qualification and follow-up;
• administer research participation and maintain necessary research records;
• respond to enquiries, correction requests, and privacy requests;
• secure, troubleshoot, and protect the website, application, and records;
• establish, exercise, or defend legal rights; and
• comply with applicable legal obligations.

The MYeHALAL account ID alone is not treated as proof of certification status, dual-scheme eligibility, certificate validity, official verification, affiliation, or integration. Personal data is not sold.

Research sessions, recordings, and publicity

Workflow Study interviews and prototype sessions are not recorded by default. If we propose to record a session, we will explain the recording and its intended use in advance and request the participant’s express agreement. A participant may decline recording without that decision being treated as consent to any other use.

Identifiable quotations, screenshots, case studies, or other participant material will not be published without separate express permission. Research findings and feedback may be used for internal research, product development, and anonymised or aggregated marketing, provided they are presented in a way reasonably designed not to identify the participant, its clients, or other individuals.

Disclosure and service providers

Personal data may be disclosed only as reasonably necessary to:

• hosting, infrastructure, email, backup, security, and technical-support providers;
• professional advisers where advice is required;
• public authorities, regulators, courts, or law-enforcement bodies where disclosure is required or permitted by law; and
• another recipient authorised by the individual or identified in a stage-specific notice.

The marketing website uses Namecheap shared-hosting services. The application and other service providers may process or make data accessible outside Malaysia. Where personal data is transferred outside Malaysia, we will take reasonable steps to use a transfer permitted by Malaysian law and to require protection appropriate to the data and circumstances.

Security

We use administrative and technical measures reasonably appropriate to the information and the size and stage of the project. These include limiting access to people and providers who need it, using encrypted connections where supported, maintaining access controls, and reviewing security-relevant records. No transmission or storage system can be guaranteed completely secure.

If a personal-data breach occurs, we will assess it and make notifications required by the Personal Data Protection Act 2010 and applicable regulatory requirements.

Retention

We retain personal data only for as long as reasonably necessary for the purposes stated in this notice, including follow-up, research administration, security, dispute handling, and legal obligations. Inactive or unsuccessful applications will be reviewed for deletion or anonymisation within 12 months after the application becomes inactive or unsuccessful. Information may be retained longer where required for legal obligations or a reasonably anticipated dispute. Residual copies in protected backups may remain until the applicable backup cycle expires and will not be restored for ordinary use.

There is no general future-study mailing list. We will not retain an unsuccessful applicant merely for unrelated future marketing unless the individual makes a separate request or gives a separate choice to do so.

Your choices and requests

Subject to applicable law, you may request access to or correction of your personal data, withdraw consent where processing depends on consent, object to direct marketing, or ask us to delete data that is no longer required. You may also ask how your information has been used or disclosed.

Send requests to contact [at] boinkergy [dot] com. Include only the information reasonably necessary to identify the relevant record and request. We may ask for proportionate identity verification and may retain a limited record of the request and our response. If a request cannot be fulfilled, we will explain the reason where required by law.

Changes to this notice

We may update this notice to reflect changes in the Workflow Study, providers, or legal requirements. The current version and effective date will be published on this page. Material new uses of previously collected personal data will be notified or presented for a new choice where required.