Privacy notice

1. Who is responsible

Nebula Systems Sdn. Bhd. (Registration No. 202001013844) is the data user for the personal data described here. Our registered address is Unit B-12-12, Prima Avenue, Jalan PJU 1/39, Dataran Prima, 47301 Petaling Jaya, Selangor, Malaysia.

For anything in this notice, including access and correction requests, write to privacy@nebulasystems.net. That address reaches the person responsible for data protection, not the sales queue.

2. What we collect

Through this website, only two things:

What you type into the enquiry form

Your name, company, and work email are required. Phone number, country, area of interest, service area, and your message are optional. We ask for a work email rather than a personal one on purpose: this is a business enquiry and we would rather not hold personal contact details.

Analytics about how pages are used

Pages viewed, how you arrived, approximate location derived from IP, and device and browser type. This is collected through Google Tag Manager and Google Analytics 4, and only after you accept cookies. See section 5.

We do not collect sensitive personal data through this website, and there is nothing here that asks for identification numbers, financial details, or credentials. If you send such details in the free-text message field, please do not — email us and we will arrange a proper channel.

3. Why we collect it

• To answer your enquiry, and to prepare a proposal or scoping call if that is where it leads.
• To administer the resulting engagement, where an enquiry becomes a customer relationship.
• To understand which pages and campaigns bring enquiries, so we spend marketing budget sensibly.
• To meet our own legal, tax, and regulatory record-keeping obligations.

We do not sell personal data, we do not share it with data brokers, and we do not use it to build advertising profiles of you as an individual.

4. Whether you have to provide it

Supplying the personal data in the enquiry form is voluntary. Without a name, company, and work email we cannot reply, so the practical consequence of not supplying it is that we cannot answer you. You can always call +603-7680 4198 instead.

5. Cookies and analytics

Nothing that tracks you runs until you choose. Analytics and advertising storage are denied by default; the banner asks, and Google Consent Mode holds the tags until you answer. Declining costs you nothing — every page works identically either way.

Strictly necessary

One local storage entry, neb-consent, remembering your cookie choice so we stop asking. No cookie is set for this and it is not sent to us.

Analytics and advertising, only with consent

Google Tag Manager and Google Analytics 4 cookies, used to measure page views and which enquiries came from which campaign. Google acts as our data processor for this and may process the data outside Malaysia.

You can change your mind at any time by clearing cookies and site data for this domain in your browser.

6. Who else sees it

Only the parties we need to run the service, each under contract and each permitted to process the data solely on our instructions:

Cloudflare

Hosting and delivery of this website, and the function that processes the enquiry form.

Resend

Transactional email delivery, used to send your enquiry to our engineering desk.

Google

Tag Manager and Analytics 4, only where you have accepted analytics cookies.

We may also disclose personal data where the law requires it, where a regulator with jurisdiction over us compels it, or where it is necessary to establish or defend a legal claim.

7. Where it is stored, and transfers out of Malaysia

Customer workloads and backups under a signed contract stay in Malaysian data centres, as described on our service pages. That is a contractual commitment and it is not affected by this notice.

Website enquiry and analytics data is different, and we would rather be plain about it than imply otherwise: the processors in section 6 operate global infrastructure, so that data may be processed outside Malaysia. Where it is, we rely on the processor's contractual data protection terms and, where applicable, standard contractual clauses. If you would prefer your enquiry never leave the country, call us instead of using the form.

8. How long we keep it

Enquiries that do not become an engagement

Up to 24 months from our last contact with you, then deleted.

Enquiries that become a customer relationship

For the duration of the relationship, and then seven years after it ends, to satisfy Malaysian statutory record-keeping and to be able to answer questions about work we did.

Analytics data

Retained on Google's standard Analytics 4 retention period, which we set to 14 months.

9. Your rights

Under the PDPA you may ask us to:

• give you access to the personal data we hold about you;
• correct it where it is inaccurate, incomplete, or out of date;
• stop or limit processing, including withdrawing a consent you previously gave;
• stop using your details for marketing, which we will action immediately and without asking why;
• provide your data in a portable form, or transmit it to another data user where that is technically feasible.

Write to privacy@nebulasystems.net. We will acknowledge within five business days and respond substantively within the period the PDPA allows. We may need to verify who you are first, which protects you rather than us. A prescribed fee may apply to a formal data access request; we will tell you before charging anything.

If you are not satisfied with how we have handled a request, you may complain to the Personal Data Protection Department (JPDP) of Malaysia.

10. Security, and what happens if it goes wrong

Enquiry data is transmitted over TLS and reaches a mailbox restricted to the people who need it. Access is limited to staff who require it for the purpose in section 3.

If a personal data breach occurs that is likely to cause significant harm, we will notify the Commissioner, and affected individuals, as the 2024 amendments require. We will tell you what happened and what we are doing about it, in plain terms.

11. Changes to this notice

We will update the effective date above whenever this notice changes. Where a change materially affects how we use data you have already given us, we will say so rather than relying on you noticing a new date.

12. Language

This notice is published in English. A Bahasa Malaysia version is required under the PDPA and will be available from the BM toggle in the navigation. Where the two versions differ, the Bahasa Malaysia version prevails.

13. Contact

privacy@nebulasystems.net for anything about personal data. sales@nebulasystems.net or +603-7680 4198 for everything else.