Privacy Notice

1. Introduction

This Privacy Notice outlines how PalmWav™, a platform owned by OpenSys Technologies Sdn. Bhd. (Company Registration No. 200601023409 (743163-T)) (referred to as “OST”, “we”, “our” or “us”), collect, use and protect your personal data specifically for the PalmWav™ Proof-of-Concept (“POC”) Project (“PalmWav™ POC”), which will run for a period of 3 months.

For the purposes of this Privacy Notice, “Processing” means any operation performed on personal data, including collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, erasure or destruction.

All Processing is conducted in accordance with the Malaysian Personal Data Protection Act 2010 and the Personal Data Protection (Amendment) Act 2024 (collectively, the “PDPA”), and other applicable Malaysian laws.

By participating in the PalmWav™ POC, you acknowledge and consent to the Processing of your personal data as described herein. OST is committed to ensuring transparency and safeguarding your privacy throughout the limited duration of this trial.

2. Scope

The PalmWav™ POC is conducted solely for evaluation and testing purposes. The objectives include:

• Authentication system;
• Obtaining user feedback to improve system usability and reliability; and
• Evaluating potential operational deployment feasibility.

Your participation is voluntary, and your Personal Data will be used only for the PalmWav™ POC evaluation.

3. Category of Personal Data Processed

We collect the following information for registration, identity verification and system testing during the PalmWav™ POC:

• Basic and Contact Information: Name, NRIC, gender, email address and contact number.
• Biometric Data: Palm vector (classified as ‘Sensitive Personal Data’ under the PDPA).
• Authentication Logs: Timestamps and transaction IDs generated during biometric testing.

Note: If you do not provide this mandatory Personal Data, we may not be able to include you in the PalmWav™ POC.

4. Methods of Data Collection

Your Personal Data is collected:

• Directly from you during registration or testing sessions.
• From biometric scanning devices used during PalmWav™ POC activities; and
• Through voluntary feedback forms, surveys or communications with OST representatives.

5. Purpose of Processing

We use the Personal Data collected during the PalmWav™ POC for the following purposes:

• To verify participant identity and ensure secure access;
• To test and validate PalmWav™’s biometric recognition technology;
• To analyse technical performance and system reliability;
• To collect your feedback for service improvement;
• To comply with the PDPA and security standards.

Your Personal Data will not be used for marketing, profiling or any unrelated commercial purposes during or after the PalmWav™ POC.

6. Personal Data Disclosure and Access

Your Personal Data will be kept confidential and accessed only by:

• Authorised OST employees and technical staff involved in the PalmWav™ POC;
• Third-party service providers supporting biometric device integration or secure Personal Data storage, who are legally bound to keep it confidential; and
• Regulatory or law enforcement authorities if required by law.

We will not sell, rent or share your Personal Data to any other third parties for commercial gain.

7. Consent and Withdrawal

By participating in the PalmWav™ POC and providing your Personal Data, you give consent for it to be Processed as described herein, including the Sensitive Personal Data (biometric data).

You may withdraw your consent at any time by contacting us (see Section 12). If you withdraw your consent, we will stop your participation and delete your Personal Data in the manner described in Section 9.

 

8. Data Accuracy

You are responsible for ensuring that all Personal Data you provide is accurate and up to date.

9. Data Security, Retention and Deletion

OST implements appropriate technical, organisational and physical safeguards to protect Personal Data from unauthorised access, modification, disclosure or loss.

All Personal Data will be kept for the duration of the PalmWav™ POC period.

Thereafter, all identifiable Personal Data will be securely deleted or anonymised

10. Your Rights

You may request access to, correction of or deletion of your Personal Data at any time during the PalmWav™ POC by contacting us (see Section 12). We will respond within 3 working days in accordance with the PDPA.

11. Personal Data Breach Management

If there is any actual or suspected Personal Data breach involving your Personal Data, we shall take all reasonable and appropriate measures in accordance with the PDPA and applicable internal policies.

If a breach occurs, OST will:

• Assess the situation to understand its scope and impact;
• Implement necessary remedial actions to mitigate any potential risk or harm;
• Where applicable, notify the Personal Data Protection Commissioner (“Commissioner”) no later than 72 hours after becoming aware of the breach; and
• Notify you without delay if the breach is likely to result in significant harm to your rights or interests, (within 7 days after notification to the Commissioner), providing sufficient details, including:
  • The category of the Personal Data affected;
  • The likely consequences of the breach; and
  • The measures taken or proposed to be taken to address and mitigate the impact of the breach.

We keep records of all Personal Data breaches for at least two (2) years and continuously improve our safeguards to prevent similar incidents.

12. Contact Us

If you have questions about this Privacy Notice or wish to exercise your rights, please contact us at: ops-support@palmwav.my

Last Updated: November 13, 2025