Privacy Policy | E-NameCard

This Privacy Policy explains how LCP Buildsoft Technology Sdn Bhd ("we", "us", "our") collects, uses, discloses and protects personal data through E-NameCard — our digital name card platform, comprising this website, the E-NameCard mobile application, and the name cards, QR codes and NFC cards issued through it. It applies whenever you register an account, create or share a name card, belong to an organisation that subscribes to E-NameCard, or simply open someone's name card.

It is issued pursuant to the Malaysian Personal Data Protection Act 2010 ("PDPA"), as amended, and should be read together with our Terms of Service, which govern your use of the platform.

What E-NameCard Does

E-NameCard lets a member build a digital name card in place of a paper one: their contact details, company details, professional and education background, and social media links, presented on a page they can share by link or QR code, or through a physical NFC card. Members can send each other business card exchange requests, and organisations can subscribe so that their people receive name cards under the organisation's account. This is why we hold the data described below — the platform cannot present a name card without it.

Who We Are, And How To Contact Us

The data controller responsible for your personal data is:

LCP Buildsoft Technology Sdn Bhd
Company registration no.: [registration number]
Registered address: [registered address]
Email: [data protection / support email address]
Telephone: [telephone number]

Questions about this policy, or any request to exercise the rights set out below, may be directed to those contact details.

Personal Data We Collect

We collect personal data in three ways: what you enter yourself, what your organisation or an administrator enters about you, and what the platform records automatically as you use it.

Account and sign-in data — your email address, username, password (stored only as a cryptographic hash, never in readable form), account type and status, whether your email has been verified, your last access time, and the access tokens issued to the mobile application.
Profile and identity data — your name (including preferred, Chinese or other language names), title, gender, race, nationality, the state or country you are in, your telephone number and its country code, postal address, date of birth, a profile photograph, a personal introduction, and the periods for which your membership is valid. If you register as an individual member we may also hold your identity card or passport number for verification.
Company and business data — company name, year established, business category and nature, company address, telephone, fax and email, your designation, a description of the company, its expansion plans or expectations, and the company's social media accounts.
Professional, education and membership data — your education history, working experience, positions held in societies or associations, and certificates, including any certificate files you upload.
Social media and links — the platforms you connect, your username or handle there, the URL, and the QR code generated for it.
Organisation data — the organisation your account belongs to, and your role within its E-NameCard subscription.
Subscription, payment and billing data — the package or subscription you hold, its validity period, and for each transaction the amount, currency, status, payment method, a payment reference, the response returned to us by the payment gateway, and receipts issued to you.
Verification data — one-time codes we send to your email address or mobile number to confirm that they belong to you, together with whether the verification succeeded.
Notification and device data — the push notification subscription identifier for your device and basic information about it, and your preferences for receiving notifications.
Files you upload — images and documents you add to your card (photograph, certificates and similar), together with their storage details, file type and size.
Technical, usage and security records — your IP address, browser and device information, sign-in and access logs, and an audit record of changes made to platform records (which records what was changed, when, and by which account).
Name card view records — when someone opens a name card, we record the card that was viewed, the time, and the viewer's IP address. This is what allows a member to see how often their card has been viewed, and it is described further below.

Your Name Card Is Published Publicly — Please Read This Section

A name card only works if it can be opened, so the page your name card generates is reachable by anyone who has its link, without signing in. There is no password on it and no way for us to limit who opens a link that has been shared. Anything you place on your card — your name, photograph, telephone number, email address, company details, social media links, introduction, and your education and working experience — may therefore be seen, copied and forwarded by anyone who has the link.

Because of that, please treat the contents of your card as public, and do not enter anything there that you are not willing to have seen by strangers. The identity card or passport number and date of birth we hold for verification, and any postal address recorded for administration, are not displayed on the public page; they are used for verification and account administration only. If your organisation administers your card, remember that your organisation's administrators can see and edit the same details you can.

How We Use Your Personal Data

We use the data above to:

create and administer your account, and authenticate you when you sign in;
build, host and publish your digital name card, generate its QR code and contact file, and let you share it;
enable name card exchange between members, and the notifications that go with it;
verify your email address and telephone number, and verify the identity or company details of members and organisations where we need to;
process subscriptions and payments, and issue invoices and receipts;
administer organisation subscriptions, including the member accounts within them;
operate, secure and troubleshoot the platform, prevent misuse, and keep an audit trail of changes;
provide support and respond to your enquiries;
send you service messages — verification codes, receipts, and notices about your subscription expiring or having expired — which are part of the service and are not promotional; and
send you information about E-NameCard features, offers or events, or ask you for feedback, where you have agreed to receive it.

Where the PDPA requires a basis for processing, we rely on your consent for the promotional messages described above and for publishing your card, on the performance of our contract with you for the operation of your account and subscriptions, and on our legitimate interests in securing the platform and preventing misuse for the security and audit records.

Disclosure To Others

We do not sell your personal data, and we do not trade it. We disclose it only as needed to run the platform:

Payment gateway. Subscription payments are processed by Billplz. Billplz receives the amount, the reference for the bill, and the information needed to complete the payment; we receive the outcome back from it. Your card details are entered with the gateway and are not received or stored by us.
Push notification service. We use OneSignal to deliver notifications to the mobile application, which receives the device's notification identifier and the content of the notification.
Email and messaging providers. Our email and messaging providers carry the messages we send you, including verification codes, receipts and service notices.
Hosting and storage providers. The platform, its database and the files you upload are held on servers and storage operated by our hosting providers.
Your organisation. If your account belongs to an organisation's subscription, its administrators can see and manage the member accounts within it.
Authorities. We may disclose data where we are required to by law, by a court, or by a regulator, or where it is necessary to investigate misuse of the platform.
Content delivery networks. Our public pages load certain fonts and front-end libraries directly from third-party content delivery networks. When your browser fetches those files, it contacts those providers, which will see your IP address.

Some of these providers process data outside Malaysia. Where personal data is transferred out of Malaysia, we do so in accordance with the PDPA's requirements for such transfers.

Cookies And Sessions

Signing in to the platform uses a session cookie, which keeps you signed in as you move between pages, together with a security token that protects forms against cross-site request forgery. We do not use the public name card pages for advertising or cross-site tracking. If you block cookies, you will be able to open name cards but will not be able to sign in.

Security

We take the security of personal data seriously. Passwords are stored only as hashes; access to the administration of the platform is restricted to authorised accounts, is role-based, and is session controlled; changes to platform records are logged in an audit trail; and — deliberately — passwords and API tokens are excluded from that audit trail, so they are never written into it. To prevent unauthorised access or disclosure we maintain reasonable physical, electronic and procedural safeguards.

The Internet, being an open environment, means we cannot guarantee that data will never be accessed, copied, disclosed, altered or otherwise interfered with by a party acting unlawfully. You should also take care of your own credentials: do not reuse your password elsewhere and do not share it.

How Long We Keep It

We keep your account and card data for as long as your account is active and your card remains published. When you delete your name card or account, we remove the published card, and the personal data it held, from the platform. Two kinds of record outlive that: payment and billing records, which we are required to keep for the period set by Malaysian tax and accounting law (currently seven years), and the audit and security logs, which we keep for as long as needed to investigate misuse and to demonstrate compliance. Where data is no longer needed we delete it or render it anonymous.

Your Rights Under The PDPA

Subject to the PDPA, you have the right to:

access the personal data we hold about you, and be told how it has been used and to whom it has been disclosed;
correct data that is inaccurate, incomplete, misleading or out of date — and much of it you can correct yourself by editing your profile;
withdraw your consent to processing that relies on consent, including the promotional messages described above and the publication of your card, at any time;
limit the processing of your data, where the PDPA allows it; and
request the transfer of the personal data you have provided to us to another controller, where the PDPA provides for it.

To exercise any of these rights, contact us using the details above. We may ask you to verify your identity first, so that we do not disclose data to the wrong person. If you believe we have not handled your data properly, you may lodge a complaint with the Personal Data Protection Commissioner of Malaysia. Withdrawing consent to the publication of your card, or asking us to delete your account, will mean the card can no longer be used — we will tell you if a request cannot be carried out, and why.

Children

E-NameCard is a professional networking platform and is not intended for children. We do not knowingly collect the personal data of anyone under 18. If you believe a child has provided us with personal data, please contact us and we will delete it.

Changes To This Policy

From time to time we may change this Privacy Policy. We encourage you to review it periodically to remain informed about how we process and protect your personal data. Where a change is significant we will draw it to your attention through the platform, and your continued use of E-NameCard after a change takes effect constitutes acceptance of the processing described in the policy as amended.

E-NameCard's PRIVACY POLICY