Last updated: November 14, 2026
Effective date: 14 November 2026
This Privacy Policy describes how Noopy Enterprise (“we”, “us”, the “Company”) collects, uses and protects personal data when you use Email Managed Services (“EMS”, the “Service”), the website at this address, and the customer portals accessed through it. It is prepared to align with the Personal Data Protection Act 2010 as amended by the Personal Data Protection (Amendment) Act 2024 (“PDPA”).
Please read this Policy carefully. It is a sample document prepared for this site and should be reviewed and executed with qualified Malaysian counsel before commercial use. Nothing in this document is legal advice.
1.1. The Company provides EMS, a managed email-threat protection service built on the MailScan engine. Our registered details are available on our Terms of Service (Section 15: Contact).
1.2. Hosting customers (Model 2): where we process email content and mailbox data for your domain inside our Malaysian data centre, we act as a data processor on your instruction, and our data-processing agreement with you governs that processing. This Policy governs our processing as a data controller — our own account holders, prospects and website visitors.
1.3. On-premise customers (Model 1): email content remains in your environment. This Policy governs the account data and operational records we hold about you, and the limited metadata described in Section 3.2.
Depending on your interaction with us, we collect:
3.1. Hosted (Model 2) customers. Mail routed to your domain is processed in the Company’s Malaysian data centre. Quarantined mail and other retained data under a data-processing agreement. Email content does not undergo cross-border transfer outside Malaysia. This is by design, so that cross-border transfer obligations under section 129 of the PDPA are not engaged by our hosting of your data.
3.2. On-premise (Model 1) customers. Email content never leaves your environment. Where attachments are checked against reputation services, only SHA-256 fingerprints of attachments are transmitted — not the messages or their content.
3.3. Quarantine and Junk retention. Malicious mail is placed in Quarantine and suspected spam is delivered to Junk. Mail held in Quarantine is retained for the retention period shown in the Service and is then deleted. Mail is never silently deleted; every automated action is logged, reversible and auditable.
We process personal data for:
| Purpose | Basis (PDPA) |
|---|---|
| Providing the Service: accounts, workspaces, sign-in, sessions, billing and product access | Performance of a contract with you / consent at sign-up |
| Security: protecting accounts and detecting, preventing and reporting abuse | Legitimate interests of the controller (s.6(2) PDPA) |
| Producing audit history and evidence trails (who, what, verdict, action, timestamp) that support your PDPA breach notification obligations | Legitimate interests, as instructed by the customer |
| Sending transactional email (verification, reset links, invitations) and service notices | Performance of a contract |
| Responding to queries you send us | Performance of a contract / consent |
| Marketing communications to subscribers, where permitted | Consent; you may withdraw consent at any time |
You cannot lawfully prevent some processing (for example, security logging) because it is required to provide the Service.
We share personal data only as needed to operate the Service:
We do not sell or rent personal data, and we do not share it with advertisers.
6.1. Model 2: hosted data is processed in Malaysia; email content and account data are not transferred outside Malaysia.
6.2. Model 1: email content is never transferred outside your environment; only attachment fingerprints (not containing personal mailbox identifiers beyond those needed to evaluate the file) are sent to reputation services.
6.3. Where any other processing by us would involve a cross-border transfer of personal data (for example, a supplier system hosted abroad), it takes place only where permitted by the PDPA — including transfers reasonably necessary for a contract with the data subject, or to another jurisdiction whose jurisdictional equivalence is recognised, as notified to you — and consistent with section 129 of the PDPA as amended.
7.1. The Company applies technical and organisational measures appropriate to the risk, including: seventy-five (75) antivirus engines for attachments (signature, heuristic and cloud lookup); self-learning Bayesian spam/phishing classifiers with neural-network weight optimisation; per-customer allow and block lists with pooled global blacklists for hosted customers; reversible, logged and audited neutralisation of threats; security headers, CSRF protection and session expiry on this website; revocable database-backed sessions; and structured audit logging of administrative actions.
7.2. Threat alerts are targeted for delivery to your configured group within five (5) minutes of detection, so that protective action can be taken promptly.
8.1. Under the PDPA as amended, in the event of a data breach that is likely to cause significant harm to affected data subjects, or is significant in scale or effect, we will notify the affected individuals within seventy-two (72) hours of becoming aware of the breach (unless an exception applies), and the Commissioner where required, through the channels set out in the applicable regulations.
8.2. For hosted customers, we will notify the customer (as data controller) without undue delay upon becoming aware of any breach affecting the customer’s hosted personal data.
8.3. EMS produces the evidence trail — who, what, verdict, action, timestamp — that makes PDPA breach notification practical to fulfil.
Personal data is retained only as long as necessary for the purposes above:
| Data | Retention |
|---|---|
| Account/session data | While the account is active; deleted or anonymised within 30 days of account closure, unless law requires longer |
| Billing records | As required by Malaysian tax and accounting law (currently seven years from the applicable financial period) |
| Audit history, workspace activity history and other operational records relevant to protected operations | Per the customer’s contract; where unagreed, 180 days on the Service, then archived or deleted |
| Quarantine contents | Per the retention period shown in the Service |
| Records of correspondence | Until resolution, then within 12 months |
Under the PDPA, you have the following rights, which you may exercise by writing to us using the contact details in Section 14:
We may charge a statutory fee permitted by the current regulations for access requests, and we will inform you where a request cannot be granted and, to the extent permitted, the reason.
The Service is intended for businesses and is not directed to individuals under 18. We do not knowingly collect personal data from children; if you believe a child’s data has been provided to us, contact us and we will delete it.
This website uses only the essential cookies described in our Cookie Policy — a session cookie to keep you signed in, a CSRF (protection token) cookie, and cookie-consent state. We do not use advertising or cross-site tracking cookies.
13.1. We may update this Privacy Policy and will publish the updated version on this page with a new “last updated” date. Material changes are notified to active account holders by email or in-Service notice in advance of taking effect, consistent with the notice requirements of the PDPA s.7.
13.2. Where your data-processing agreement with us governs processing of hosted email content, the version of that agreement prevails in respect of such processing.
Data Protection Officer / personal data enquiries:
General enquiries: [support email]
Related documents: Terms of Service · Cookie Policy