Privacy Policy

2. Information we collect

We collect personal information in the following ways:

• Information you give us. When you complete a contact, audit, or demo request form, subscribe to our newsletter, or otherwise communicate with us, we may collect your name, business name, role, email address, phone number, location, and any details you choose to include about your business and workflows.
• Information collected automatically. When you visit our website we may collect technical data such as IP address, device and browser type, pages viewed, and referring URLs, using cookies and similar technologies.
• Information from engagements. If you become a client, we process information necessary to deliver our services, which may include access to systems and data you authorise. The handling of client data is governed by the separate agreement between us.

3. How we use your information and our legal bases

We use personal information to:

• respond to your enquiries and provide the information or services you request (legal basis: performance of a contract or steps prior to a contract);
• operate, maintain, and improve our website and services (legal basis: our legitimate interests in running and improving our business);
• send you marketing communications where you have requested them or where otherwise permitted by law (legal basis: consent or legitimate interests);
• comply with our legal and regulatory obligations (legal basis: legal obligation).

Where we rely on consent, you may withdraw it at any time. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

4. Cookies and analytics

We use cookies and similar technologies to operate the website and to understand how it is used. Non-essential cookies are only set where permitted in accordance with your choices. You can control cookies through your browser settings; disabling some cookies may affect how the website functions.

5. WhatsApp messages we process for clients

Some of our clients use systems we build and run to handle customer conversations on WhatsApp, through Meta’s WhatsApp Business Platform. When you message one of those businesses, we may process the following on that business’s behalf:

• What we process: your WhatsApp phone number, your WhatsApp profile name, the content of messages you send and receive (including any files or images you share), and message metadata such as timestamps and delivery status.
• Why: only to route your message to the right person or workflow at that business, to draft or send replies for the business, and to record the conversation in the business’s own systems. We do not use these messages for our own marketing, we do not sell them, and we do not use them to train external AI models.
• Who else is involved: Meta Platforms, Inc. and its affiliates operate WhatsApp and the WhatsApp Business Platform and process messages as a service provider in delivering them. Meta’s handling of your data is described in WhatsApp’s own privacy policy. Messages may also pass through the AI and hosting providers we use to run the client’s system, under the safeguards in sections 7 and 8.
• How long we keep it: for as long as the business’s service agreement with us requires. When that agreement ends, or when the business or you ask us to delete it, we delete the messages and phone numbers we hold within 30 days, unless the law requires us to keep them longer.
• Your rights: the business you messaged is the data user responsible for your information. You can exercise your PDPA rights with that business directly, or contact us at [email protected] and we will pass your request to the business and help them carry it out. You can stop receiving messages at any time by replying STOP or blocking the number in WhatsApp.

6. Deleting your data

To ask us to delete your personal information, email [email protected] with the subject “Data deletion request” and include the phone number, email address or account the request relates to. We will confirm receipt, may ask you to verify that the data is yours, and will delete it within 30 days. Full instructions are on our Data Deletion page.

7. Sharing your information

We do not sell your personal information. We may share it with trusted third parties who provide services to us, for example hosting, analytics, email, and customer-relationship tools, who act as our processors and only handle data on our instructions. We may also disclose information where required by law, to protect our rights, or in connection with a business transfer. We require our service providers to maintain appropriate security and confidentiality.

8. International transfers

Some of our service providers may be located outside your country. Where personal information is transferred internationally, we take steps to ensure it is protected by appropriate safeguards, such as standard contractual clauses or an equivalent recognised mechanism.

9. How long we keep it

We keep personal information only for as long as necessary for the purposes set out in this policy, to comply with our legal obligations, to resolve disputes, and to enforce our agreements. When information is no longer needed, we delete or anonymise it.

10. Security

We implement appropriate technical and organisational measures designed to protect personal information against unauthorised access, loss, or misuse. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping any credentials you use confidential.

11. Your rights

Under the PDPA you have the right to request access to the personal information we hold about you, to ask us to correct it if it is inaccurate, incomplete or out of date, to withdraw consent, to ask us to stop or limit processing, and to ask us to stop sending you direct marketing. You may also ask us to delete your information (see section 6) and, where it applies, to transmit it to another data user. If you are in the UK or EU, you have equivalent rights under the UK GDPR or EU GDPR.

To exercise any of these rights, contact us at [email protected] or +60 12-732 8168. We will respond within 21 days. If you are not satisfied with our response, you can complain to the Personal Data Protection Commissioner of Malaysia (Jabatan Perlindungan Data Peribadi).

12. Children

Our website and services are intended for businesses and are not directed at children. We do not knowingly collect personal information from children.

13. Third-party websites

Our website may contain links to third-party sites and tools. We are not responsible for the privacy practices or content of those third parties, and we encourage you to review their policies.

14. Changes to this policy

We may update this policy from time to time. The “Last updated” date above shows when it was last revised. Continued use of our website after changes take effect constitutes acceptance of the updated policy.

15. Contact us

For any questions about this policy or how we handle your information, contact us:

BLJH Consulting Sdn. Bhd. (202301004756 / 1498675-A), trading as Pexalo
Sunway Serene, Jalan SS7/2, SS8, Petaling Jaya, 47300 Selangor, Malaysia
Tel +60 12-732 8168 · Email [email protected]