Privacy Notice

Last updated 14 May 2026 · Governed by the Personal Data Protection Act 2010 (Malaysia) and Amendment Act 2024

Version: 2026-05-14 (current)

1. Who We Are

Ventana is a customer communication platform operated by Sage42 Sdn Bhd ("we", "us", "our"), accessible at https://ventana.my. We act as a data processor on behalf of our business clients (data controllers) who use Ventana to communicate with their end-customers.

If you are an end-customer of a business using Ventana, that business is the data controller responsible for how your data is used. You may also contact our DPO directly (see Section 9).

2. Personal Data We Collect

We process the following categories of personal data on behalf of our clients:

CategoryData fieldsClassification
IdentityFirst name, last name, display namePersonal Data
ContactPhone number, email address, physical addressPersonal Data
Identity documentIC / passport number (document_number)Sensitive Personal Data
DemographicsGender, race / ethnicity, disability status, income level, date of birthSensitive Personal Data
LocationGPS coordinates (latitude / longitude), location namePersonal Data
Social identifiersFacebook ID, Instagram ID, Telegram ID/username, WhatsApp phonePersonal Data
CommunicationsMessage content, media attachments, voice transcripts, AI-generated responsesSensitive Personal Data
Profile photoPhoto stored in AWS S3 (biometric-adjacent)Sensitive Personal Data
Consent recordsCall recording consent, communication opt-out statusPersonal Data

Sensitive personal data (IC number, race, health-related content in messages, biometric images) is only collected when the business operator explicitly enables those fields for their use case.

3. Purposes of Processing (PDPA Section 7)

Personal data is processed for the following specific, lawful purposes:

PurposeLawful basis
Enabling customer communication via WhatsApp, Facebook, Instagram, Telegram on behalf of the business operatorContract necessity (operator subscription)
AI-assisted reply suggestions and sentiment analysisLegitimate interest / operator consent — subject consent required and being implemented
Content moderation (detect inappropriate or illegal content in messages and images)Legitimate interest
Customer relationship management (CRM fields: tags, notes, appointments)Contract necessity
Data Subject Access Requests (DSAR) — providing data exports to subjects on requestLegal obligation (PDPA s.30)
Broadcast marketing messages sent on behalf of the business operatorOperator's responsibility to hold subject consent; Ventana provides the channel
Fraud prevention and platform securityLegitimate interest

We will not use your personal data for any purpose beyond what is listed above without your explicit consent.

4. Third-Party Services

We use third-party services to operate our platform. Each processes only the data necessary for its specific function.

  • Amazon Web Services (AWS) — cloud infrastructure, database hosting (RDS), file storage (S3), email delivery (SES), content moderation and PII detection (Rekognition, Comprehend)
  • Meta (Facebook / Instagram / WhatsApp) — message delivery via Meta APIs
  • Firebase (Google) — push notifications to agent users
  • OpenAI — AI-assisted replies, semantic search, and conversation analysis
  • Pusher — real-time messaging events in the operator dashboard
  • ElevenLabs — AI voice synthesis for voice agent features
  • Telegram — message delivery via Telegram Bot API
  • Nightwatch / Laravel Cloud — application error and performance monitoring

5. Cross-Border Data Transfers

Some of our service providers are located outside Malaysia. Transfers occur to:

DestinationProviderLegal basis
Malaysia (ap-southeast-5)AWS Aurora PostgreSQL, AWS ElastiCacheWithin Malaysia — no cross-border transfer
Singapore (ap-southeast-1)AWS S3 (media storage)AWS Data Processing Addendum
United StatesOpenAIData Processing Agreement
United States / EUFirebase (Google), Pusher, ElevenLabs, NightwatchProvider DPAs / standard contractual clauses
United States / EU (via Meta)Facebook, Instagram, WhatsApp infrastructureMeta Platform Terms; operator's lawful basis for collection

6. Retention

Personal data is retained for the period configured by each business operator (their "data retention period" setting), after which it is automatically deleted by a scheduled purge process. Audit logs are retained for a minimum of 2 years for regulatory compliance. Operators may contact us to request earlier deletion.

7. Cookies

We use essential cookies to keep the platform running (session management, security, authentication). No analytics or tracking cookies are used.

You can change your cookie preferences at any time at Privacy Preferences.

8. Your Rights Under Malaysia PDPA

  • Right to access — request a copy of personal data we hold about you.
  • Right to correction — request correction of inaccurate or incomplete data.
  • Right to withdraw consent — withdraw consent for any processing activity at any time.
  • Right to prevent processing — request we stop processing if it causes or is likely to cause damage or distress.
  • Right to data portability — request your data in machine-readable format (subject to technical feasibility).
  • Right to erasure — request deletion of your personal data (subject to legal retention obligations).

To exercise these rights, contact our DPO at dpo@ventana.my. We will acknowledge your request and respond within 21 days.

9. Data Protection Officer (DPO)

Ventana has appointed a Data Protection Officer in compliance with the PDPA Amendment Act 2024.

Email: dpo@ventana.my

10. Contact & Complaints

If you have questions or complaints about how we handle your personal data, contact us at dpo@ventana.my. You also have the right to lodge a complaint with the Personal Data Protection Commissioner of Malaysia.

Questions about this document? Emaildpo@ventana.my