Privacy Policy

This Policy is the personal data protection notice of DCK Media & Business Consulting for the purposes of section 7 of the Malaysian Personal Data Protection Act 2010 (as amended by the Personal Data Protection (Amendment) Act 2024) ("PDPA"). It is also intended to provide the information required by Articles 13 and 14 of the EU General Data Protection Regulation (EU) 2016/679 ("GDPR") and of the GDPR as retained in the law of the United Kingdom ("UK GDPR"), the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act ("CCPA"), the Singapore Personal Data Protection Act 2012 ("Singapore PDPA") and other data protection laws that apply to us.

The controller (in Malaysian terms, the "data user") responsible for the Personal Data described in this Policy, except where Section 3 says otherwise, is DCK Media & Business Consulting (Registration No. 202503147640 (PG0572109-H)), a business registered in Malaysia, which provides the DCK VISIBILITY 360 services at dckvisibility360.com ("DCK VISIBILITY 360", "we", "us" or "our").

Data Protection Officer. We have appointed a Data Protection Officer ("DPO") as required by the PDPA. Our DPO is the DCK VISIBILITY 360 Data Protection Officer (privacy@dckvisibility360.com) and can also be reached at privacy@dckvisibility360.com. Please mark communications "Attention: Data Protection Officer".

EU and UK representative. We are a business registered in Malaysia and do not currently have an establishment in the European Economic Area ("EEA") or the United Kingdom. Where Article 27 of the GDPR or of the UK GDPR requires us to designate a representative, we will appoint one and publish the representative's details in this Section. Until then, individuals and supervisory authorities in the EEA and the UK may contact us directly at privacy@dckvisibility360.com.

In this Policy, the following terms have the meanings set out below:

Capitalised terms not defined in this Policy have the meanings given in the Terms of Service. This Policy is a notice: it does not form part of any contract with you except where Applicable Data Protection Law requires otherwise. Where we process Personal Data as a processor on behalf of a Customer, the Data Processing Addendum governs that processing and prevails over this Policy to the extent of any inconsistency.

This Policy applies to Personal Data that we process in connection with:

• (a)the Platform and its APIs;
• (b)our marketing website at dckvisibility360.com and its subdomains, including DCK VISIBILITY 360-hosted blogs to the extent we act as controller;
• (c)the Apps for iOS and Android, when and as released;
• (d)requests for, and delivery and follow-up of, HALO Reports;
• (e)Sales Helper prospect analyses and our other business-to-business sales and marketing activities, including outbound email campaigns;
• (f)enquiries about our custom WhatsApp, Messenger and Instagram AI bot consultation services submitted through our bots page;
• (g)our partner, coupon and referral programme;
• (h)demo and consultation bookings, events, surveys, support and other communications with us; and
• (i)the security, administration and improvement of all of the above.

This Policy does not apply to:

• (a)Personal Data that we process as a processor on behalf of Customers (see Section 3), which is governed by the relevant Customer's own privacy notice and by our Data Processing Addendum;
• (b)the practices of third-party websites, platforms and services, including Connected Accounts and AI platforms, which are governed by their own privacy policies; or
• (c)Personal Data of our own job applicants, employees and contractors, which is covered by separate notices.

The Services are designed for businesses and professionals. Most individuals whose Personal Data we process interact with us in a business or professional capacity, for example as owners, employees or contractors of a Customer, Prospect or Partner.

We are the controller (data user) for Personal Data that we decide to collect and use for our own purposes, including: account, profile and billing data; data collected on our own website (including through our own deployment of the Tracking Script on dckvisibility360.com); HALO Report requests; Sales Helper and outbound sales data; Partner data; bots consultation enquiries; support and communications data; security, audit and diagnostics data; and the creation of aggregated or de-identified data described in Section 8.

We are a processor (in Malaysian terms, a "data processor"; in Singapore, a "data intermediary"; and under the CCPA, a "service provider" or "contractor") for Personal Data that we process only on behalf of and on the documented instructions of a Customer, including:

• (a)Visitor data collected by the Tracking Script on websites owned or controlled by the Customer;
• (b)Personal Data contained in Customer Content and in data that a Customer uploads, imports or makes available to us, including prospect and lead lists, contact data and data retrieved from Connected Accounts; and
• (c)Personal Data contained in content that we publish to the Customer's websites or Connected Accounts on its instructions.

For processing described in Section 3.2, the Customer is the controller and is solely responsible for: having a valid lawful basis; providing all notices required by Applicable Data Protection Law (including cookie and privacy notices to Visitors); obtaining any consent required before the Tracking Script is loaded or before Personal Data is uploaded; and responding to requests from individuals. That processing is governed by our Data Processing Addendum. If you are a Visitor or another individual whose data a Customer processes through the Services, please contact the relevant Customer (for example, the owner of the website you visited). If you contact us instead, we will, where we can identify the Customer, refer your request to it and assist it as required by the Data Processing Addendum.

To the maximum extent permitted by applicable law, we are not responsible for the privacy or data protection practices of Customers, which may differ from ours.

Certain third parties act as independent controllers of Personal Data they collect in connection with the Services rather than as our Subprocessors, for example: payment providers when performing their own fraud-prevention, anti-money-laundering and regulatory obligations; operators of Connected Accounts and social platforms in respect of content published to them; Meta when you contact us via WhatsApp; and Apple and Google in respect of app-store downloads, reviews and purchases. Their own privacy policies apply to that processing.

Account and profile data. Your name, business email address, password (which we store only as a salted cryptographic hash and never in plain text), company or organisation name, website address, job title or role, country, time zone, language preference, plan, account settings, preferences, and details of Authorised Users that you invite. If you sign in with Google, we receive the basic profile information (such as name, email address and account identifier) that you authorise Google to share. If you choose to add one, we also keep a private mobile number with the country you selected, and a record of each of your two separate messaging choices (important service alerts by WhatsApp/SMS, and offers and tips) with the time and the place in the Services where you made or withdrew it. A mobile number is never required to create or use an account.

Billing and transaction data. Billing contact name, billing address, tax or VAT registration number, plan, billing cycle, invoices, payment status, refund and chargeback records, and limited payment-method details made available to us by our payment providers (such as card brand, last four digits and expiry date, or PayPal account email). Payment card and bank details are collected and processed directly by Stripe or PayPal. We never receive or store full card numbers or card security codes.

Website and crawl data. When a Customer adds a website, our rate-limited crawler retrieves publicly accessible pages, metadata and structured data to perform SEO scoring and analysis. Those pages may contain Personal Data published by the website owner (for example, staff names, biographies or contact details). We also process keywords, rankings, search-engine results data, competitor domains and related data obtained from search-data providers. If you add public business contact details to a website (business telephone and WhatsApp numbers, business address and opening hours), we publish them on your behalf: they appear on your DCK VISIBILITY 360-hosted blog and in the structured data we publish for your business, so that search engines and AI assistants can show consistent contact details. Auto-fill only suggests a phone number or address that is already published on your own homepage, and you decide whether to keep it. Do not enter a personal number here if you do not want it to be public.

Visitor analytics through the Tracking Script. Where the Tracking Script is installed (including on our own website), it collects: page URL and title; page text, metadata and structured data for SEO analysis; performance metrics; referrer; UTM campaign parameters; user agent; browser language; screen size; a pseudonymous visitor identifier stored in the Visitor's browser localStorage (key seo_ai_visitor); a session identifier stored in sessionStorage (key seo_ai_session); and conversion events, being form submissions and clicks on telephone, email and WhatsApp links. In respect of these items:

• (a)form field values are never read or transmitted — for a form submission we record only the form's action URL, the page, the referrer and UTM parameters;
• (b)the Visitor's IP address is used transiently to derive an approximate country (using IPinfo) and is then anonymised by truncation before storage; and
• (c)we store only salted hashes of IP-derived values for rate-limiting and abuse prevention, not full IP addresses.

AI prompts, inputs and outputs. Instructions, briefs, topics, keywords, brand and competitor names, website excerpts and other inputs that you provide or that the Services derive from your website for AI content generation and analysis, and the resulting AI Output. For AI visibility checks, we record the prompts sent to third-party AI platforms and the answers, brand mentions and citations returned. Inputs and outputs may contain Personal Data if you include it or if an AI platform's answer refers to an individual.

Connected Account data and integration tokens. OAuth access and refresh tokens, API keys and similar credentials (which are encrypted at rest), account, page, property and channel identifiers, the display name of the Connected Account, data that you authorise us to retrieve (such as Search Console performance data, Google Analytics 4 reports, Google Business Profile listing and review data, and Bing Webmaster Tools data), and records of content published through the Connected Account. Review and listing data may include the names and comments of individuals who left reviews.

Prospect and lead data. We collect the following in connection with our own sales and marketing:

• (a)HALO Reports: website URL, brand name, up to three competitor names or domains, email address, a record of your consent (including the time and the wording of the consent checkbox), a hash of your anonymised IP address and your user agent (for abuse prevention), and the resulting report. A phone or WhatsApp number is optional: we keep it only if you also tick the separate "Contact me about my results" box, and we record when you did;
• (b)Sales Helper: the business name and public website analysed, prospect contact name, business email address and telephone number, notes, the analysis produced, whether the prospect's consent to receive the report by email has been recorded, and the identity of the authorised sales representative concerned. For our representatives, we process their name, contact details, a hashed member code, access attempts, IP-based lockout events and usage counts against daily caps; and
• (c)Outbound business-to-business campaigns: business contact details (such as name, job title, business email address, company and website) obtained from the individual or from publicly available business sources, together with delivery, bounce, reply and opt-out status.

Partner data. Name, email address, telephone number, country, company, tax identification number, payout details (such as bank account, PayPal, Wise, Payoneer or Stripe account details), coupon or referral codes, attributed referrals, commission calculations and payment records.

Bots consultation enquiries. Name, contact details (such as email address and WhatsApp or telephone number), business name and details, and the content of your message.

Communications and support data. The content of emails, WhatsApp and other messages, support tickets, call or meeting notes, demo bookings made through Calendly (name, email and booking details), feedback and survey responses, together with related metadata such as dates and times.

Technical, usage and security data. IP address, browser and device type, operating system, referring pages, pages and features used, timestamps, error and performance logs (including through Sentry where enabled), authentication events, rate-limit and abuse-prevention signals, and security data generated by Cloudflare. For platform administrators, we keep audit logs of administrative actions that store salted SHA-256 hashes of IP addresses rather than the IP addresses themselves.

Device and app data (Apps). When you use the Apps, we collect device model, operating system and version, app version and build, language and region settings, crash reports and diagnostics, and — only if you enable notifications — a push notification token. We do not collect the device advertising identifier (IDFA or Android Advertising ID) for tracking purposes, and we do not engage in "tracking" as defined by Apple's App Tracking Transparency framework. The Apps do not collect precise location, contacts, health or biometric data.

Cookies and similar technologies. We and our service providers use cookies, localStorage, sessionStorage and similar technologies as described in our Cookie & Tracking Policy.

Sensitive data. We do not intentionally collect sensitive personal data (including, under the PDPA, information about physical or mental health, political opinions, religious or similar beliefs, the commission or alleged commission of any offence, or biometric data, and special-category or criminal-offence data under the GDPR). Please do not submit such data to the Services. Customers must not upload such data, include it in prompts, or configure the Tracking Script or their websites so that it captures such data. If we become aware that we hold sensitive data that we did not intend to collect, we may delete it.

Obligatory and voluntary data. Information marked as required in our forms (for example, your email address to create an account, or your billing details to purchase a Subscription) is obligatory; if you do not provide it, we will be unable to provide the relevant Service. All other information is voluntary. Failing to provide voluntary information will not prevent you from using the core Services but may limit certain features.

We obtain Personal Data from the following sources:

• (a)directly from you, when you register, complete forms, request a HALO Report, book a demo, contact us, apply to become a Partner or otherwise interact with us;
• (b)automatically, from your browser or device when you use the Services, including through cookies, local storage and the Tracking Script on our own website;
• (c)from Customers, when they invite Authorised Users, upload or import data, embed the Tracking Script on their websites, or connect Connected Accounts;
• (d)from Connected Account providers, such as Google, Microsoft, Meta, LinkedIn, Telegram, WordPress and Shopify, as authorised by the Customer;
• (e)from publicly available sources, such as public websites, search-engine results, business directories and public business profiles;
• (f)from third-party AI platforms, whose answers to AI visibility prompts may mention individuals;
• (g)from service providers, such as payment confirmations from Stripe and PayPal, approximate country from IPinfo, security signals from Cloudflare, and booking information from Calendly;
• (h)from our authorised sales representatives using Sales Helper, and from Partners who refer Customers to us; and
• (i)from app stores, such as crash reports and aggregated statistics that Apple or Google make available to developers.

We process Personal Data for the purposes set out in the table below. The final column states the legal basis we rely on under the GDPR and UK GDPR. Section 6.3 explains the position under the PDPA and Section 6.4 under the Singapore PDPA.

Where we rely on legitimate interests, we have balanced those interests against your interests, rights and freedoms. You may request details of that assessment and you have the right to object (see Section 14). Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

Malaysia (PDPA). We process Personal Data with your consent, which you give by providing the data, ticking a consent box, creating an account or continuing to use the Services after receiving this notice, or without consent where the processing is necessary for a purpose permitted by section 6(2) of the PDPA, including the performance of a contract to which you are a party, taking steps at your request with a view to entering into a contract, compliance with a legal obligation, protecting your vital interests, the administration of justice, or the exercise of functions conferred by law. We process Personal Data only for lawful purposes directly related to our activities, and the data is adequate and not excessive in relation to those purposes.

Singapore (Singapore PDPA). We rely on consent (including deemed consent by conduct, by contractual necessity and by notification where permitted) or on an exception under the First or Second Schedule of the Singapore PDPA, such as the legitimate interests exception or the business improvement exception.

We will not process Personal Data for a purpose that is materially different from those described in this Policy without first notifying you and, where required by Applicable Data Protection Law, obtaining your consent.

The Services use artificial-intelligence models provided by third parties. We currently use Google Gemini models for content generation and analysis and may also use models from OpenAI and Anthropic. For AI visibility checks, we send prompts through official APIs to third-party AI platforms (including Google Gemini and AI Overviews detection through search-results data, OpenAI, Anthropic and Perplexity) and record the answers, mentions and citations returned. These providers are listed as Subprocessors in Section 9.

We design prompts to include only the information reasonably needed for the task, such as topics, keywords, website excerpts, brand and competitor names and your instructions. We do not intentionally include passwords, authentication tokens or payment card data in AI prompts. Please do not include Personal Data in prompts or instructions unless it is necessary.

Model training. Under the API terms of our AI providers as at the date of this Policy, data submitted through their business APIs is not used to train their models by default; we do not control provider policies. Where providers offer settings or service tiers under which API data is not used to train their models, we choose those settings or tiers. AI providers may retain inputs and outputs for limited periods for abuse monitoring, safety and legal compliance in accordance with their terms. We do not use Customer Content to train third-party general-purpose AI models.

No significant automated decisions. We do not make decisions about individuals based solely on automated processing that produce legal effects concerning them or similarly significantly affect them, within the meaning of Article 22 of the GDPR. Automated security controls (such as rate limits, temporary IP-based lockouts and fraud screening by our payment providers) may temporarily restrict access to a feature; you may contact us to request human review.

AI Output may be inaccurate, incomplete or out of date and may, despite our safeguards, refer to real individuals. Customers are responsible for reviewing AI Output and for content published to their websites and Connected Accounts, including content published in Auto-Publish mode under the Customer's standing pre-authorisation. See our AI Disclaimer.

AI visibility results are point-in-time samples of third-party AI answers, which vary by user, location, time and model version. Where an answer mentions an individual (for example, a company founder), we store it only as part of the Customer's visibility evidence history and do not use it to build profiles of individuals.

We may create aggregated, de-identified or anonymised data from the data we process, including account and usage data, Customer Content, Visitor analytics and AI visibility results. Examples include cross-customer benchmarks by industry or region, statistics about which sources and content types AI platforms tend to cite, and improvements to our own scoring methods and models of what gets cited.

When we create such data we apply safeguards appropriate to the risk, including:

• (a)removing direct identifiers and Customer names;
• (b)combining data across multiple Customers and websites and applying minimum group-size thresholds (in the manner of k-anonymity), so that benchmark results are used or published only where a group is large enough that no individual Customer, website or person can reasonably be singled out;
• (c)not identifying any Customer in benchmarks or publications without its permission; and
• (d)not attempting to re-identify such data, and contractually prohibiting any recipient from doing so.

Aggregated, de-identified or anonymised data that does not identify any individual or Customer is not Personal Data. To the maximum extent permitted by applicable law, we may use and disclose it for any lawful purpose. Where the source data is processed by us as a processor, we create such data only as permitted by the Data Processing Addendum. Where the CCPA applies, we maintain and use de-identified information only in de-identified form and do not attempt to re-identify it, except as permitted by law to test our de-identification processes.

Subprocessors and service providers. We share Personal Data with the following Subprocessors, which process it on our behalf (or on behalf of our Customers) under written contracts that require appropriate confidentiality and security. This list also forms the Subprocessor list referred to in our Data Processing Addendum; changes are notified as set out in the Data Processing Addendum.

Other disclosures. We may also disclose Personal Data:

• (a)within your organisation — account owners and administrators of a Customer account can see information about Authorised Users and their activity in that account;
• (b)to platforms you connect — when a Customer instructs us to publish or submit content to its website, WordPress or Shopify site or Connected Accounts, the content is disclosed to that platform and, once published, may become publicly available;
• (c)within the Backlink Network — if a Customer opts in, the URLs and content of link placements are visible to other participating sites and to the public; we do not disclose account or billing data to other participants;
• (d)to Partners — limited information needed to attribute referrals and calculate commissions, such as the referred business's name, plan and payment status; we do not disclose billing card or bank details to Partners;
• (e)to professional advisers — such as lawyers, accountants, auditors and insurers, under duties of confidentiality;
• (f)to authorities and others where required or permitted by law — including courts, regulators, tax authorities and law-enforcement agencies, where we believe in good faith that disclosure is required by law or legal process, or is necessary to protect the rights, property or safety of us, our users or others, to detect or prevent fraud, abuse or security incidents, or to enforce our Terms;
• (g)in corporate transactions — to an actual or prospective buyer, investor, lender or successor, and their advisers, in connection with any merger, acquisition, financing, restructuring, insolvency or sale of all or part of our business or assets, subject to confidentiality obligations; Personal Data may be transferred as part of such a transaction and this Policy will continue to apply to it unless you are notified otherwise;
• (h)to any future affiliates under common ownership or control with us, who will be required to handle it consistently with this Policy; and
• (i)with your consent or at your direction.

No sale or sharing for advertising. We do not sell Personal Data and we do not share Personal Data for cross-context behavioural advertising, as those terms are defined in the CCPA, and we have not done so in the preceding 12 months. We do not rent or sell contact lists, we never sell or rent phone or WhatsApp numbers, and we do not disclose Personal Data to third parties for their own direct-marketing purposes. We do not use advertising cookies.

We are a business registered in Malaysia, and the DCK VISIBILITY 360 Services are operated from Malaysia. Our Platform is hosted with Hostinger in Malaysia (Kuala Lumpur), email is delivered through Google Workspace, encrypted backups are stored on Cloudflare R2, and our Subprocessors operate in the locations set out in Section 9, including the United States, the European Union, Singapore and global edge locations. Personal Data may therefore be transferred to, stored in and accessed from countries other than the one in which you are located, which may not offer the same level of protection as your home country.

From Malaysia. We transfer Personal Data outside Malaysia only as permitted by section 129 of the PDPA (as amended), including where the destination has in force a law substantially similar to the PDPA or ensures an adequate level of protection at least equivalent to that afforded by the PDPA, or where another ground in section 129 applies (such as your consent, the performance of a contract with you, or where we have taken all reasonable precautions and exercised all due diligence to ensure that the data will not be processed in a manner that would contravene the PDPA).

From the EEA. Where we transfer Personal Data from the EEA to a country that is not subject to an adequacy decision of the European Commission (including Malaysia), we rely on the Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914, or on another lawful transfer mechanism such as an adequacy decision (including, where the recipient is certified, the EU-US Data Privacy Framework), together with supplementary measures where appropriate.

From the United Kingdom. We rely on the International Data Transfer Agreement or the International Data Transfer Addendum to the EU Standard Contractual Clauses issued by the UK Information Commissioner, or on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework where applicable).

From Singapore. In accordance with the transfer limitation obligation in the Singapore PDPA and the Personal Data Protection Regulations 2021, we take appropriate steps to ensure that recipients outside Singapore are bound by legally enforceable obligations to provide a standard of protection comparable to that under the Singapore PDPA.

You may request a copy of the relevant transfer safeguards by contacting privacy@dckvisibility360.com; commercially sensitive terms may be redacted. To the extent that Applicable Data Protection Law permits transfers on the basis of consent and no other transfer mechanism is available, by providing Personal Data to us you consent to its transfer as described in this Section.

We keep Personal Data only for as long as it is needed for the purposes for which it was collected, in accordance with the Retention Principle of the PDPA and equivalent rules elsewhere. Our standard retention periods are:

Retention may be extended where required by law, to establish, exercise or defend legal claims (including for the limitation period of six years under the Malaysian Limitation Act 1953), or under a legal hold.

At the end of the applicable period we delete Personal Data or anonymise it so that it can no longer be associated with an individual. Deleted data may persist in backups until those backups are overwritten in the normal cycle; while it does, it remains protected and is not used for any other purpose.

Paused services. When a Subscription has ended or remained unpaid and no other Subscription is live, the service is paused (Terms of Service, Section 22.6) and we keep its Customer Content for 12 months after the pause began. We email the account owner 60, 30 and 7 days before the deletion date. If the Subscription is not renewed by then, we delete the paused service's content — generated articles and blog posts, media files, social posts and assets, reports, keyword, AI visibility and proof-of-impact data, featured banner creatives, crawl data and stored Connected Account tokens — and email a confirmation. User accounts stay open so they can sign in and subscribe again; invoices, payment and billing records, Subscription history and audit logs are kept for the periods above.

Where we act as a processor, we retain and delete Personal Data in accordance with the Customer's instructions and the Data Processing Addendum. Customers can delete certain data earlier through the Platform, for example by deleting content, disconnecting Connected Accounts or removing the Tracking Script.

We implement appropriate technical and organisational measures, in line with the Security Principle of the PDPA and Article 32 of the GDPR, designed to protect Personal Data against loss, misuse, unauthorised access, modification, disclosure and destruction. These measures include:

• (a)encryption in transit using TLS for connections to the Services;
• (b)encryption at rest of OAuth tokens, API keys and other integration credentials;
• (c)storing customer passwords only as salted cryptographic hashes;
• (d)two-factor authentication (TOTP) for platform administrators, with recovery codes stored only as hashes;
• (e)storing Sales Helper member codes only as hashes, with IP-based lockout and daily usage caps;
• (f)IP address anonymisation (truncation) for Tracking Script data and salted hashes of IP addresses in security and admin audit logs;
• (g)role-based access control and least-privilege access for our personnel, who are bound by confidentiality obligations;
• (h)audit logging of administrative actions;
• (i)regular backups held on a rolling basis;
• (j)network protection through Cloudflare, including DDoS mitigation and a web application firewall; and
• (k)rate limiting and abuse-prevention controls on public forms and APIs.

We review our measures periodically. However, no method of transmission over the internet or of electronic storage is completely secure. We cannot guarantee absolute security, and to the maximum extent permitted by applicable law we are not responsible for unauthorised access that occurs despite our appropriate measures or that results from circumstances outside our reasonable control.

You are responsible for keeping your login credentials confidential, using a strong and unique password, enabling additional security features where we offer them, limiting access to your account to Authorised Users, and notifying us promptly at privacy@dckvisibility360.com if you suspect any unauthorised access to your account.

Our Subprocessors are required by contract to implement appropriate security measures. Under the PDPA as amended, data processors are also directly bound by the Security Principle.

If the PDPA applies to the processing of your Personal Data, you have the right, subject to the conditions and exceptions in the PDPA:

• (a)to access your Personal Data and be informed whether we hold it, and to receive a copy (sections 12 and 30);
• (b)to correct Personal Data that is inaccurate, incomplete, misleading or not up to date (section 34);
• (c)to withdraw consent to the processing of your Personal Data by giving us written notice (section 38), although we may then be unable to provide some or all of the Services;
• (d)to prevent processing that is causing or likely to cause substantial and unwarranted damage or distress to you or another person (section 42);
• (e)to prevent processing for direct marketing purposes by giving us written notice (section 43); and
• (f)to data portability — to request that we transmit your Personal Data to another data controller of your choice by electronic means, where technically feasible and where the data format is compatible (section 43A).

We will respond to a data access request or a data correction request within 21 days of receipt. If we are unable to do so, we will notify you in writing of the reasons and comply within a further period of not more than 14 days, as permitted by the PDPA. We may charge a fee for a data access request not exceeding the amount prescribed under the PDPA regulations.

We may refuse a request on the grounds permitted by the PDPA, for example where we are not supplied with sufficient information to verify your identity, where compliance would disclose the Personal Data of another individual without that individual's consent, or where another ground in sections 32 or 36 of the PDPA applies. If we refuse, we will tell you the reasons in writing.

You may also contact us with any enquiry or complaint about our processing of your Personal Data at privacy@dckvisibility360.com or by writing to us at Level 8, Vertical Corporate Tower B, 8, Jalan Kerinchi, Bangsar South City, 59200 Kuala Lumpur, Wilayah Persekutuan, Malaysia.

If the GDPR or UK GDPR applies, you have the following rights, subject to the conditions and exceptions in the law:

• (a)access — to obtain confirmation of whether we process your Personal Data and a copy of it (Article 15);
• (b)rectification — to have inaccurate Personal Data corrected and incomplete data completed (Article 16);
• (c)erasure — to have your Personal Data deleted in certain circumstances (Article 17);
• (d)restriction — to have the processing of your Personal Data restricted in certain circumstances (Article 18);
• (e)data portability — to receive Personal Data you provided to us in a structured, commonly used and machine-readable format and to have it transmitted to another controller where technically feasible (Article 20);
• (f)objection — to object at any time to processing based on our legitimate interests on grounds relating to your particular situation, and to object at any time, without giving reasons, to processing for direct marketing (Article 21);
• (g)not to be subject to solely automated decisions with legal or similarly significant effects (Article 22) — as explained in Section 7.4, we do not make such decisions;
• (h)withdrawal of consent — where processing is based on consent, to withdraw it at any time without affecting the lawfulness of earlier processing; and
• (i)complaint — to lodge a complaint with the supervisory authority in the EEA member state where you live or work or where the alleged infringement occurred, or, in the UK, with the Information Commissioner's Office.

We will respond within one month of receiving your request. We may extend this period by up to two further months where necessary, taking into account the complexity and number of requests, in which case we will inform you within the first month. We do not charge a fee unless a request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse to act on it.

Notice at Collection. This Section, together with the rest of this Policy, constitutes our Notice at Collection for California residents. To the extent the CCPA applies to us, the table below describes the categories of personal information we have collected in the preceding 12 months, the sources, the business or commercial purposes for collection, and the categories of recipients to whom we disclosed it for a business purpose. Retention periods for each category are set out in Section 11.

We do not collect protected classification characteristics, biometric information, or education information, other than incidentally where you choose to provide it. We do not use or disclose sensitive personal information for purposes other than those permitted by the CCPA regulations, and we do not use it to infer characteristics about you; accordingly, the right to limit the use of sensitive personal information does not apply.

We do not sell personal information or share it for cross-context behavioural advertising, including the personal information of consumers under 16 years of age, and we do not offer financial incentives in exchange for personal information.

Subject to the CCPA, California residents have the right:

• (a)to know the categories and specific pieces of personal information we have collected about them, the categories of sources, the business or commercial purposes, and the categories of third parties to whom we disclosed it;
• (b)to delete personal information we collected from them, subject to exceptions;
• (c)to correct inaccurate personal information;
• (d)to opt out of the sale or sharing of personal information (we do not sell or share it);
• (e)to limit the use and disclosure of sensitive personal information (which we use only for permitted purposes); and
• (f)not to receive discriminatory treatment for exercising any of these rights — we will not deny you services, charge you different prices or provide a different level of quality because you exercised your rights.

Authorised agents. You may use an authorised agent to submit a request. We may require the agent to provide your signed written permission and may require you to verify your identity directly with us or confirm that you gave the agent permission, unless the agent holds a valid power of attorney under California Probate Code sections 4121 to 4130.

Verification and timing. We verify requests by matching information you provide with information we hold, normally by requiring the request to come from, or be confirmed through, the email address associated with your account. We will confirm receipt within 10 business days and respond within 45 calendar days, which we may extend by a further 45 calendar days where reasonably necessary, with notice to you.

Other US states. If you live in another US state with a comprehensive consumer privacy law (such as Virginia, Colorado, Connecticut, Utah, Texas or Oregon), you may have similar rights to access, correct, delete and obtain a copy of your personal data and to opt out of targeted advertising, sale and certain profiling. We do not sell personal data, engage in targeted advertising or conduct profiling that produces legal or similarly significant effects. If we decline your request, you may appeal by replying to our decision with the subject line "Privacy appeal" to privacy@dckvisibility360.com; we will respond to the appeal within the period required by law and, if we deny it, you may contact your state attorney general.

California "Shine the Light". We do not disclose personal information to third parties for their own direct-marketing purposes.

Where we process personal information as a service provider or contractor on behalf of a Customer (for example, Visitor data), please direct your request to that Customer.

If the Singapore PDPA applies, you may, subject to its exceptions:

• (a)request access to your Personal Data in our possession or control and information about the ways in which it has been used or disclosed in the preceding year;
• (b)request correction of an error or omission in your Personal Data; and
• (c)withdraw consent to the collection, use or disclosure of your Personal Data on reasonable notice, in which case we will inform you of the likely consequences, which may include our being unable to continue providing the Services.

We will respond to access and correction requests as soon as reasonably possible and, if we cannot respond within 30 days, we will inform you in writing of the time by which we will respond. We may charge a reasonable fee for an access request and will give you a written estimate in advance.

Before sending a marketing message to a Singapore telephone number, we check the Do Not Call Registry unless we have your clear and unambiguous consent in written or other accessible form or an exemption applies.

If you are not satisfied with our response, you may complain to the Personal Data Protection Commission of Singapore (see Section 27).

If you live in another jurisdiction with data protection laws (for example Australia, Brazil, Canada, India, Indonesia, the Philippines, Thailand or Vietnam), you may have rights similar to those described above, such as rights to access, correct or delete your Personal Data, to withdraw consent and to complain to a regulator. We will honour such rights to the extent required by the laws that apply to us. Please contact us at privacy@dckvisibility360.com to make a request.

You may exercise your rights by:

• (a)emailing privacy@dckvisibility360.com, preferably from the email address associated with your account, stating the right you wish to exercise and the jurisdiction whose law you rely on;
• (b)using the self-service tools in the Platform or Apps, for example to update your profile, disconnect Connected Accounts, export data where that feature is available, or delete your account under Profile → Delete account; or
• (c)writing to our DPO at Level 8, Vertical Corporate Tower B, 8, Jalan Kerinchi, Bangsar South City, 59200 Kuala Lumpur, Wilayah Persekutuan, Malaysia.

Verification. To protect your Personal Data, we must verify your identity before acting on a request. We may ask you to confirm the request from your account email address, to sign in, or to provide additional information. We will use information provided for verification only for that purpose. We may decline a request if we cannot verify your identity.

Response times and fees. Subject to the details in Sections 13 to 17:

We may refuse or limit a request where permitted by Applicable Data Protection Law, for example where it would adversely affect the rights of others, disclose legally privileged information or trade secrets, conflict with a legal obligation or our need to establish, exercise or defend legal claims, or where it is manifestly unfounded, excessive or repetitive.

If your request concerns Personal Data that we process as a processor on behalf of a Customer, we will refer it to the relevant Customer where we can identify it, and will assist that Customer as required by the Data Processing Addendum.

Service messages. We send messages that are necessary to provide the Services, such as account verification, security alerts, billing notices and receipts, notices of changes to our terms and policies, and important information about the Services. You cannot opt out of service messages while your account is active, because they are necessary for the Services and our legal obligations.

Marketing messages. We may send you information about our products, features, offers, events and content (including follow-up relating to a HALO Report you requested) where you have consented or where Applicable Data Protection Law otherwise permits, for example to existing Customers about similar services or to business contacts where electronic-marketing rules permit business-to-business communications. We send unsolicited business-to-business outreach only where it is lawful in the recipient's jurisdiction.

Email. Every marketing email we send:

• (a)identifies us as the sender and includes our physical postal address;
• (b)uses subject lines that are not deceptive; and
• (c)includes a working unsubscribe link. We process unsubscribe requests promptly and in any event within 10 business days, as required by the US CAN-SPAM Act.

WhatsApp. We send business-initiated WhatsApp messages (including HALO Report delivery and follow-up) only where you have opted in to receive them, using message templates approved under the WhatsApp Business Messaging Policy. You can opt out at any time by replying STOP. WhatsApp is operated by Meta, which processes messages in accordance with its own terms and privacy policy.

Mobile alerts and offers. If you add a mobile number to your account, you choose separately whether we may send you important service alerts and whether we may send you offers and tips by WhatsApp or SMS; offers and tips are off unless you turn them on. You can change either choice, or remove your number, at any time on the Account & billing page. Phone or WhatsApp numbers given with a HALO Report request are used only to talk to you about your results, and only if you ticked the box allowing it.

Sales Helper reports are emailed to a Prospect only where the Prospect's consent to receive the report has been recorded.

Your choices. You may opt out of marketing at any time by using the unsubscribe link, replying STOP on WhatsApp, or emailing privacy@dckvisibility360.com. Under section 43 of the PDPA and Article 21 of the GDPR you may require us to stop processing your Personal Data for direct marketing. We keep a minimal suppression record (such as your email address or phone number and the date of opt-out) so that we can continue to honour your choice.

How to delete. You can delete your account at any time in the Platform or the Apps by going to Profile → Delete account. Alternatively, you can email a deletion request to privacy@dckvisibility360.com from the email address associated with your account. Our public Account deletion page explains the steps and what happens to your data.

We may ask you to confirm the request or verify your identity before completing it. Where an account belongs to a Customer organisation, we may require the request to be made or confirmed by the account owner.

What happens when you delete your account:

• (a)you will be signed out and lose access to the account and all Customer Content in it;
• (b)any active Subscription will be cancelled and will not renew; deletion does not entitle you to a refund except as provided in our Refund & Cancellation Policy or as required by law;
• (c)Connected Account tokens are revoked or deleted within 7 days;
• (d)account and profile data is deleted or anonymised within 30 days after the deletion is completed;
• (e)Customer Content (including Visitor analytics, crawl data and AI visibility history) is deleted within 90 days; and
• (f)deleted data is removed from our rolling backups within up to 35 days after deletion from our live systems.

What we keep. Even after deletion, we may retain, in accordance with Section 11:

• (a)billing records, invoices and tax records for 7 years;
• (b)consent records and marketing suppression entries so that your opt-outs continue to be honoured;
• (c)security and admin audit logs (with hashed IP addresses) for up to 24 months;
• (d)data subject to a legal hold or needed to establish, exercise or defend legal claims; and
• (e)aggregated or de-identified data that no longer identifies you.

Content outside our systems. Content that has already been published to your website, DCK VISIBILITY 360-hosted blog, WordPress or Shopify site or Connected Accounts may remain there until you remove it, and we cannot delete content from third-party platforms on your behalf after your account is deleted. If you participated in the Backlink Network, we will remove placements on a best-efforts basis within a reasonable period. You should also remove the Tracking Script from your websites; once your account is deleted, data it sends will not be stored.

Account deletion is permanent and cannot be undone. Please export any data you wish to keep before deleting your account, where export is available. Uninstalling an App from your device does not delete your account.

This Policy applies to the Apps when they are released. A link to this Policy is available within the Apps and on their Apple App Store and Google Play listings.

The privacy information we provide on app-store listings (including Apple's App Privacy labels and Google Play's Data safety section) is intended to be consistent with this Policy. If you notice any inconsistency, please contact us; we will correct it, and in the meantime this Policy describes our practices.

Permissions. The Apps request device permissions only when needed for a feature you choose to use (for example, notifications, or access to your photo library or camera if you choose to upload an image). You can grant, refuse or withdraw permissions at any time in your device settings; refusing a permission may make the related feature unavailable.

Sign-in. If the Apps offer sign-in with a third-party account such as Google, we will also offer Sign in with Apple or another login option that meets Apple's App Store requirements. If you use Sign in with Apple, you may choose to hide your email address, in which case we receive a relay address from Apple.

Push notifications. We send push notifications only if you opt in through your device's notification permission. You can turn them off at any time in your device settings or in the App's settings.

No cross-app tracking. The Apps do not track you across apps and websites owned by other companies and do not access the device advertising identifier for that purpose. If we ever wish to do so, we will first ask your permission through the App Tracking Transparency prompt (on iOS) or as otherwise required, and update this Policy.

Diagnostics. Crash reports and diagnostics are used to keep the Apps stable and secure and are retained for up to 90 days. If you have enabled diagnostics sharing on your device, Apple or Google may also share crash data with us in accordance with their policies.

Apple and Google process data relating to your download, ratings, reviews and any app-store purchases as independent controllers under their own privacy policies.

You can delete your account from within the Apps at Profile → Delete account, as described in Section 20.

The Services are intended for businesses and are not directed to anyone under 18 years of age. You must be at least 18 to use the Services. We do not knowingly collect Personal Data from anyone under 18. If we learn that we have collected such data, we will delete it as soon as reasonably practicable. If you believe a minor has provided us with Personal Data, please contact privacy@dckvisibility360.com.

Our DPO, the DCK VISIBILITY 360 Data Protection Officer (privacy@dckvisibility360.com), oversees our compliance with Applicable Data Protection Law and can be contacted at privacy@dckvisibility360.com. Where required by the PDPA, the DPO's appointment and contact details are notified to the Personal Data Protection Commissioner.

We maintain procedures to detect, contain, assess, record and respond to personal data breaches. Where a breach occurs, we will take steps to contain it and mitigate its effects and will make notifications as required by law, including as follows:

• (a)Malaysia: we will notify the Personal Data Protection Commissioner as soon as practicable and within 72 hours of becoming aware of a personal data breach that causes or is likely to cause significant harm, and will notify affected individuals without unnecessary delay (in line with the Commissioner's guidelines, within 7 days of notifying the Commissioner);
• (b)EEA / UK: we will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a breach, unless it is unlikely to result in a risk to individuals' rights and freedoms, and will notify affected individuals without undue delay where the breach is likely to result in a high risk;
• (c)Singapore: we will notify the Personal Data Protection Commission within 3 calendar days after assessing that a breach is notifiable, and will notify affected individuals where required; and
• (d)United States and elsewhere: we will provide notifications required by applicable breach-notification laws.

Where we act as a processor, we will notify the affected Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data and provide the information and assistance set out in the Data Processing Addendum. The Customer, as controller, is responsible for any notifications it is required to make to regulators and individuals.

To the maximum extent permitted by applicable law, a notification of, or response to, a data breach is not an acknowledgement of fault or liability.

The Services contain links to, and integrations with, third-party websites, platforms and services, including Connected Accounts, AI platforms, Calendly, WhatsApp and payment pages operated by Stripe and PayPal. When you use them, the third party's own terms and privacy policy apply. We are not responsible for the content, security or privacy practices of third parties, and we encourage you to read their policies.

When you connect a Connected Account, you authorise us to access and use data from that account as described in this Policy and the authorisation screen. You can revoke access at any time in the Platform or in the third-party platform's settings. Our use of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements.

We may update this Policy from time to time to reflect changes in our Services, practices or legal requirements. The "Last updated" date at the top shows when it was last revised.

If we make a material change, we will give you notice by email, in the Platform or Apps, or by a prominent notice on our website before the change takes effect, where practicable at least 14 days in advance. Where Applicable Data Protection Law requires your consent to a change, we will ask for it.

Your continued use of the Services after a change takes effect means that you have read the updated Policy, to the extent permitted by applicable law. Previous versions are available on request.

This notice is also made available in Bahasa Malaysia. In case of inconsistency, the English version prevails to the extent permitted by law. Any translation into another language is provided for convenience only.

For any question, request or complaint about this Policy or our handling of Personal Data, please contact:

• (a)DCK Media & Business Consulting (Registration No. 202503147640 (PG0572109-H)), a business registered in Malaysia, Level 8, Vertical Corporate Tower B, 8, Jalan Kerinchi, Bangsar South City, 59200 Kuala Lumpur, Wilayah Persekutuan, Malaysia
• (b)Data Protection Officer: the DCK VISIBILITY 360 Data Protection Officer (privacy@dckvisibility360.com)
• (c)Privacy and legal: privacy@dckvisibility360.com
• (d)Product support: support@dckvisibility360.com

We will try to resolve your concern. If you are not satisfied with our response, you may complain to a data protection authority, including:

• (a)Malaysia: the Personal Data Protection Commissioner, Jabatan Perlindungan Data Peribadi (Department of Personal Data Protection) — www.pdp.gov.my;
• (b)EEA: the supervisory authority in your member state of residence or work, or where the alleged infringement occurred — see the list published by the European Data Protection Board at edpb.europa.eu;
• (c)United Kingdom: the Information Commissioner's Office — ico.org.uk;
• (d)Singapore: the Personal Data Protection Commission — www.pdpc.gov.sg; and
• (e)California: the California Privacy Protection Agency — cppa.ca.gov — or the California Attorney General.

Except where mandatory law provides otherwise, the governing law and dispute-resolution provisions of the Terms of Service apply to any dispute relating to this Policy. Nothing in this Policy limits your right to complain to a data protection authority or any rights you have under mandatory law.