Privacy Policy
This Policy explains how Webtek Sdn Bhd collects, uses, and protects personal data in connection with the AIRS platform. It is drafted in compliance with the Personal Data Protection Act 2010 (Malaysia).
Privacy at a Glance
This table is a plain-language summary. Please read the full policy below for complete details.
| Topic | Summary |
|---|---|
| Who we are | Webtek Sdn Bhd (202201006226), Puchong, Selangor, Malaysia — developers of AIRS. |
| What data we collect | Account details, property information, guest data, usage data, and payment records. |
| Why we collect it | To operate AIRS, process reservations, improve the AI, and comply with legal obligations. |
| Who we share it with | Trusted sub-processors (cloud hosting, payment gateway, AI provider) only. We never sell your data. |
| How long we keep it | For the duration of your Subscription plus 90 days after termination. |
| Your rights | Access, correction, deletion, portability, and withdrawal of consent under PDPA 2010. |
| Cross-border transfers | Data may be processed outside Malaysia with appropriate safeguards in place. |
| Cookies | We use essential and analytics cookies. You can opt out of non-essential cookies. |
| Contact | contact@webtek.my |
Table of Contents
- Introduction
- Data Controller and Contact Details
- Personal Data We Collect
- How We Collect Personal Data
- Purposes and Legal Basis for Processing
- AI Processing and Voice Data
- Cookies and Tracking Technologies
- How We Share Personal Data
- Cross-Border Data Transfers
- Data Retention
- Data Security
- Your Rights Under the PDPA
- Children's Privacy
- Third-Party Links and Integrations
- Marketing Communications
- Changes to This Privacy Policy
- Complaints and Regulatory Authority
- Contact Us
01 Introduction
Webtek Sdn Bhd (Company Registration No. 202201006226) ("Webtek", "we", "us", or "our") is committed to protecting the privacy and personal data of everyone who interacts with AIRS — AI Revenue & Reservation System (the "Platform" or "Service").
This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, who we share it with, and what rights you have over your data. It applies to:
- Hotel operators, property managers, and businesses ("Customers") who subscribe to AIRS;
- Guests and end users who interact with the AIRS AI Assistant on behalf of a Customer ("Guests"); and
- Visitors to our website at airs.my and any related Webtek web properties.
This Policy is drafted in compliance with the Personal Data Protection Act 2010 (Malaysia) ("PDPA") and reflects best practices aligned with international data protection standards.
BY USING AIRS, YOU ACKNOWLEDGE THAT YOU HAVE READ AND UNDERSTOOD THIS PRIVACY POLICY. IF YOU DO NOT AGREE, YOU MUST NOT USE THE SERVICE.
02 Data Controller and Contact Details
The data controller responsible for your personal data under this Policy is:
| Detail | Information |
|---|---|
| Company | Webtek Sdn Bhd |
| Registration No. | 202201006226 |
| Address | Puchong, Selangor, Malaysia |
| contact@webtek.my | |
| Website | webtek.my |
| Platform | airs.my |
For all privacy-related inquiries, data subject requests, or complaints, please contact us at contact@webtek.my. We will respond within fourteen (14) business days.
03 Personal Data We Collect
We collect the following categories of personal data depending on your relationship with AIRS:
3.1 Customer Account Data
When you register for AIRS, we collect:
- Full name and job title;
- Business email address and phone number;
- Property name, type, address, and number of rooms;
- Password (stored in encrypted, hashed form — Webtek never stores plain-text passwords);
- Billing information (name, billing address, payment method details processed via our payment gateway);
- Subscription plan details and transaction history.
3.2 Guest Data
When Guests interact with the AIRS AI Assistant, the following data may be collected on your behalf:
- Name and contact number provided during a reservation inquiry;
- Email address (if provided);
- Reservation details: check-in/check-out dates, room type, number of guests, and special requests;
- Conversation transcripts between the Guest and the AI Assistant;
- Voice note recordings and transcriptions (if voice note feature is enabled by the Customer);
- Language preference and device/platform metadata (e.g., WhatsApp, web chat).
Customers are the data controllers of Guest data. Webtek processes Guest data solely as a data processor on the Customer's instructions. Customers are responsible for obtaining all necessary consents from Guests.
3.3 Usage and Technical Data
When you use the Platform, we automatically collect:
- IP address and approximate geographic location;
- Browser type, operating system, and device information;
- Pages visited, features used, and session duration;
- API call logs and error reports;
- AI interaction logs used to monitor system performance and improve the Service.
3.4 Communications Data
If you contact us for support or via email, we retain:
- The content of your communications;
- Your contact details and the date and time of communications.
3.5 Data We Do Not Collect
Webtek does not collect and does not require you to provide:
- National Registration Identity Card (NRIC) or passport numbers;
- Full payment card numbers (card data is tokenised by our payment gateway);
- Sensitive personal data as defined under Section 4 of the PDPA, unless strictly necessary and with explicit consent.
04 How We Collect Personal Data
We collect personal data through the following means:
- Directly from you — when you register, subscribe, fill in forms, or contact us;
- Automatically — through cookies, server logs, and analytics tools when you use the Platform;
- From Guests — through interactions with the AI Assistant embedded in your hotel's WhatsApp or website;
- From third parties — including our payment gateway provider for billing verification purposes.
05 Purposes and Legal Basis for Processing
We process personal data for the following purposes and on the following legal bases under the PDPA:
| Purpose | Legal Basis under PDPA |
|---|---|
| Account creation and management | Performance of contract (your Subscription agreement with Webtek) |
| Providing the AI Reservation and Revenue features | Performance of contract |
| Processing upfront Subscription payments | Performance of contract; legal obligation (SST/tax compliance) |
| Operating the Dynamic Pricing Engine and generating revenue forecasts | Performance of contract; legitimate interests |
| Delivering and improving the AI Assistant | Legitimate interests (improving service quality and accuracy) |
| Sending transactional emails (invoices, booking confirmations, system alerts) | Performance of contract |
| Sending product updates and marketing communications | Consent (you may opt out at any time) |
| Customer support and responding to inquiries | Legitimate interests; performance of contract |
| Security monitoring, fraud detection, and abuse prevention | Legitimate interests; legal obligation |
| Analytics and platform performance monitoring | Legitimate interests |
| Compliance with Malaysian law (PDPA, SST, AMLA, etc.) | Legal obligation |
We do not use your personal data for automated decision-making that produces legal or similarly significant effects without human review.
06 AI Processing and Voice Data
6.1 How the AI Assistant Processes Data
The AIRS AI Assistant processes conversation content (text and voice) to generate responses and facilitate reservations. Conversation data is transmitted to our AI infrastructure provider for real-time processing. We retain conversation logs for a period of ninety (90) days for quality assurance and troubleshooting purposes, after which they are deleted.
6.2 Voice Notes
If your Customer account has the voice note feature enabled, audio messages sent by Guests are transcribed to text using automated speech recognition. The audio file is not stored beyond the transcription process. The resulting text transcript is retained for ninety (90) days in line with our standard conversation log retention policy.
6.3 AI Model Improvement
Webtek may use anonymised and aggregated interaction data to improve the performance of the AIRS AI. This data is stripped of all personally identifiable information before use. We do not use identifiable Guest conversations to train AI models without explicit Customer consent.
07 Cookies and Tracking Technologies
7.1 What Cookies We Use
Our website and Platform use the following types of cookies:
- Essential cookies — required for the Platform to function (login sessions, security tokens). Cannot be disabled.
- Analytics cookies — help us understand how the Platform is used (e.g., pages visited, session duration). Used in aggregate, anonymised form.
- Preference cookies — remember your settings and preferences (e.g., language, dashboard layout).
We do not use third-party advertising or tracking cookies.
7.2 Managing Cookies
You can control non-essential cookies through your browser settings or via the cookie preferences panel on our website. Disabling essential cookies may affect Platform functionality. For more information, refer to your browser's help documentation.
08 How We Share Personal Data
Webtek does not sell, rent, or trade personal data. We share personal data only in the following circumstances:
8.1 Sub-processors and Service Providers
We engage trusted third-party providers who process data on our behalf under strict data processing agreements:
- Cloud infrastructure provider — for secure hosting of the AIRS Platform and data storage;
- AI infrastructure provider — for real-time processing of AI Assistant conversations;
- Payment gateway provider — for processing upfront Subscription payments (card data is never stored by Webtek);
- Email delivery provider — for sending transactional and system notification emails;
- Analytics provider — for anonymised usage analytics.
All sub-processors are contractually bound to process data only on Webtek's instructions, implement appropriate security measures, and not use the data for their own purposes.
8.2 Legal Disclosure
We may disclose personal data if required to do so by Malaysian law, court order, regulatory authority, or to protect the rights, property, or safety of Webtek, its Customers, Guests, or the public.
8.3 Business Transfer
In the event of a merger, acquisition, or sale of all or substantially all of Webtek's assets, personal data may be transferred to the acquiring entity. We will notify affected users by email before any such transfer and ensure the acquiring entity is bound by privacy obligations no less protective than this Policy.
8.4 With Your Consent
We may share personal data with third parties not listed above where we have obtained your explicit consent to do so.
09 Cross-Border Data Transfers
AIRS operates with cloud infrastructure that may be located outside Malaysia. Where personal data is transferred to a country outside Malaysia, Webtek ensures that appropriate safeguards are in place, including:
- Contractual clauses requiring overseas recipients to apply equivalent levels of data protection;
- Use of sub-processors operating under established international privacy frameworks; or
- Transfer to countries recognised as providing adequate data protection.
BY USING AIRS, YOU CONSENT TO THE TRANSFER OF YOUR PERSONAL DATA TO COUNTRIES OUTSIDE MALAYSIA SUBJECT TO THE SAFEGUARDS DESCRIBED ABOVE.
10 Data Retention
We retain personal data for the following periods:
| Data Category | Retention Period |
|---|---|
| Customer Account Data | Duration of active Subscription + 90 days after termination |
| Guest reservation and conversation data | 90 days from date of interaction, then deleted |
| Voice note transcripts | 90 days from date of interaction, then deleted |
| Billing and transaction records | 7 years (to comply with Malaysian financial record-keeping requirements) |
| Support communications | 2 years from date of last interaction |
| Usage and technical logs | 12 months on a rolling basis |
| Anonymised analytics data | Retained indefinitely (no personal identifiers) |
Upon expiry of the applicable retention period, personal data is securely deleted or anonymised. You may request earlier deletion of your Customer Account Data by contacting contact@webtek.my, subject to any legal retention obligations.
11 Data Security
Webtek implements appropriate technical and organisational security measures to protect personal data, including:
- Encryption of data in transit (TLS 1.2 or higher) and at rest (AES-256);
- Password hashing using industry-standard algorithms (bcrypt);
- Role-based access controls limiting internal access to personal data;
- Regular security assessments and vulnerability monitoring;
- Multi-factor authentication for administrative access to production systems.
Despite these measures, no system is completely secure. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, Webtek will notify you and the relevant authorities in accordance with applicable law as promptly as reasonably practicable.
12 Your Rights Under the PDPA
As a data subject, you have the following rights under the Personal Data Protection Act 2010 (Malaysia). To exercise any of these rights, please contact us at contact@webtek.my. We will respond within fourteen (14) business days.
| Right | Description |
|---|---|
| Right of Access | Request a copy of the personal data Webtek holds about you. |
| Right to Correction | Request correction of inaccurate or incomplete personal data. |
| Right to Withdraw Consent | Withdraw consent for processing where consent is the legal basis. Withdrawal does not affect the lawfulness of prior processing. |
| Right to Limit Processing | Request that Webtek limit the processing of your data in certain circumstances. |
| Right to Data Portability | Request that your personal data be provided in a structured, machine-readable format. |
| Right to Erasure | Request deletion of your personal data, subject to legal retention obligations. |
| Right to Object | Object to processing based on legitimate interests where your personal circumstances warrant it. |
Please note that some rights are subject to limitations under the PDPA. For example, we may be unable to delete data we are legally required to retain. We will explain any such limitations when responding to your request.
13 Children's Privacy
AIRS is a business-to-business SaaS platform intended solely for use by adults (aged 18 and above) in a commercial context. We do not knowingly collect personal data from children under the age of 18. If you believe that a child has provided us with personal data, please contact us at contact@webtek.my and we will delete the data promptly.
14 Third-Party Links and Integrations
The Platform may contain links to third-party websites or integrate with third-party services such as property management systems (PMS) or online travel agents (OTAs). This Privacy Policy does not apply to those third-party services. We encourage you to review the privacy policies of any third-party services you connect to AIRS. Webtek is not responsible for the privacy practices of third parties.
15 Marketing Communications
With your consent, we may send you product updates, tips, and promotional communications about AIRS and other Webtek products. You may opt out of marketing communications at any time by:
- Clicking the "Unsubscribe" link in any marketing email; or
- Contacting us at contact@webtek.my.
Opting out of marketing communications will not affect transactional emails related to your Subscription (invoices, system alerts, booking confirmations).
16 Changes to This Privacy Policy
Webtek may update this Privacy Policy from time to time to reflect changes in our practices, the Service, or applicable law. We will notify registered Customers of material changes by email and by posting the updated Policy at airs.my/privacy with an updated Effective Date.
Your continued use of AIRS after the effective date of any update constitutes your acceptance of the revised Policy. If you do not agree with any changes, you must stop using the Service and may request deletion of your account data.
17 Complaints and Regulatory Authority
If you have a complaint about how Webtek handles your personal data, please contact us first at contact@webtek.my. We take all complaints seriously and will respond within fourteen (14) business days.
If you are not satisfied with our response, you have the right to lodge a complaint with the Personal Data Protection Commissioner of Malaysia (Jabatan Perlindungan Data Peribadi — JPDP):
- Website: pdp.gov.my
- Telephone: +603-8911 5000
- Email: pdp@kkmm.gov.my
18 Contact Us
For any questions, concerns, or requests relating to this Privacy Policy or your personal data, please contact:
| Detail | Information |
|---|---|
| Company | Webtek Sdn Bhd (202201006226) |
| Product | AIRS — AI Revenue & Reservation System |
| Address | Puchong, Selangor, Malaysia |
| contact@webtek.my | |
| Website | webtek.my |
| Platform | airs.my |