Privacy and Terms

Privacy Notice

Version 1.0, 21 October 2026. Also in Bahasa Malaysia; neither version prevails over the other.

1. Who we are

Karyosa is business management software operated by Karyosa Software Management, registration no. 202603249372 (PG0593552-V), of Eco Grandeur, 42300 Bandar Puncak Alam, Selangor ("Karyosa", "we", "us").

For questions about this notice or about your personal data, contact our data protection contact at hello@karyosa.com or on WhatsApp at +6019-6789501.

2. Two different relationships

This notice covers people in two different positions, and the difference matters.

If you are our customer (the owner or administrator of a business that subscribes to Karyosa), we hold your personal data as a data controller and decide how it is used.

If you are an employee of one of our customers (a staff member, manager, locum or contractor whose employer uses Karyosa), your employer is the data controller. It decides what is collected and why. We hold that data as a data processor, only on your employer's instructions, and we do not use it for our own purposes. Section 12 explains what this means for you.

3. What personal data we hold

About customers: name, email address, phone number, business name, address and registration number, the modules and plan you take, quotations, invoices and payment references, and our correspondence with you.

About employees of customers, as entered by the employer or the employee:

• Identity and contact: name, email address, job title and role, staff number, identity card or passport number, age, and a profile picture if one is added.
• Employment: date joined, offer letter and other staff letters (including disciplinary letters and the replies to them), signatures, policies read and signed, work schedule, and tasks.
• Attendance: clock-in and clock-out times, location at clock-in and clock-out and the distance from the workplace, a photograph at clock-in where the employer switches that on, and any reason given for being late.
• Pay: salary, allowances, overtime, incentives, claims and their receipts, payslips, bank name and account number, EPF, SOCSO and income tax numbers, and the family details used for tax relief (marital status, whether a spouse works, number of children).
• Leave: leave requests and medical certificates.
• Performance: goals, scores, and photographs given as proof of work.
• Locums and contractors: agreements and invoices.
• Purchases: the name of a staff member who paid for stock with their own money, and when they were paid back. Supplier invoices, and a photo or PDF of them, are kept as business records.

About other people, where the employer records them: for example the name or phone number of a patient or customer linked to an incentive. The employer is responsible for that data too.

Records the software keeps by itself: a history of changes made in the business (who did what, and when), and an error log (the error, the page, and who was signed in) so that we can fix faults. Karyosa does not store your internet address or your device details. Google, which hosts the service, keeps its own technical logs (see section 8).

Karyosa is made for businesses and their working staff, not for children.

4. Sensitive personal data

Medical certificates, and claims for medical treatment, show information about a person's health. The law treats this as sensitive personal data. The employer may hold it only with the employee's explicit consent, or where it is needed for a right or duty that employment law gives the employer, such as approving sick leave. Within Karyosa, only the person themselves and the people the employer allows to manage payroll can open it.

Clock-in photographs are not used for face recognition.

5. Where the data comes from

Customer data comes from you, when you ask us for a quotation, set up your business or contact us.

Employee data comes from the employer, from the employee where they enter it themselves, and from the phone or computer the employee uses when clocking in.

6. Why we use it

• To provide the service you or your employer subscribes to.
• To sign you in and keep accounts secure.
• To set up a new business, and to give support when the business asks for it.
• To bill customers and keep accounting records.
• To find and fix faults.
• To tell customers about changes, outages and security matters.
• To meet our legal obligations, including tax and data protection law.

We do not sell personal data. We do not use it for advertising. We do not use it to train artificial intelligence systems.

7. Is supplying data obligatory? Your choices

Some data is needed. Karyosa cannot open an account without a name and email address, and cannot record attendance without a clock-in time. Without them we cannot provide the service.

Other data is up to you or your employer. Location and photograph at clock-in are settings your employer chooses. If your employer has switched them on, that is a condition of your work there, not of our service; take it up with your employer.

To limit what is processed, a customer can switch modules and settings off, or remove records. An employee can ask their employer. A customer can also ask us, at the contact in section 1, to stop processing their own data, or to stop sending anything other than service messages.

8. Who can see it, and who we disclose it to

Inside your business, each person sees only what their role allows. One business can never see another business's data.

Karyosa staff do not browse customer data. We can open a business only:

• During setup, for up to 40 days after the business is created, to set up its settings, goals and stock list. This window closes by itself.
• For support, when the owner switches support access on, for up to 7 days at a time. The owner can switch it off at any time.

Even then, Karyosa staff cannot open payroll, payslips, claims, medical certificates or staff letters.

Outside services we use:

• Google LLC. Its Firebase and Google Cloud services sign people in, store the data, and send the sign-in emails. Data is stored in Singapore (asia-southeast1).
• Google Fonts, also from Google. If a business picks a typeface that is not built into Karyosa, the browser fetches it from Google, which sees the browser's internet address.
• ipify (api.ipify.org). Only if the employer turns on the "company Wi-Fi" check, the browser asks ipify for its public internet address at clock-in, so Karyosa can compare it with the business's own. The address is not stored.
• Map links, where a business adds one, open in Google Maps only when you choose to tap them.

We also disclose data to our professional advisers (accountant, auditor, lawyer) where they need it; to a public authority where the law requires it or a court orders it; and to a buyer of our business, if Karyosa is ever sold, under the same obligations as this notice.

We use no payment processor. Fees are paid by bank transfer or DuitNow directly to us.

9. Transfer outside Malaysia

The data is stored in Singapore, which has its own personal data protection law, the Personal Data Protection Act 2012. Google may also support the service from other countries, under its data protection terms with us. Section 129 of the Act allows a transfer to a place with a law substantially similar to ours, or with adequate protection, and also where the person consents. By using Karyosa you consent to this transfer.

10. How long we keep it

• While the subscription is active, and for 3 months after it ends, read-only, so that a business can download a final backup. Then the data is deleted.
• A free trial that did not become a subscription: kept read-only for 3 months, then deleted.
• Clock-in photographs and photographs given as proof of work: 40 days, then deleted automatically. The record they belonged to is kept.
• Our own billing and tax records: 7 years, as Malaysian tax law requires.

Within a subscription, the employer decides how long to keep its staff records, and can delete them. Employment law asks employers to keep some records, such as pay and attendance, for a number of years.

11. Your rights

You may ask us to:

• give you a copy of your personal data;
• correct it if it is wrong or out of date;
• send it to you, or to another data controller, in a common format where that is technically possible (data portability);
• stop processing that is likely to cause you damage or distress;
• withdraw your consent;
• delete data we no longer need to keep.

Write to hello@karyosa.com. We answer requests to see or correct your data within 21 days, as the Act requires. There is no fee for a reasonable request. If we refuse a request, we tell you why.

If you are unhappy with our answer, you may complain to the Personal Data Protection Commissioner, Malaysia.

12. If you are an employee of a customer

Your employer controls your data, so send requests to see, correct, export or delete it to your employer. Inside Karyosa you can already see your own attendance, leave, claims and payslips, and download your payslips.

If you send a request to us, we pass it to your employer within 7 days, tell you we have done so, and help them answer it. We will not change or delete an employer's records on the instruction of their employee, except where the law requires us to.

13. Security and data breaches

Data is encrypted in transit and at rest. Every read and write is checked against rules that let each person reach only what their role allows. Karyosa staff access is limited and time-bound, as section 8 explains, and changes in a business are kept in its history.

No system is completely secure, and we do not claim otherwise. If a personal data breach happens:

• We tell the affected business promptly, and in any case within 24 hours of finding out.
• Where we are the data controller, we notify the Personal Data Protection Commissioner within 72 hours, and the people affected within 7 days after that if the breach is likely to cause them significant harm, as the Act requires.
• We keep a record of every breach.

14. Browser storage

Karyosa does not use advertising or tracking cookies. Your browser keeps your sign-in so you stay signed in, whether you chose "stay signed in", when a verification email was last sent, and small display choices, such as which tips and notes you have closed. Nothing else is stored in the browser.

15. Changes

We may update this notice. We will tell customers by email at least 14 days before a material change takes effect, and publish the new version at karyosa.com/policy.

Notis Privasi

Versi 1.0, 21 October 2026. Juga dalam bahasa Inggeris; tiada versi yang mengatasi yang lain.

1. Siapa kami

Karyosa ialah perisian pengurusan perniagaan yang dikendalikan oleh Karyosa Software Management, no. pendaftaran 202603249372 (PG0593552-V), beralamat di Eco Grandeur, 42300 Bandar Puncak Alam, Selangor ("Karyosa", "kami").

Untuk sebarang pertanyaan mengenai notis ini atau data peribadi anda, hubungi pegawai perhubungan perlindungan data kami di hello@karyosa.com atau melalui WhatsApp di +6019-6789501.

2. Dua hubungan yang berbeza

Notis ini meliputi orang dalam dua kedudukan yang berbeza, dan perbezaan itu penting.

Jika anda pelanggan kami (pemilik atau pentadbir perniagaan yang melanggan Karyosa), kami memegang data peribadi anda sebagai pengawal data dan menentukan cara ia digunakan.

Jika anda pekerja kepada pelanggan kami (kakitangan, penyelia, lokum atau kontraktor yang majikannya menggunakan Karyosa), majikan anda ialah pengawal data. Majikan yang menentukan apa yang dikumpul dan untuk apa. Kami memegang data itu sebagai pemproses data, hanya mengikut arahan majikan anda, dan kami tidak menggunakannya untuk tujuan kami sendiri. Seksyen 12 menerangkan maksudnya bagi anda.

3. Data peribadi yang kami pegang

Mengenai pelanggan: nama, alamat emel, nombor telefon, nama, alamat dan nombor pendaftaran perniagaan, modul dan pelan yang diambil, sebut harga, invois dan rujukan pembayaran, serta surat-menyurat dengan kami.

Mengenai pekerja pelanggan, seperti yang dimasukkan oleh majikan atau pekerja itu sendiri:

• Identiti dan perhubungan: nama, alamat emel, jawatan dan peranan, nombor pekerja, nombor kad pengenalan atau pasport, umur, dan gambar profil jika ditambah.
• Pekerjaan: tarikh mula bekerja, surat tawaran dan surat kakitangan lain (termasuk surat tatatertib dan jawapan kepadanya), tandatangan, polisi yang dibaca dan ditandatangani, jadual kerja, dan tugasan.
• Kehadiran: waktu masuk dan keluar kerja, lokasi semasa masuk dan keluar kerja serta jarak dari tempat kerja, gambar semasa masuk kerja jika majikan mengaktifkannya, dan sebarang sebab yang diberi kerana lewat.
• Gaji: gaji, elaun, kerja lebih masa, insentif, tuntutan dan resitnya, slip gaji, nama bank dan nombor akaun, nombor KWSP, PERKESO dan cukai pendapatan, serta butiran keluarga untuk pelepasan cukai (status perkahwinan, sama ada pasangan bekerja, bilangan anak).
• Cuti: permohonan cuti dan sijil cuti sakit.
• Prestasi: sasaran, markah, dan gambar sebagai bukti kerja.
• Lokum dan kontraktor: perjanjian dan invois.
• Pembelian: nama kakitangan yang membayar stok dengan wang sendiri, dan bila wang itu dibayar balik. Invois pembekal, serta gambar atau PDF invois itu, disimpan sebagai rekod perniagaan.

Mengenai orang lain, jika majikan merekodkannya: contohnya nama atau nombor telefon pesakit atau pelanggan yang dikaitkan dengan insentif. Majikan juga bertanggungjawab atas data itu.

Rekod yang disimpan oleh perisian itu sendiri: sejarah perubahan dalam perniagaan (siapa membuat apa, dan bila), dan log ralat (ralat, halaman, dan siapa yang log masuk) supaya kami dapat membaiki kerosakan. Karyosa tidak menyimpan alamat internet atau butiran peranti anda. Google, yang menempatkan perkhidmatan ini, menyimpan log teknikalnya sendiri (lihat seksyen 8).

Karyosa dibuat untuk perniagaan dan kakitangannya yang bekerja, bukan untuk kanak-kanak.

4. Data peribadi sensitif

Sijil cuti sakit, dan tuntutan rawatan perubatan, menunjukkan maklumat tentang kesihatan seseorang. Undang-undang menganggapnya sebagai data peribadi sensitif. Majikan hanya boleh memegangnya dengan persetujuan nyata pekerja, atau jika ia perlu bagi hak atau kewajipan yang diberi oleh undang-undang pekerjaan kepada majikan, seperti meluluskan cuti sakit. Dalam Karyosa, hanya orang itu sendiri dan mereka yang dibenarkan majikan mengurus gaji boleh membukanya.

Gambar semasa masuk kerja tidak digunakan untuk pengecaman wajah.

5. Sumber data

Data pelanggan diperoleh daripada anda, semasa anda meminta sebut harga, menyediakan perniagaan anda atau menghubungi kami.

Data pekerja diperoleh daripada majikan, daripada pekerja itu sendiri jika dia memasukkannya, dan daripada telefon atau komputer yang digunakan pekerja semasa merekod kehadiran.

6. Tujuan penggunaan

• Menyediakan perkhidmatan yang dilanggan oleh anda atau majikan anda.
• Melog masuk anda dan menjaga keselamatan akaun.
• Menyediakan perniagaan baharu, dan memberi sokongan apabila perniagaan memintanya.
• Mengeluarkan bil dan menyimpan rekod perakaunan.
• Mengesan dan membaiki kerosakan.
• Memaklumkan pelanggan tentang perubahan, gangguan dan hal keselamatan.
• Memenuhi kewajipan undang-undang kami, termasuk undang-undang cukai dan perlindungan data.

Kami tidak menjual data peribadi. Kami tidak menggunakannya untuk pengiklanan. Kami tidak menggunakannya untuk melatih sistem kecerdasan buatan.

7. Adakah pemberian data wajib? Pilihan anda

Sesetengah data diperlukan. Karyosa tidak dapat membuka akaun tanpa nama dan alamat emel, dan tidak dapat merekod kehadiran tanpa waktu masuk. Tanpanya kami tidak dapat menyediakan perkhidmatan ini.

Data lain bergantung kepada anda atau majikan anda. Lokasi dan gambar semasa masuk kerja ialah tetapan pilihan majikan. Jika majikan mengaktifkannya, ia adalah syarat pekerjaan anda di situ, bukan syarat perkhidmatan kami; sila bincang dengan majikan anda.

Untuk mengehadkan pemprosesan, pelanggan boleh mematikan modul dan tetapan, atau membuang rekod. Pekerja boleh meminta majikannya. Pelanggan juga boleh meminta kami, melalui hubungan di seksyen 1, supaya berhenti memproses data mereka sendiri, atau berhenti menghantar apa-apa selain mesej perkhidmatan.

8. Siapa yang boleh melihatnya, dan kepada siapa kami mendedahkannya

Dalam perniagaan anda, setiap orang hanya melihat apa yang dibenarkan oleh peranannya. Sesebuah perniagaan tidak boleh melihat data perniagaan lain.

Kakitangan Karyosa tidak melayari data pelanggan. Kami hanya boleh membuka sesebuah perniagaan:

• Semasa penyediaan, sehingga 40 hari selepas perniagaan dibuka, untuk menyediakan tetapan, sasaran dan senarai stoknya. Tempoh ini tamat dengan sendirinya.
• Untuk sokongan, apabila pemilik menghidupkan akses sokongan, sehingga 7 hari setiap kali. Pemilik boleh mematikannya pada bila-bila masa.

Walaupun begitu, kakitangan Karyosa tidak boleh membuka gaji, slip gaji, tuntutan, sijil cuti sakit atau surat kakitangan.

Perkhidmatan luar yang kami gunakan:

• Google LLC. Perkhidmatan Firebase dan Google Cloud-nya melog masuk pengguna, menyimpan data, dan menghantar emel log masuk. Data disimpan di Singapura (asia-southeast1).
• Google Fonts, juga daripada Google. Jika perniagaan memilih jenis huruf yang tidak terbina dalam Karyosa, pelayar mengambilnya daripada Google, yang dapat melihat alamat internet pelayar itu.
• ipify (api.ipify.org). Hanya jika majikan menghidupkan semakan "Wi-Fi syarikat", pelayar bertanya kepada ipify alamat internet awamnya semasa masuk kerja, supaya Karyosa dapat membandingkannya dengan alamat perniagaan. Alamat itu tidak disimpan.
• Pautan peta, jika perniagaan menambahnya, hanya dibuka dalam Google Maps apabila anda memilih untuk menekannya.

Kami juga mendedahkan data kepada penasihat profesional kami (akauntan, juruaudit, peguam) jika mereka memerlukannya; kepada pihak berkuasa awam jika dikehendaki undang-undang atau diperintahkan mahkamah; dan kepada pembeli perniagaan kami, sekiranya Karyosa dijual, tertakluk kepada kewajipan yang sama seperti notis ini.

Kami tidak menggunakan pemproses pembayaran. Yuran dibayar melalui pindahan bank atau DuitNow terus kepada kami.

9. Pemindahan ke luar Malaysia

Data disimpan di Singapura, yang mempunyai undang-undang perlindungan data peribadinya sendiri, iaitu Personal Data Protection Act 2012. Google juga mungkin menyokong perkhidmatan ini dari negara lain, di bawah terma perlindungan datanya dengan kami. Seksyen 129 Akta membenarkan pemindahan ke tempat yang mempunyai undang-undang yang pada dasarnya serupa dengan undang-undang kita, atau perlindungan yang mencukupi, dan juga jika orang itu bersetuju. Dengan menggunakan Karyosa, anda bersetuju dengan pemindahan ini.

10. Tempoh penyimpanan

• Sepanjang langganan aktif, dan selama 3 bulan selepas ia tamat secara baca sahaja, supaya perniagaan boleh memuat turun sandaran terakhir. Selepas itu data dipadam.
• Percubaan percuma yang tidak menjadi langganan: disimpan baca sahaja selama 3 bulan, kemudian dipadam.
• Gambar semasa masuk kerja dan gambar bukti kerja: 40 hari, kemudian dipadam secara automatik. Rekod yang berkaitan dengannya dikekalkan.
• Rekod bil dan cukai kami sendiri: 7 tahun, seperti dikehendaki undang-undang cukai Malaysia.

Sepanjang langganan, majikan menentukan berapa lama rekod kakitangannya disimpan, dan boleh memadamnya. Undang-undang pekerjaan menghendaki majikan menyimpan sesetengah rekod, seperti gaji dan kehadiran, selama beberapa tahun.

11. Hak anda

Anda boleh meminta kami:

• memberikan salinan data peribadi anda;
• membetulkannya jika salah atau tidak terkini;
• menghantarnya kepada anda, atau kepada pengawal data lain, dalam format biasa jika ia boleh dilakukan secara teknikal (kemudahalihan data);
• menghentikan pemprosesan yang berkemungkinan menyebabkan kerosakan atau kesusahan kepada anda;
• menarik balik persetujuan anda;
• memadam data yang tidak perlu lagi kami simpan.

Tulis kepada hello@karyosa.com. Kami menjawab permohonan untuk melihat atau membetulkan data anda dalam tempoh 21 hari, seperti dikehendaki Akta. Tiada bayaran bagi permohonan yang munasabah. Jika kami menolak sesuatu permohonan, kami akan memberitahu sebabnya.

Jika anda tidak berpuas hati dengan jawapan kami, anda boleh mengadu kepada Pesuruhjaya Perlindungan Data Peribadi, Malaysia.

12. Jika anda pekerja kepada pelanggan kami

Majikan anda mengawal data anda, jadi hantar permohonan untuk melihat, membetulkan, mengeksport atau memadam data anda kepada majikan. Dalam Karyosa, anda sudah boleh melihat kehadiran, cuti, tuntutan dan slip gaji anda sendiri, dan memuat turun slip gaji anda.

Jika anda menghantar permohonan kepada kami, kami akan menyerahkannya kepada majikan anda dalam tempoh 7 hari, memaklumkan anda, dan membantu majikan menjawabnya. Kami tidak akan mengubah atau memadam rekod majikan atas arahan pekerjanya, kecuali jika dikehendaki undang-undang.

13. Keselamatan dan pelanggaran data

Data disulitkan semasa penghantaran dan semasa disimpan. Setiap bacaan dan tulisan disemak mengikut peraturan yang membenarkan setiap orang mencapai apa yang dibenarkan oleh peranannya sahaja. Akses kakitangan Karyosa adalah terhad dan bertempoh, seperti diterangkan di seksyen 8, dan perubahan dalam sesebuah perniagaan disimpan dalam sejarahnya.

Tiada sistem yang selamat sepenuhnya, dan kami tidak mendakwa sebaliknya. Jika berlaku pelanggaran data peribadi:

• Kami memaklumkan perniagaan yang terjejas dengan segera, dan dalam apa jua keadaan dalam tempoh 24 jam selepas mengetahuinya.
• Jika kami pengawal data, kami memaklumkan Pesuruhjaya Perlindungan Data Peribadi dalam tempoh 72 jam, dan individu yang terjejas dalam tempoh 7 hari selepas itu jika pelanggaran itu berkemungkinan menyebabkan kemudaratan ketara kepada mereka, seperti dikehendaki Akta.
• Kami menyimpan rekod setiap pelanggaran.

14. Storan pelayar

Karyosa tidak menggunakan kuki pengiklanan atau penjejakan. Pelayar anda menyimpan log masuk anda supaya anda kekal log masuk, sama ada anda memilih "kekal log masuk", bila emel pengesahan terakhir dihantar, dan pilihan paparan kecil, seperti petua dan nota yang telah anda tutup. Tiada perkara lain disimpan dalam pelayar.

15. Perubahan

Kami boleh mengemas kini notis ini. Pelanggan akan dimaklumkan melalui emel sekurang-kurangnya 14 hari sebelum perubahan penting berkuat kuasa, dan versi baharu diterbitkan di karyosa.com/policy.

Terms of Service

Version 1.0, effective 21 October 2026.

1. Who these terms are between

These terms are an agreement between Karyosa Software Management, registration no. 202603249372 (PG0593552-V), of Eco Grandeur, 42300 Bandar Puncak Alam, Selangor ("Karyosa", "we", "us") and the business that subscribes to the service ("you", "your business").

By accepting our quotation, or by using Karyosa, you accept these terms on behalf of your business. If you are not authorised to bind your business, do not proceed.

2. What the service is

Karyosa is software for managing staff records and letters, attendance, leave, payroll and claims, performance goals, tasks, inventory, expenses, locums and contractors, statutory deadlines and related business administration. It is provided over the internet. Nothing is installed on your premises.

Features change over time. We may add, alter or withdraw a feature. Where withdrawing a feature would materially reduce what you are paying for, we will give you 30 days' notice and you may cancel for a pro-rata refund of the unused period.

3. Your account

You are responsible for everything done through your account, including by your staff.

Keep passwords confidential. Tell us at hello@karyosa.com or on WhatsApp at +6019-6789501 as soon as you suspect an account has been compromised.

You must give us accurate business details and keep them current. One subscription covers one business. You may not share an account between separate businesses.

4. Your people and your data

Your business data belongs to your business. We do not claim ownership of it.

You grant us permission to store and process it only so far as is needed to run the service for you, to keep it secure, and to support you when you ask.

You are responsible for what you put in. In particular:

• You must have a lawful basis for collecting your employees' personal data, and you must tell them what you collect and why. We provide the software; the employment relationship is yours.
• If you switch on location recording or photograph capture at clock-in, you must inform your staff and comply with employment and data protection law in doing so.
• Medical certificates and medical claims are sensitive personal data. You must have your staff's explicit consent to hold them, or another basis that section 40 of the Personal Data Protection Act 2010 allows.
• If you record details of your own patients or customers (for example against an incentive), you must be entitled to do so.
• You must not put into Karyosa any data you are not entitled to hold, and must not use it to monitor people unlawfully.

5. Personal data we process for you

For the personal data of your staff and others that you put into Karyosa, you are the data controller and we are your data processor. We will:

• process it only to provide the service to you, on your instructions, and never for our own purposes;
• keep it secure, as section 9 of the Act requires of us, and let our staff reach it only as the Privacy Notice section 8 describes: during the 40-day setup window, or while you have support access switched on;
• use only the outside services named in the Privacy Notice, and tell you 30 days before adding a new one that would receive your data, so you can object or cancel;
• tell you promptly, and in any case within 24 hours, after we find a personal data breach affecting your data, with what we know, so you can meet your own duty to notify the Commissioner within 72 hours;
• help you answer requests from your staff to see, correct or move their data;
• delete your data when it is no longer kept under the Privacy Notice, after giving you the chance to download a final backup under clause 10.

Storing your data in Singapore is a transfer outside Malaysia. You confirm that you have told your staff, as the Privacy Notice section 9 explains.

6. Support and availability

We aim to keep Karyosa available at all times, but we do not promise uninterrupted service. Planned maintenance will be notified in advance where practicable.

Support is by email at hello@karyosa.com or WhatsApp at +6019-6789501 during Monday to Friday, 9am to 6pm (Malaysian time), excluding public holidays. We aim to respond within 2 working days. Response targets are aims, not guarantees, unless a separate written service level agreement says otherwise.

New subscribers receive 40 days of setup assistance from the date the account is created. During that time we can set up your business settings, goals and stock list for you. After that, we can open your business only when you switch support access on, for up to 7 days at a time.

7. Free trial

New businesses may use Karyosa free for 30 days from the day the account is created. The trial is the full service; no payment details are needed to start one.

At the end of the trial, if you have not subscribed, your account becomes read-only. You keep access to everything already entered and you may export it at any time, but nothing further can be added. We do not delete anything because a trial ended. A read-only account is kept, and deleted only as set out in clause 10 and the Privacy Notice.

One trial per business.

8. Fees

Fees are in Malaysian Ringgit and are payable in advance, either yearly or monthly.

The amounts are the ones in the quotation we give you, not in these terms. What you pay depends on what you take: the whole of Karyosa, or only the modules you choose. Your quotation sets out the fee, how often it is payable, and which modules it covers, and it is part of this agreement. Adding a module later changes the fee from the next renewal, and we will tell you the new amount in writing before you decide.

Your subscription renews automatically for a further period of the same length unless you cancel before it renews.

A one-off setup and training fee, also quoted to you, is payable before your account is set up. It covers configuring Karyosa for your business and training your people. It is charged once, whatever you take, is separate from the subscription fee, and is not refundable once the setup work has begun.

Fees exclude any applicable tax, which is added if it applies.

We may change prices on 30 days' written notice. A price change takes effect at your next renewal. If you do not accept it, cancel before renewal.

If a renewal is not paid. Your subscription runs until the date it is paid up to. If payment has not reached us by then, your account stays fully usable for a further 14 days. After that, and until payment is received, your account becomes read-only: you and your people can still open everything and export all of it, but nothing further can be entered. We do not delete anything, and we do not withhold your data, at any point. Access is restored as soon as payment is recorded.

9. Cancelling

You may cancel at any time. Cancellation takes effect at the end of the period you have paid for, and your subscription is not renewed.

Fees already paid are not refunded. Because fees are paid in advance, this means that if you cancel part way through a period, whether yearly or monthly, you keep full access until that period ends, but no part of the fee is returned. The setup and training fee is not refundable either. The 30-day free trial in clause 7 is there so that you can decide whether Karyosa suits you before any money changes hands.

If we end it, we refund. If we terminate your subscription on notice, or we stop providing Karyosa altogether, we refund the unused full months of the period you have paid for, within 30 days. This does not apply to the setup and training fee, which pays for work already done. If we withdraw a material feature under clause 2 and you cancel because of it, the same refund applies.

We may terminate immediately, and without refund, if you use Karyosa unlawfully, or in a way that harms the service or other customers.

10. Backups and getting your data out

Keeping a backup is your responsibility. The Backup button in Karyosa downloads all of your records in one file, including photos and uploaded files. Download a backup at least once a month, and before each payroll run, and keep it somewhere safe: it holds your staff's personal data. Karyosa reminds the owner when the last backup is more than 30 days old.

Restoring. The Restore button puts back your business details, outlets, goals, scores, stock list, purchases and stock counts at any time. To put back everything else exactly as it was, including payslips, letters and signatures, ask us to open a 24-hour restore window; you then run the restore yourself. Opening the window is recorded in your History.

We take reasonable care to protect your data, as clause 5 and the Privacy Notice describe, but we do not promise that lost or damaged data can be restored. To the extent the law allows, we are not liable for data you could have restored from your own backup.

When your subscription ends, your account stays read-only for 3 months, so that you can download a final backup yourself. We do not prepare exports for you. After that period, your data is deleted in line with the Privacy Notice, and cannot be recovered.

11. What we do not promise

Karyosa is provided as it is. To the extent the law allows, we exclude warranties that are not expressly stated here.

In particular, Karyosa is not a substitute for professional advice. Calculations for payroll, statutory contributions, tax and compliance deadlines are provided as an aid. You remain responsible for checking figures and dates against the requirements of KWSP, PERKESO, LHDN, SSM and any other authority before you rely on or submit them. We are not your accountant, your company secretary or your lawyer.

Invoices, letters and templates produced by Karyosa are drafting aids. Have a professional review anything with legal effect before you use it.

12. Our liability

Nothing in these terms limits liability for death or personal injury caused by negligence, for fraud, or for anything that cannot lawfully be limited.

Subject to that, our total liability to you for all claims in any 12-month period is limited to the fees you paid us in the 12 months before the claim arose.

We are not liable for loss of profit, loss of business, loss of goodwill, or for any penalty, fine or additional tax imposed on you by an authority, however it arises.

13. Your liability to us

You will indemnify us against claims brought against us by your employees or third parties arising from your use of Karyosa, except where the claim arises from our own breach of this agreement.

14. If we get it wrong

If we materially breach these terms and do not put it right within 30 days of your written notice, you may terminate and receive a refund of the unused period.

15. Confidentiality

Each of us will keep the other's confidential information confidential, and use it only for this agreement. This does not apply to information that is public, already known, or that the law requires be disclosed.

16. Changes to these terms

We may change these terms. We will give customers 30 days' notice by email of any material change. If you do not accept it, you may cancel before it takes effect. Continuing to use Karyosa after that date means you accept the change.

17. General

Assignment. You may not transfer this agreement without our written consent. We may transfer it to a buyer of our business.

Whole agreement. These terms, your quotation and the Privacy Notice are the whole agreement between us.

Severance. If a clause is unenforceable, the rest stands.

Governing law. The laws of Malaysia. The courts of Malaysia have exclusive jurisdiction.

Notices. To us, at hello@karyosa.com. To you, at the email address on your account.