1. Who we are and when this notice applies
Prospectly is owned and operated by Matrix Connexion Sdn Bhd (Registration No. 200501031455 (713592-P)). This notice explains personal data handling for the Prospectly website, accounts, subscriptions, support and customer communication services. It supplements our corporate privacy notice for these product-specific activities.
We determine the purposes of processing account, billing, security and business enquiry data. For messages, contacts, attachments and business knowledge submitted by a workspace, we generally process personal data on that customer’s instructions. The workspace customer determines why it collects and uses that information and is responsible for its own privacy notices and lawful instructions. These roles depend on the actual processing activity, not simply its label.
2. Information we process and where it comes from
Account and enquiry information may include your name, work email, organisation, account role, contact details, correspondence and authentication information. Billing information may include subscription, invoice, transaction and payment-method references supplied by payment providers. Card entry and payment authorisation are handled through the payment provider’s checkout or payment interfaces.
Workspace content may include customer names, phone numbers, channel identifiers, conversation history, message delivery information, uploaded documents, images, audio and other attachments, knowledge sources, AI instructions and generated responses. What is processed depends on the features enabled and what you and your contacts provide.
Technical records may include IP addresses, browser or device information, timestamps, account activity, security and support logs, usage and error information. We receive information directly from you, your workspace administrators and contacts, connected messaging and AI services, payment providers and the devices accessing the service.
3. Why we process personal data
We process information to create and administer accounts, authenticate users, route and store conversations, provide configured AI and knowledge functions, manage subscriptions and payments, respond to enquiries, provide support, investigate failures or misuse, protect the service, keep appropriate business records and meet legal obligations.
Processing must have a basis permitted by applicable law, including consent where required, performance of a contract or steps requested before a contract, and applicable legal obligations. This notice is not blanket consent for unrelated processing. Where optional communications require consent, you may decline or withdraw it. Service and security notices needed for your account are separate from promotional communications.
Information necessary for authentication, account administration, billing or a requested channel function must be provided to use that function. Optional information can be omitted. If necessary information is withheld or relevant permission withdrawn, we may be unable to provide the affected service; this does not remove unrelated statutory rights.
4. AI, knowledge sources and connected channels
When AI features are enabled, relevant conversation content, instructions, knowledge excerpts and supported attachments may be transmitted to the AI, embedding or media-processing providers used for that function. AI outputs and associated operational records may be stored in the workspace. Connecting your own provider key does not mean information stays within Prospectly or on your device.
Messaging providers receive information needed to connect your account and deliver messages. Providers may process data under their own terms for their independent services. Provider locations, retention and permitted uses vary by configuration and contract. This notice does not promise that every provider has zero retention or excludes all model training. Request information about the intended setup before sending confidential or sensitive material.
Workspace owners should minimise the data sent to AI, review configuration and source permissions, explain automated replies to their contacts where required, and arrange appropriate human oversight. Do not submit sensitive personal data or regulated records without establishing a lawful basis and confirming that the service and provider arrangements are suitable.
6. Processing outside Malaysia
Hosting and connected service providers may process information outside Malaysia. A Malaysian customer account does not imply Malaysian-only data residency. Cross-border transfers must meet the applicable requirements of Malaysian law, including section 129 of the Personal Data Protection Act 2010 where it applies, and any applicable contractual safeguards. Contact us before onboarding if you require specific locations, transfer arrangements or a data-processing agreement; those requirements are not included merely by creating an account.
7. Cookies and browser storage
The service uses browser storage and, where applicable, cookies or similar mechanisms for sign-in, security, preferences and continuity of a chat session. Connected checkout or other third-party pages may use their own cookies under their notices. Blocking or clearing essential storage can sign you out or interrupt a conversation.
This notice does not authorise undisclosed advertising tracking. If optional tracking is introduced, its purposes and any required choices must be provided before it is used.
8. Retention, account closure and security
Information is retained according to its purpose, the customer relationship, applicable legal and accounting requirements, security needs and the resolution of disputes. Closing or disabling an account does not by itself erase every record. Operational data, backups and provider-held copies may have different deletion processes. We do not promise an immediate purge or a fixed universal retention period.
We will address deletion and retention requests under applicable law and the relevant service arrangements. Legal holds or records needed for legitimate legal obligations may limit deletion. Customers should request necessary copies before closing an account and should not rely on Prospectly as their only archive.
We use technical and organisational measures appropriate to the processing risks, including access restrictions and security controls. No internet service is completely risk-free. Where a personal data breach triggers legal notification duties, we will make the notifications required by applicable law. Contact us promptly if you suspect unauthorised access.
9. Your choices, requests and complaints
Subject to applicable law and its exceptions, you may request access to or correction of your personal data, withdraw consent where processing relies on it, ask to prevent or stop direct marketing, and exercise applicable rights concerning processing likely to cause damage or distress or data portability. You may also ask us about retention or deletion. These rights are not all unconditional and are not replaced by the Terms of Service.
Send requests to [email protected] with enough information to identify the relevant account and request. We may need proportionate identity or authority verification and will respond within applicable legal time limits. We will explain any lawful restriction or refusal. Do not send passwords, provider keys or full card information.
If you are messaging one of our business customers, contact that business first because it generally controls your conversation data. We can help identify or route the request where appropriate and assist the customer within our role. You may raise a complaint with Malaysia’s Personal Data Protection Commissioner through pdp.gov.my; contacting us first does not waive that right.
10. Children and information about other people
Prospectly subscriptions are intended for adults managing customer communications. Workspace customers are responsible for any communications involving minors, including required parent or guardian permissions and appropriate safeguards. If you believe personal data of a child has been provided unlawfully, contact us so that the circumstances can be assessed.
11. Changes and contact details
We may update this notice as the service or legal requirements change. The current version is dated above. Material changes will be brought to affected users’ attention where required, and fresh consent will be requested where the law requires it. An update does not retrospectively authorise an incompatible use of personal data.
Privacy enquiries: [email protected]. Postal contact: Privacy enquiries, Matrix Connexion Sdn Bhd, Unit 50-7-7, 7th Floor, Wisma UOA Damansara, 50, Jalan Dungun, Damansara Heights, 50490 Kuala Lumpur, Malaysia. The English and Bahasa Malaysia notices describe the same processing; any discrepancy must be resolved consistently with applicable law.
200501031455 (713592-P)
Unit 50-7-7, 7th Floor, Wisma UOA Damansara, 50, Jalan Dungun, Damansara Heights, 50490 Kuala Lumpur, Malaysia