Privacy Notice

1. Who we are

This portal is operated by JK Klang Recycle Sdn Bhd (Reg. No. 200601026946 / 746701-K), of Lot 2742, Jalan Haji Sirat, Off Jalan Meru, 41050 Klang, Selangor, Malaysia ("we", "us"). We are the data controller in respect of the personal data described below. This notice explains what personal data the portal collects, why we collect it, who it is disclosed to, and how you may request access to or correction of it.

2. Personal data we collect

The portal stores only the data needed to run client and staff accounts and to keep an audit trail of what was recorded:

• Client account records — company name, client code, login email address, the name and phone number of the person in charge (PIC) at the client, and the client's logo.
• Client access credentials — the security PIN is never stored in readable form. It is held only as a one-way bcrypt hash and is compared inside the database, so the hash is not sent to the browser during login. We also record failed login attempts and account lockouts.
• Staff account records — name, username, email address, role and active status. The password is stored only as a one-way bcrypt hash.
• Administrator accounts — email address, full name and password, held in our authentication provider's user directory (see section 4).
• Audit trail — for each recorded action: the name, email address and role of the person who performed it, the type of action, the record affected, a short description, and the date and time. The portal provides no function for users to edit or delete audit entries.
• Internal messages and entry comments — the sender's name, role and email address, and the text of the message.
• Session data on your own device — when you log in, your browser's local storage holds your session record (including your name, email address, PIC name and phone number where applicable, and a session token) so that you stay signed in. It is cleared when you log out.

The portal itself does not store IP addresses or device identifiers (our hosting provider and the QR service in section 4 may process IP addresses as part of normal web traffic), we set no cookies, and we run no analytics, advertising or behavioural-tracking scripts. The waste, tonnage and carbon figures in the portal are business records of a company, not personal data.

3. Why we collect it

• To verify that whoever signs in is an authorised client or member of staff.
• To produce and issue the ESG and Scope 3 reports and certificates you request.
• To contact the person in charge at a client about collections, reports or account access.
• To maintain an audit trail so that every figure in a report can be traced to who recorded it.
• To protect the portal against automated abuse — the login form uses a hidden honeypot field, a simple human-verification question, a minimum submission time, and a lockout after repeated failed attempts.

Supplying this data is necessary to hold an account. Without it we cannot give you access to the portal or issue reports to you.

4. Who we disclose it to

We do not sell personal data and we do not share it for marketing. We disclose it only to the service providers that run the portal on our behalf:

• Supabase — hosts the portal's database and authentication. The account records, audit entries and messages described in section 2 are stored there.
• Vercel — hosts and serves the portal application itself.
• api.qrserver.com (goqr.me) — generates the QR code image printed on report certificates. When a certificate is displayed, your browser requests that image directly from this third party, which therefore receives the certificate reference (which contains the client code) together with the ordinary connection details your browser sends to any site it loads an image from, such as your IP address and the referring page. We do not send names, email addresses or phone numbers to this service.

These providers operate infrastructure outside Malaysia, so your personal data may be transferred to, stored in and processed in countries other than Malaysia. We rely on those providers' own contractual and technical safeguards for that processing.

5. How long we keep it

Account records are kept for as long as the account is active, and for 7 years afterwards. Audit trail entries are retained for 7 years so that issued reports remain traceable, and the portal provides no function to edit or delete them. Session data on your own device is deleted when you log out or when your session is ended for inactivity.

6. Security

Client PINs and staff passwords are stored only as one-way bcrypt hashes, and both the hashing and the login check are performed by functions inside the database. The portal does not read the stored hash, so it is not sent to a browser. Every response the portal serves carries headers that tell browsers to use HTTPS on future visits (HTTP Strict Transport Security), refuse to display the portal inside another site's frame, and not guess file types. Each account holds a session token, so signing in again, or clearing that token, signs out any other device still holding the previous one.

7. Your rights: access and correction

Under the Personal Data Protection Act 2010 you may ask us for access to the personal data we hold about you, and you may ask us to correct it if it is inaccurate, incomplete, misleading or out of date. You may also ask us to limit how we process it. Send your request to hq@jkklang.com. We may need to verify your identity before we act on it, and we will respond within the period required by the Act. A data access request may be subject to a prescribed fee.

Note that audit trail entries record what was done in the portal and, for the integrity of issued reports, we do not delete them; a correction is recorded as a new entry rather than by editing the original.

8. Contact us

JK Klang Recycle Sdn Bhd (Reg. No. 200601026946 / 746701-K)
Lot 2742, Jalan Haji Sirat, Off Jalan Meru, 41050 Klang, Selangor, Malaysia
Email: hq@jkklang.com