Privacy Notice

1. Introduction

This Privacy Notice outlines how PalmWav, a platform owned by OpenSys Technologies Sdn. Bhd. (Company Registration No. 200601023409 (743163-T)) (referred to as “OST”, “we”, “our” or “us”), collects, uses and protects your personal data specifically for the PalmWav Production Live System (“PalmWav Live”), which will run until further notice for public usage.

For the purposes of this Privacy Notice, “Processing” means any operation performed on personal data, including collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, erasure or destruction.

All Processing is conducted in accordance with the Malaysian Personal Data Protection Act 2010 and the Personal Data Protection (Amendment) Act 2024 (collectively, the “PDPA”), and other applicable Malaysian laws.

By participating in the PalmWav Live, you acknowledge and consent to the Processing of your personal data as described herein. OST is committed to ensuring transparency and safeguarding your privacy throughout the limited duration of this trial.

2. Scope

The PalmWav Live is conducted for evaluation, testing and public usage purposes. This includes testing the biometric authentication and payment system, obtaining user feedback to improve system usability, evaluating potential operational deployment feasibility and providing a platform for public use after successful trial.

Your participation is voluntary, and your Personal Data will be used only for the PalmWav Live evaluation.

3. Category of Personal Data Processed

We collect the following information for registration, identity verification and system testing during the PalmWav Live:

• Basic and Contact Information: Name, NRIC, passport, date of birth, gender, email address, home address and contact number.
• Biometric Data: Palm vector (classified as ‘Sensitive Personal Data’ under the PDPA).
• Authentication Logs: Timestamps and transaction IDs generated during biometric testing.

Note: If you do not provide this mandatory Personal Data, we may not be able to include you in the PalmWav Live.

4. Methods of Data Collection

Your Personal Data is collected:

• Directly from you during registration;
• From biometric scanning devices used during PalmWav Live activities; and
• Through voluntary feedback forms, surveys or communications with OST representatives.

5. Purpose of Processing

We use the Personal Data collected during the PalmWav Live for the following purposes:

• To verify participant identity and ensure secure access;
• To test and validate PalmWav’s biometric recognition technology;
• To analyse technical performance and system reliability;
• To collect your feedback for service improvement;
• To comply with the PDPA and security standards.

Your Personal Data will not be used for marketing, profiling or any unrelated commercial purposes during or after the PalmWav Live.

6. Personal Data Disclosure and Access

Your Personal Data will be kept confidential and accessed only by:

• Authorised OST employees who involved in the PalmWav project;
• Third-party service providers supporting biometric device integration or secure Personal Data storage, who are legally bound to maintain confidentiality; and
• Regulatory or law enforcement authorities where required by law.

We will not sell, rent or share your Personal Data to any other third parties for commercial gain.

7. Consent and Withdrawal

By participating in the PalmWav Live and providing your Personal Data, you give consent for it to be Processed as described herein, including Sensitive Personal Data (biometric data).

You may withdraw your consent at any time by contacting us (see Section 12). If you withdraw your consent, we will stop your participation and any Personal Data collected will be securely deleted or anonymised in accordance with Section 9.

8. Data Accuracy

You are responsible for ensuring that all Personal Data you provide is accurate and up to date.

9. Data Security, Retention and Deletion

OST implements appropriate technical, organisational and physical safeguards to protect Personal Data from unauthorised access, modification, disclosure or loss.

All Personal Data will be kept for the duration of the PalmWav Live period.

Thereafter, all identifiable Personal Data will be securely deleted or anonymised, unless required to be retained for legal or regulatory purposes.

10. Your Rights

You may request access to, correction of, or deletion of your Personal Data at any time during the PalmWav Live by contacting us (see Section 12). We will respond within three (3) working days in accordance with the PDPA.

11. Personal Data Breach Management

If there is any actual or suspected Personal Data breach involving your Personal Data, we shall take all reasonable and appropriate measures in accordance with the PDPA and applicable internal policies.

If a breach occurs, OST will:

• Assess the situation to understand its scope and impact;
• Implement necessary remedial actions to mitigate any potential risk or harm;
• Where applicable, notify the Personal Data Protection Commissioner (“Commissioner”) no later than seventy-two (72) hours after becoming aware of the breach; and
• Notify you without delay if the breach is likely to result in significant harm to your rights or interests, (within seven (7) days after notification to the Commissioner), providing sufficient details, including:
  • The category of the Personal Data affected;
  • The likely consequences of the breach; and
  • The measures taken or proposed to be taken to address and mitigate the impact of the breach.

We keep records of all Personal Data breaches for at least two (2) years and continuously improve our safeguards to prevent similar incidents.

12. Contact Us

If you have questions about this Privacy Notice or wish to exercise your rights, please contact us at: ops-support@palmwav.my

13. Changes to the Privacy Notice

We may update this Privacy Notice periodically. Participants are encouraged to regularly check our website at https://palmwav.my/legal/privacy-policy for any updates. Continued participation will be considered as acceptance of the most recent version of this Privacy Notice.

Last Updated: 12 February 2026