Last updated: 22 October 2026
This Privacy Policy explains how the IXI Group of Companies, comprising IXI Solutions Sdn. Bhd. (201401024550) and IXI Creatives Sdn. Bhd. (202101029185) (“IXI”, “we”, “us”), collects, uses, stores and discloses personal data, in line with the Personal Data Protection Act 2010 of Malaysia as amended by the Personal Data Protection (Amendment) Act 2024 (the “PDPA”).
It applies to ixi.my, helpdesk.ixi.my, our telephone, email, WhatsApp and social media channels, and our training enquiry and recruitment activities. It applies to individuals only.
It does not govern personal data that our clients store in systems we build or support for them. For that data, see section 3.
By using our website, contacting us or giving us your personal data, you agree to the collection and use described in this policy, including our Cookies Policy. You may withdraw your consent at any time, as described in section 14, although this may affect our ability to respond to you or provide services.
IXI as data controller. We decide why and how we use personal data we collect for our own purposes: website visitors, enquiries, business contacts, training enquirers, job applicants, and the contact persons of our clients and partners.
IXI as data processor. When a client uses an IXI system to manage its own users’ or customers’ data, the client is the data controller and IXI processes that data only on the client’s documented instructions, under our Client Data Processing Terms. If you are an end user of a client’s system and want to access, correct or delete your data, please contact that client. If you contact us, we will refer your request to the client.
Our website does not intentionally collect biometric, health or other sensitive personal data. Please do not include such information in forms, emails or CVs unless we specifically ask for it.
Directly from you (forms, WhatsApp, email, phone, meetings); automatically through cookies when you visit our website; and from third parties such as your employer, referrers or JobStreet, where lawful.
We do not send newsletters or marketing emails. If we start, we will update this policy and give you the choice to opt out.
Internal use. We use Microsoft 365 Copilot, a paid business plan within Microsoft 365 Business Premium, to support our staff in their work. Microsoft’s documented privacy and compliance controls apply to that service. Our staff do not enter client personal data into Copilot.
AI Automation for clients. In AI Automation projects, the AI model depends on the project. The model and its provider are agreed with each client in the project documentation.
We use Google Analytics to understand how visitors use our website, and Google Ads conversion tracking to measure whether visits from our ads lead to enquiries. We do not use remarketing or Google Signals on ixi.my. See our Cookies Policy.
We share personal data only as needed for the purposes above, with:
We do not sell personal data.
Our website is hosted in Malaysia. Some services we use, such as Google, WhatsApp and Microsoft, may process data outside Malaysia. We transfer personal data outside Malaysia only where the destination has a law substantially similar to the PDPA or ensures an equivalent level of protection, or where the PDPA otherwise permits. Client systems are hosted in the client’s own cloud environment or a hybrid setup, and their locations are agreed project by project.
We take practical steps to protect personal data against loss, misuse, unauthorised access, disclosure, alteration or destruction. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.
If a personal data breach occurs, we will assess it and, where the PDPA requires, notify the Personal Data Protection Commissioner and affected individuals. For client data we process, we will notify the client as set out in our Client Data Processing Terms.
We keep personal data only as long as needed for the purpose it was collected for and then delete or anonymise it. Website enquiries, training enquiries and unsuccessful job applications are kept for 24 months. Business contact records and other data collected through our website are kept for up to 5 years. Client data is kept according to each client’s agreement with us.
Subject to the PDPA, you may ask us to give you access to your personal data, correct it, limit its processing, withdraw your consent, and, where it applies, transfer a copy of it to you or another organisation (data portability). To make a request, email [email protected] with your name, contact details and what you are asking for. We may need to verify your identity. We aim to respond within the time required by the PDPA. If we cannot comply, we will explain why. You may also complain to the Personal Data Protection Commissioner.
Requests about data held in a client’s system should go to that client (see section 3).
Our website embeds Google Maps in the footer and links to services such as WhatsApp, LinkedIn and Facebook. Their own privacy policies apply to what they collect.
Our website and services are for businesses and are not directed at children under 18. We do not knowingly collect personal data from them.
We may update this policy from time to time. We will post the updated version here with a new “Last updated” date and, for material changes, give notice by other appropriate means.
Last updated: 22 October 2026
Cookies are small text files placed on your device when you visit a website. They help the site work, remember your settings and show the site owner how it is used. Similar technologies, such as pixels and local storage, work in comparable ways, and we refer to all of them as “cookies” here.
Our website ixi.my uses:
We do not use remarketing or Google Signals on ixi.my. Information about ad clicks and form submissions is shared with Google for conversion measurement.
We may update this policy and will post changes here with a new date.
Questions about cookies: [email protected]. See also our Privacy Policy.
Last updated: 22 October 2026
These terms apply where IXI processes personal data on behalf of a client in providing software, implementation, support or other services. They form part of the agreement between IXI and the client (the “Main Agreement”).
Terms such as “personal data”, “data subject”, “processing” and “personal data breach” have the meaning given in the PDPA. “Client” means the customer named in the Main Agreement. “IXI” means the member of the IXI Group of Companies (IXI Solutions Sdn. Bhd. or IXI Creatives Sdn. Bhd.) named in the Main Agreement. “Client Personal Data” means personal data processed by IXI on the Client’s behalf under the Main Agreement. “PDPA” means the Personal Data Protection Act 2010 of Malaysia as amended. “Sub-processor” means a third party engaged by IXI to process Client Personal Data.
The Client is the data controller and IXI is the data processor. IXI processes Client Personal Data only to provide the services in the Main Agreement and on the Client’s documented instructions, including these terms, unless the law requires otherwise (in which case IXI will tell the Client, where lawful).
The Client is responsible for the lawfulness of its collection and use of Client Personal Data, including notices and consents, for the accuracy of the data, and for its own users’ access rights and settings in the system. The Client will not instruct IXI to process data unlawfully and will not upload sensitive personal data (such as health or biometric data) unless the scope was agreed in writing.
IXI will:
IXI hosts and supports systems in the Client’s own cloud environment or in a hybrid setup. Where the Client’s cloud provider is selected and contracted by the Client, that provider is the Client’s own service provider and is not an IXI Sub-processor.
The Sub-processors IXI uses for a project, IXI will give the Client at least 30 days’ notice of any addition or replacement, and the Client may object on reasonable data protection grounds within that period. IXI will bind Sub-processors to data protection obligations no less protective than these terms and remains responsible for their performance.
If IXI receives a request from a data subject about Client Personal Data, IXI will refer the person to the Client and will not respond itself unless the Client instructs it. Taking into account the nature of the processing, IXI will give the Client reasonable help in responding to access, correction, restriction, portability and similar requests. Any charge for help beyond the scope of the services is set out in the Main Agreement.
IXI will implement appropriate technical and organisational measures to protect Client Personal Data against loss, misuse, unauthorised access, disclosure, alteration and destruction, in line with the Main Agreement and project documentation. The Client is responsible for the security of its own cloud environment, except for measures IXI agrees to configure or manage in the project documentation.
IXI staff will not enter Client Personal Sensitive Data into general-purpose AI tools, including Microsoft 365 Copilot, unless the Main Agreement allows it.
IXI will notify the Client without undue delay and in any event within 24 hours after becoming aware of a personal data breach affecting Client Personal Data, by raising a ticket on helpdesk.ixi.my and by email to the Client’s designated contact. The notice will describe, as far as known, the nature of the breach, the data and data subjects affected, the likely consequences, and the measures taken or proposed. IXI will take reasonable steps to contain and remediate the breach and will help the Client meet its own obligations to notify the Personal Data Protection Commissioner and affected data subjects. The detailed response process for each Client is set out in the Main Agreement or project documentation.
Unless the Main Agreement states otherwise, IXI will keep Client Personal Data for 90 days after the end of the services. During that period the Client may ask IXI in writing to return the data in a commonly used electronic format. After that period IXI will delete the data, unless the law requires IXI to keep it, and will confirm deletion in writing on request.
IXI will process Client Personal Data in the locations agreed for each project. IXI will not transfer Client Personal Data outside Malaysia unless the destination meets the PDPA’s requirements for cross-border transfers and the Client has been informed by notice under section 5.
IXI will make available the information reasonably needed to show compliance with these terms. The Client may audit IXI’s compliance up to once a year on 30 days’ written notice, during business hours, subject to confidentiality and at the Client’s cost.
Each party’s liability under these terms is subject to the limitations of liability in the Main Agreement.
These terms apply for as long as IXI processes Client Personal Data. If these terms conflict with the Main Agreement on the processing of personal data, these terms prevail. They are governed by the laws of Malaysia and subject to the jurisdiction of the courts of Malaysia.