PRIVACY & DATA PROTECTION POLICY

Effective Date: 1st September 2026
Last Updated: 1st September 2026

Pentas Flora Sdn. Bhd. (“Pentas Flora”, “we”, “us”, or “our”) respects your privacy and is committed to protecting personal data processed through our mobile applications.

This Privacy Policy explains how Pentas Flora collects, uses, stores, discloses, protects, and otherwise processes personal data and other information through the following internal mobile applications:

BOD Dashboard
The Link
Amethyst

Collectively, these applications are referred to as the “Applications”.

The Applications are intended primarily for authorised employees, management personnel, Board of Directors members, and other authorised users of Pentas Flora. They are not intended for general public use.

Because each Application serves a different business purpose, the type of data collected and the device permissions used may differ between Applications. The application-specific sections below describe those differences.

1. About Pentas Flora

Pentas Flora Sdn. Bhd.

Level 23A, EXSIM Tower @ Millerz Square
Jalan Klang Lama
58000 Kuala Lumpur
Malaysia

Privacy Contact: thelink@pentasflora.com

2. Scope of This Privacy Policy

This Privacy Policy applies to personal data and other information processed through the Applications and their associated backend systems, APIs, databases, authentication systems, and supporting infrastructure.

This Privacy Policy does not necessarily apply to third-party websites, applications, platforms, or services that may be accessed through or associated with the Applications. Those third parties may have their own privacy policies and data-processing practices.

3. Who May Use the Applications

The Applications are intended for authorised users associated with Pentas Flora, including employees, management personnel, Board of Directors members, and other persons who have been granted access for legitimate business purposes.

Access to the Applications is controlled through authentication and authorisation mechanisms determined by Pentas Flora.

The Applications are intended only for adults and are not directed to individuals under the age of 18.

4. Personal Data We May Collect

Depending on the Application you use and your role within Pentas Flora, we may process the following categories of personal data.

4.1 Identity and Employment Information

This may include:

Full name
Staff ID
Department
Join date
Address
Postcode
State
Phone number
Email address
Passport number
Login credentials
Other employment or account information required to administer authorised access

Not every Application collects or uses all of the information listed above.

4.2 Authentication and Security Information

The Applications may process:

Staff ID
Login credentials
Session tokens
IP address
Login history
Failed login attempts
Account and access-control information

This information is used to authenticate authorised users, maintain secure sessions, control access, detect suspicious activity, and protect company systems.

4.3 Technical Information

The Applications may process technical information necessary to operate, secure, maintain, and troubleshoot the Applications, such as:

Application version
Device or operating-system information where required for technical operation
IP address
System and security logs
Error or diagnostic information where generated by the Application or its supporting systems

Pentas Flora does not intentionally collect technical information beyond what is reasonably necessary for application operation, security, maintenance, and support.

5. Application-Specific Data Practices

5.1 BOD Dashboard

BOD Dashboard is an internal management dashboard designed for authorised management and Board of Directors users.

Personal Data

BOD Dashboard may process:

Full name
Address
Postcode
State
Email address
Department
Join date
Passport number
Staff ID
Login credentials
Session tokens
IP address
Login history
Failed login attempts

Business and Operational Data

BOD Dashboard retrieves business and operational information from Pentas Flora’s authorised backend/API systems.

The dashboard may display:

Total litres of oil collection
Average price per litre
Total kilograms of waste collection
Total sales
Bank transfer usage count
QR transfer usage count
Bank transfer amount
QR transfer amount
Active fleet count
Total distance covered by fleet vehicles

These business metrics are used for management reporting, operational monitoring, business analysis, and decision-making.

The business information displayed by BOD Dashboard is retrieved from backend systems rather than being manually entered by users through the dashboard.

Location and Device Permissions

BOD Dashboard does not intentionally collect or use:

Precise location
Approximate location
GPS information
Camera
Microphone
Contacts
Photo or media library

BOD Dashboard does not currently use push notifications or third-party analytics services.

Backend Systems

BOD Dashboard is supported by:

OutSystems
Microsoft SQL Server
Authorised backend/API services used to retrieve dashboard information

Access to the underlying database is restricted to authorised members of the IT/MIS team for legitimate technical, administrative, security, maintenance, troubleshooting, and support purposes.

5.2 The Link

The Link is an internal Pentas Flora application used to support operational workflows relating to scheduled waste collection and related business activities.

The Application may process information necessary to support activities such as customer-related workflows, job management, operational activities, and location-based actions.

Personal and Account Information

The Link may process information associated with an authorised user account, including:

Staff ID
Name and employee information associated with the user’s account
Contact information
Nationality
Login credentials
Authentication and session information
Login and security activity

Location Information

The Link uses device location information for certain operational features.

Location may be used to support functions such as:

Creating or registering customer information at the relevant location
Driver or marketer check-in activities
Other location-based operational workflows

Location information is used for the relevant business function and is not collected for advertising or behavioural tracking.

The Link does not use location information for targeted advertising.

Operational Information

The Link may process operational information associated with scheduled waste collection activities, customer records, jobs, fleet activities, and other business workflows required for Pentas Flora’s operations.

The exact information shown or processed depends on the user’s role and authorised system access.

Other Device Permissions

The Link may request access to device permissions that are necessary to support its business functions. In particular, the Application may request access to the device’s location services when a location-based feature is used.

The requested permission will be presented by the operating system at the time access is required, and users may choose whether to grant the requested permission. Certain features of The Link may not function as intended if the required permission is denied.

5.3 Amethyst

Amethyst is an internal Pentas Flora application used for business and operational purposes, including QR/barcode-based scanning, employee meal claim management, and visitor and contractor entry registration.

Account and User Information

Amethyst may process information necessary to authenticate and identify authorised users and support the application’s business functions, including:

Staff ID and employee identification information
Login credentials
Session and authentication information
User account information and role or access permissions
Information associated with the employee’s use of Amethyst

Access to certain functions may be restricted based on the user’s assigned role or permissions.

Camera and QR/Barcode Scanning

Amethyst uses the device camera to scan QR codes and barcodes required for its business and operational workflows.

The camera may be used for functions including:

Employee meal claim verification and recording
Entry and access-related check-in and check-out processes
Visitor and contractor identification or registration workflows
Other authorised QR/barcode-based business processes within the application

The application may allow authorised users to select the device camera, such as the front or rear camera, where required for scanning functionality.

The camera is used for scanning purposes and is not intended for general photography, targeted advertising, or continuous monitoring of the user or their surrounding environment.

QR/barcode information captured through scanning may be transmitted to Pentas Flora backend systems where necessary to validate the scan, record a transaction, or perform the relevant business process.

Meal Claims

Amethyst may process information relating to employee meal claims and meal eligibility. This may include claimant information, claim status, meal type, and records associated with lunch or dinner claims.

The application may record information necessary to validate and manage meal claims, including statuses such as entitlement validation, invalid QR codes, duplicate or multiple claims, and successful lunch or dinner claims.

Meal claim records may be used for operational monitoring, reporting, and administrative purposes.

Visitor and Contractor Entry Registration

Amethyst may process personal information relating to visitors and contractors when authorised users perform entry registration functions.

Depending on the applicable business process, this may include:

Name
Identification card (IC) information
Contact number
Email address
Card assignment information
Card validity or effectivity end date

This information is used to support visitor and contractor registration, identification, access-card assignment, and entry management. The application may also perform checks to prevent duplicate card assignments.

Location

Amethyst does not intentionally collect or use device location information as part of its application functionality.

Microphone and Other Device Permissions

Amethyst does not intentionally collect or use microphone, contacts, or device location information.

Device permissions requested by the application are intended to support its authorised business functionality, such as camera access for QR/barcode scanning.

Amethyst does not intentionally use device permissions for advertising, continuous surveillance, or purposes unrelated to its stated business functions.

6. How We Use Personal Data

Pentas Flora may process personal data for the following purposes:

6.1 Authentication and Access Management

To:

Verify authorised users
Provide access to the Applications
Manage user permissions
Maintain secure sessions
Restrict access to authorised information

6.2 Security and Fraud Prevention

To:

Monitor account activity
Detect and prevent unauthorised access
Investigate suspicious activity
Review failed login attempts
Protect company systems and information

6.3 Application Operation

To:

Provide the Applications’ features and functions
Retrieve information from authorised backend systems
Support business workflows
Maintain reliable application operation
Troubleshoot technical problems

6.4 Business and Management Purposes

To provide authorised personnel with operational, financial, management, reporting, and business information required to perform their responsibilities.

6.5 Maintenance and Improvement

To maintain, troubleshoot, secure, and improve the Applications and their supporting systems.

6.6 Legal and Regulatory Purposes

To comply with applicable laws, regulations, lawful requests, legal proceedings, or other applicable obligations.

7. How We Obtain Information

We may obtain information through:

Information provided by authorised users
Pentas Flora’s internal employment and administrative systems
Authorised internal personnel
Backend databases and APIs
Application login and authentication processes
Security and system logs
Device permissions used by the relevant Application
Operational activities performed through the Applications

Business and operational information displayed by the Applications may be retrieved from Pentas Flora’s backend systems.

8. Backend Systems and Data Processing

The Applications may communicate with Pentas Flora backend systems and databases to retrieve, process, and store information necessary to provide their intended functionality.

Our current application environment includes technologies such as:

OutSystems
Microsoft SQL Server
Application APIs and backend services

The exact information processed depends on the Application and the user’s authorised access.

9. Data Sharing and Disclosure

Pentas Flora does not sell personal data collected through the Applications.

Personal data and company information are accessible only to authorised persons and systems where access is required for legitimate business purposes.

9.1 Internal Access

Authorised Pentas Flora personnel may access information where necessary for:

IT administration
Application maintenance
Technical support
Security monitoring
Troubleshooting
Database administration
Business operations
Management responsibilities
Other authorised company purposes

For BOD Dashboard, direct access to underlying database records is restricted to authorised members of the IT/MIS team through controlled database access.

9.2 Information Requests

Information may be provided to an internal or authorised requestor after the request has been reviewed.

The request may be evaluated based on:

Identity of the requestor
Purpose of the request
Authority of the requestor
Type of information requested
Business necessity
Security considerations
Applicable internal policies
Applicable legal requirements

9.3 Legal and Regulatory Disclosure

Pentas Flora may disclose information where required or permitted by applicable law, regulation, court order, legal process, or lawful government request.

9.4 Service Providers

Pentas Flora may use third-party infrastructure or service providers to support the operation of its Applications, such as hosting, cloud infrastructure, application platform, database, security, or other technical services.

Where such providers process personal data on behalf of Pentas Flora, access is limited to what is necessary to provide the relevant service and is subject to appropriate contractual, technical, or organisational safeguards where applicable.

10. Analytics and Advertising

The current known implementations do not use the Applications for advertising or behavioural advertising.

BOD Dashboard does not use third-party analytics services.

The Link and Amethyst do not intentionally use personal data for advertising.

Where technical monitoring, diagnostics, crash reporting, or other operational services are introduced in the future, Pentas Flora will update its privacy disclosures where required.

11. Push Notifications

BOD Dashboard does not currently use push notifications.

The Link and Amethyst are not currently described as using push notifications as part of their core functionality.

Should push notifications be introduced, the relevant application’s privacy disclosure will be updated where necessary.

12. Data Storage and Security

Pentas Flora takes reasonable technical and organisational measures to protect personal data and company information against unauthorised access, disclosure, alteration, misuse, loss, or destruction.

These measures include appropriate:

Authentication controls
Access restrictions
Database access controls
Session management
Administrative access controls
Security monitoring
Audit and login records
Backup and recovery measures
Operational and organisational safeguards

Access to application databases is restricted based on authorised roles and responsibilities.

Pentas Flora regularly reviews its security and access practices and may improve them as necessary based on operational, technical, and security requirements.

No electronic system, network, application, or method of data transmission can be guaranteed to be completely secure.

13. Data Retention

Pentas Flora retains personal data and other information only for as long as reasonably necessary for the purposes described in this Privacy Policy and for applicable employment, legal, operational, security, accounting, audit, and business requirements.

Because different types of information serve different purposes, retention periods may vary.

For example, information may be retained for as long as:

The user’s account remains active
The user remains authorised to access the Applications
The information is required for operational or business purposes
The information is required for security and audit purposes
The information is required by applicable legal or regulatory obligations

When information is no longer required, Pentas Flora may securely delete, anonymise, archive, or otherwise dispose of it in accordance with applicable requirements and internal procedures.

14. Data Location and International Transfers

The Applications and their associated backend systems may use infrastructure and service providers that process or store information in Malaysia or other jurisdictions where the relevant service providers operate.

Pentas Flora does not currently publish specific server or database locations for its internal application infrastructure.

Where personal data is transferred or processed outside Malaysia, Pentas Flora will take reasonable steps to ensure that appropriate safeguards are applied in accordance with applicable data protection requirements.

15. User Privacy Rights

Subject to applicable laws, internal procedures, and reasonable identity verification, users may request:

Access to personal data held about them
Correction of inaccurate or incomplete personal data
Deletion of their account and personal data where appropriate
Withdrawal of consent where processing is based on consent
Information about how their personal data is processed
Investigation of privacy-related concerns or complaints

Requests may be submitted to:

Email: thelink@pentasflora.com

Pentas Flora may verify the identity of a requestor before processing a request in order to protect against unauthorised access or disclosure.

Certain information may need to be retained where required for legal, security, employment, contractual, accounting, audit, or other legitimate purposes.

16. Account Deletion

Because the Applications are intended for internal use, user accounts are managed through Pentas Flora’s authorised internal systems and procedures.

Users may request deletion of their account and associated personal data by contacting:

Email: thelink@pentasflora.com

Upon receiving a valid request, Pentas Flora will review the request and take appropriate action in accordance with applicable law, security requirements, employment requirements, and data-retention obligations.

Where information must be retained for legitimate legal, security, employment, accounting, audit, or other required purposes, such information may be retained for the applicable period.

Account deletion may result in the loss of access to the relevant Application and associated company systems.

17. Withdrawal of Consent

Where processing of personal data is based on consent, a user may withdraw that consent by contacting:

Email: thelink@pentasflora.com

Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

Pentas Flora may continue processing or retaining information where another lawful basis or legal requirement permits or requires such processing.

Withdrawal may also affect access to an Application if the relevant information is necessary for authentication, security, employment, or operational purposes.

18. Children’s Privacy

The Applications are intended exclusively for authorised adult users.

The Applications are not intended for individuals under the age of 18, and Pentas Flora does not knowingly provide access to individuals under 18.

19. Changes to This Privacy Policy

Pentas Flora may update this Privacy Policy from time to time to reflect:

Changes to the Applications
Changes to data-processing practices
Changes to backend systems
Changes to service providers
Changes in applicable laws or regulations
Changes in security practices
Other legitimate business or operational requirements

When material changes are made, Pentas Flora may update the “Last Updated” date and provide additional notice where appropriate.

Users are encouraged to review this Privacy Policy periodically.

20. Contact Us

For questions, privacy requests, complaints, or concerns regarding the processing of personal data through the Applications, please contact:

Pentas Flora Sdn. Bhd.
Level 23A, EXSIM Tower @ Millerz Square
Jalan Klang Lama
58000 Kuala Lumpur
Malaysia

Email: thelink@pentasflora.com

21. Applicable Law

This Privacy Policy is intended to be interpreted in accordance with the applicable laws and regulations of Malaysia, including the Personal Data Protection Act 2010 (Act 709) and applicable amendments, regulations, requirements, and guidance.

Pentas Flora will review its privacy and personal data handling practices periodically and make updates where necessary to reflect applicable legal and regulatory requirements.

Policy Owner: Pentas Flora Sdn. Bhd. — Information Technology (IT) Department
Document Version: 1.0
Effective Date: 1st September 2026
Last Updated: 1st September 2026