Privacy Notice

Version 1.2 · Effective: 30 September 2026

1Who we are

1.1
This notice is given by Zenara Jaya Sdn Bhd (formerly known as Glowyrich Sdn Bhd) (Company No. 202101036810 (1437110-X)), of Lot 1180, Ground Floor, Jalan Krokop 2, 98000 Miri, Sarawak, which operates Rakanify ("we", "us"). It is given under section 7 of the Personal Data Protection Act 2010 ("PDPA").
1.2
For any question or request about personal data, contact us at hello@zenarajaya.com.
1.3
This notice covers personal data we control: about people who apply for, use or deal with Rakanify on behalf of an agency, and about visitors to our website. It does not cover how an agency uses the candidate and client data it puts on Rakanify; see "If you are a candidate or client of an agency" below.

2.1
Application and account data: the name, role, work email and mobile number of the person applying, and of Users and contacts the agency adds; the agency's company, SSM and licence details; and the SSM and JTK licence documents, which may contain names and details of directors and officers.
2.2
Register data: the details JTK publishes about the licence, including the agency name, licence number, status, expiry and the email address JTK lists for it. We do not keep phone numbers from the registers.
2.3
Verification and security data: records of confirmation codes sent (the addresses they were sent to are shown masked, and codes are stored only as a keyed hash), IP addresses and browser details used for security, rate-limiting and to record acceptance of our terms, and audit logs of actions on the application.
2.4
Billing data: amounts, invoices and payment status. Card and online banking details are entered on our payment provider's pages, and we do not receive them.
2.5
Communications: messages you send us, and replies to requests for more information.
2.6
Website: our website uses no advertising or analytics cookies. Our hosting provider keeps standard server logs (such as IP address and pages requested) for security and reliability.

3.1
From you and your agency; from JTK's public registers of licensed private employment agencies (JTK Semenanjung Malaysia and JTK Sabah); from the documents you upload; and from our payment provider.

We process personal data to:

4.1
check that an agency holds a valid JTK licence and that the application is made with the licence holder's authority;
4.2
assess applications, contact you about them and give you access to Rakanify;
4.3
provide, secure and support Rakanify, and prevent fraud and misuse;
4.4
bill and collect fees, issue invoices and e-invoices, and meet our tax and accounting duties;
4.5
comply with the law and with requests from courts and authorities, and establish, exercise or defend legal claims;
4.6
improve Rakanify using statistics that do not identify anyone;
4.7
send you service messages. We send marketing messages only if you have agreed, and you can opt out at any time.

5.1
The information marked as required in the sign-up form, and the confirmation step, are needed to verify an agency. If they are not provided, we cannot process the application. Optional fields (such as website and team size) can be left out.

We do not sell personal data. We share it only with:

6.1
our service providers, who process it for us under contract (listed below);
6.2
another agency on a Deal, limited to the details needed for that Deal, once both agencies have accepted the Deal Terms;
6.3
our professional advisers, auditors and insurers, under confidentiality;
6.4
JTK, the Personal Data Protection Commissioner, the Malaysian Anti-Corruption Commission, the police, courts and other authorities, where the law requires or permits it, or to report suspected trafficking, forced labour or bribery;
6.5
a successor or related company that takes over Rakanify, on the same terms as this notice.

7.1
The providers listed in the table below. Some of them process personal data outside Malaysia. We transfer personal data outside Malaysia only in a way the PDPA permits, and under contracts that require the recipient to protect it to a standard at least equivalent to the PDPA. We will update this list before adding a provider.

Provider	Purpose	Location
Neon	Database	Singapore
Vercel Inc.	Website and app hosting; private document storage	Singapore (with a global network for delivering the website)
Resend	Sending emails, including confirmation codes	United States
Billplz	Taking payments (FPX, e-wallets, cards)	Malaysia

8.1
Confirmation codes: until used or expired (10 minutes), then deleted. Sending and attempt counters: up to 2 days.
8.2
Applications that are rejected or not completed: 12 months after the last activity, then deleted, except a minimal record (agency name, licence number, outcome and date) kept for 3 years to prevent fraud and repeated misuse.
8.3
Active agencies: for as long as the agency subscribes. After the agreement ends, account data is kept for 90 days and then deleted, except as below.
8.4
Records of acceptance of our terms, invoices, payments and tax records: 7 years after the agreement ends, as required for tax and to establish or defend legal claims.
8.5
Where there is a dispute, investigation or legal hold, we keep the relevant data until it is resolved.

9.1
We use encryption in transit and at rest, private document storage with no public links, access limited to staff who need it with every access logged, keyed hashing of secret codes and links, rate limits, and regular review of these measures. No system is perfectly secure, but we take practical steps under the PDPA Security Principle.
9.2
If a personal data breach occurs, we will notify the Personal Data Protection Commissioner, and affected individuals where the breach is likely to cause significant harm, within the time the law requires.

Subject to the PDPA, you may:

10.1
ask for access to, and a copy of, your personal data;
10.2
ask us to correct personal data that is inaccurate, incomplete, misleading or out of date;
10.3
withdraw your consent, or ask us to limit processing (withdrawal may mean we cannot continue an application or account);
10.4
ask us to transmit your personal data to another data user, where the PDPA gives that right;
10.5
tell us not to process your data for direct marketing.
10.6
Send requests to us at hello@zenarajaya.com. We respond within 21 days, and do not charge a fee unless the law allows it and the request is manifestly excessive. If you are not satisfied, you may complain to the Personal Data Protection Commissioner (Jabatan Perlindungan Data Peribadi).

11.1
Agencies use Rakanify to manage their own candidates and clients. For that data, the agency is the data user (controller) and we process it on the agency's behalf. Please contact the agency first; it is responsible for telling you how it uses your data and for obtaining your consent before your anonymised profile is shared with other licensed agencies on the network.
11.2
If you cannot reach the agency, you may contact us at hello@zenarajaya.com, and we will pass your request to the agency and help it respond.

12.1
Rakanify is for businesses and is not directed at anyone under 18.
12.2
We may update this notice. We will show the new version and date here, and tell agencies about material changes.
12.3
This notice is provided in English and Bahasa Melayu. If there is any inconsistency, the English version prevails.