PDPA Notice

This notice explains how personal data may be collected and processed when users interact with AcaraX, including event registration, ticketing, check-in, certificate issuance and event communication.

This notice is issued in accordance with the Personal Data Protection Act 2010 (PDPA) of Malaysia and applies to personal data collected from individuals in connection with the services provided by AcaraX, operated by PFM GLOBAL VENTURES SDN. BHD (AcaraX).

AcaraX may collect and process the following categories of personal data:

• Identity data: full name, IC number or passport number
• Contact data: email address, phone number, mailing address (where applicable)
• Registration data: event-specific fields such as company, position, team, category, age group
• Transactional data: ticket type, payment status, payment reference
• Attendance data: check-in time, gate, staff name
• Certificate data: certificate serial number, issue date, attendance status
• Technical data: IP address, device information, session data
• Uploaded files: documents or images submitted during event registration

Your personal data is processed for the following purposes:

• Registration and confirmation for events on the AcaraX platform
• Issuance and delivery of QR e-tickets
• QR check-in processing and attendance record-keeping
• Generation and verification of e-certificates of attendance
• Payment processing and transaction record-keeping
• Communication with participants and event organizers regarding event details
• Customer support and dispute resolution
• Platform performance monitoring and security
• Compliance with applicable laws and regulations

Personal data collected during event registration is accessible to the event organizer for the purpose of managing their event. Event organizers are independent data controllers under the PDPA and are responsible for their own compliance obligations.

AcaraX may engage service providers for hosting, payment processing and platform infrastructure. These providers are contractually bound to process data only for the purposes specified by AcaraX.

AcaraX does not sell personal data to third parties for marketing or commercial purposes.

AcaraX implements appropriate technical and organizational security measures to protect personal data against unauthorized access, loss, misuse or alteration. These include HTTPS encryption, access controls and password hashing. Despite these measures, no system is entirely secure and AcaraX cannot guarantee absolute security of personal data.

Personal data is retained only for as long as necessary for the stated purposes:

• Event registration data: up to 2 years after the event date
• Payment transaction records: up to 7 years for regulatory and audit purposes
• e-Certificate records: retained indefinitely for verification purposes
• Account data: retained until account deletion is requested

As a data subject under the PDPA 2010, you have the right to:

• Access personal data held about you by AcaraX
• Request correction of inaccurate, incomplete or outdated personal data
• Withdraw consent to the processing of your personal data (subject to legal and contractual limitations)
• Limit the processing of your data in certain circumstances

To exercise any of these rights, please submit a written request to support@acarax.my. AcaraX will respond within a reasonable timeframe in accordance with the PDPA.

You may withdraw your consent to the processing of your personal data at any time by contacting support@acarax.my. Please note that withdrawal of consent may affect your ability to participate in events or access services on the platform.

For PDPA-related inquiries, data access or correction requests, or complaints, please contact the AcaraX Data Protection Officer at support@acarax.my.