Privacy Policy

SJEC Issue and Warranty Tracker — mobile application

This policy covers the SJEC Issue and Warranty Tracker mobile application and the service behind it. It is separate from, and additional to, the privacy policy published at sjec.com.my, which covers our website. Where the two differ in respect of the application, this policy applies.

SECTION 1Who we are

Sheng Jian Engineering & Construction Sdn Bhd (“SJEC”, “we”, “us”) is the data controller for the personal data described in this policy. We are a structural steel and construction engineering company registered in Malaysia, with our office at 53A, Tasek Mutiara 1, Kawasan Perindustrian IGB, 31400 Ipoh, Perak.

The application is a tool for managing construction projects, pre-handover punch lists and warranty claims between SJEC, our clients and our suppliers. Accounts are issued to named individuals acting in the course of their employment — it is not a consumer application and is not offered to the general public.

SECTION 2In short

What we collect

Your name, work email address, company and role on the application; the descriptions, comments, photographs and signatures you enter into the application; and a record of which account performed which action, and when. We do not ask for a telephone number, an identity document number or a date of birth.

Why

To run the project and warranty records the application exists to keep, and to tell the right people when something needs their attention.

What we do not collect

No location or GPS data. No payment or financial information. No advertising identifiers. There are no advertising or analytics trackers in the application.

Who sees it

SJEC staff working on your job. Clients see their own jobs only. Suppliers see only the components they supplied, and are never told which client a job belongs to.

Where it is kept

On SJEC’s own servers and storage at our premises in Malaysia.

Do we sell it

No. We do not sell personal data, and we do not share it for advertising.

SECTION 3What information we collect

3.1 Information provided when your account is created

• Your full name.
• Your work email address, which is also your sign-in name.
• Your company name and your role on the application — client, supplier, or one of SJEC’s own roles. This is what decides what you are shown.
• A password, which we store only in hashed form and never in a form we can read.

The account itself holds nothing else. We do not ask for a telephone number, a date of birth, an identity document number or a photograph of you, and the application has nowhere to put them. A contact telephone number may appear elsewhere — against your company’s record, or against a job or a warranty item, where SJEC’s staff have written down who to call. That is contract documentation rather than part of your account, and section 9 explains what happens to it when an account is deleted.

Accounts are either created by invitation from SJEC, or requested by you and approved by SJEC — and, where your company already has an administrator on the application, by that administrator. We tell them your name, company, requested role and email address so that they can decide whether to approve the request.

3.2 Information created while using the application

The purpose of the application is to keep a durable, attributable record of work. That record necessarily includes personal data:

• Punch list items and warranty claims you raise, including the description you write.
• Photographs you take or select, together with the file name, the date and time of capture, and the folder on SJEC’s storage the photograph belongs to.
• Comments you record against site photographs, and the rectification comments our engineers record against your items.
• The name of the person who signs a Certificate of Completion, and, where a signature is captured on screen, the drawn signature itself.
• A history of every change to an item — what changed, who changed it and when. This history cannot be edited or removed by any user, including SJEC, because its value depends on that.

3.3 Information collected automatically

• The internet address (IP address) your device connects from, recorded against security-relevant events such as signing in, so that we can investigate misuse of an account.
• Session tokens held on your device, which keep you signed in.
• Basic technical information needed to deliver the service, such as the time of each request.

3.4 What we do not collect

We say this explicitly because these are the things people reasonably expect a construction application to take:

• Location. The application does not request location permission and does not record where a photograph was taken or where you are.
• Payment or financial data. None is collected or held.
• Contacts, calendar, call logs or messages. The application does not read them.
• Advertising and analytics. There are no advertising identifiers, third-party advertising networks or analytics trackers in the application.

The application uses your device’s own photo picker and camera when you choose to attach a photograph, and only for the photographs you select.

SECTION 4How we use your information

• To operate the application: to show you your jobs, your punch list items and your warranty claims, and to let you raise and respond to them.
• To maintain the project and warranty record, including who reported a defect, who rectified it and who accepted the rectification. This record is the basis on which warranty questions are settled and may be relied on years after the work is finished.
• To notify the right people by email when something needs their attention, such as a defect raised against a job or a Certificate of Completion awaiting signature.
• To decide whether to approve a request for an account, and to give each account access only to what it is entitled to see.
• To protect the service — to detect and investigate unauthorised access and misuse.
• To comply with our legal obligations.

We rely on the performance of our contract with your company, and on our legitimate interests in keeping an accurate record of the work we have carried out, as the basis for this processing. Where consent is required, we ask for it and you may withdraw it.

SECTION 5Who can see what

Access is decided by the role your account holds, and is enforced by our server on every request rather than by what the application chooses to display:

• SJEC staff (administrators, project managers and site engineers) can see the jobs they work on and the records under them.
• Clients can see their own jobs only. A client is never shown another client’s jobs, records or people, and a request for a record belonging to another client is answered exactly as though the record did not exist.
• Suppliers can see only the components they supplied and any claims raised against them. A supplier is never told which client a job belongs to, is not shown the job number, and is not shown the job’s other components.

Colleagues at your own company who hold accounts on the application can see what your company can see.

SECTION 6Who else we share it with

We do not sell personal data and we do not share it for advertising. We share it only as follows:

• Email delivery. Notification emails are sent through Google Workspace (Google LLC), which processes the recipient’s email address and the content of the message in order to deliver it.
• Network delivery. The application reaches our servers through Cloudflare, Inc., which carries the connection and processes technical connection data in order to route and protect it.
• Professional advisers and authorities. Where we are required to by law, or where it is necessary to establish, exercise or defend a legal claim — which, for a warranty record, is the reason much of it is kept.
• A successor. If SJEC or part of its business is transferred, the records transfer with it, subject to this policy.

SECTION 7Where your information is kept

Your records and the photographs attached to them are stored on SJEC’s own servers and network storage at our premises in Malaysia. They are not stored with a third-party cloud provider.

The two service providers named in section 6 operate infrastructure outside Malaysia, so email in transit and connection data may be processed in other countries. We share only what those services need to deliver a message or carry a connection.

SECTION 8How long we keep it

The Personal Data Protection Act 2010 requires that personal data is not kept for longer than is necessary to fulfil the purpose it was collected for. We apply that as follows:

• Account details — for as long as your account is active, and then as described in section 9.
• Project, punch list, warranty and photographic records — for the duration of the warranty period on the job, and for seven years after that period ends.
• Security and audit records — for seven years.

Seven years is not arbitrary. A claim founded on contract may be brought in Malaysia for up to six years under the Limitation Act 1953, and the Companies Act 2016 requires business records to be kept for seven years. A warranty record that is destroyed before either period has run is a record that cannot answer the question it exists to answer — for you as much as for us.

After that period we delete the records or anonymise them so that they no longer identify anyone. Where we are required by law to keep something for longer, we keep it for that period and no longer.

SECTION 9Deleting your account and your data

You can ask us to delete your account and the personal data associated with it in two ways:

• From inside the application, under Settings → Delete my account.
• By submitting a request at sjec.my/delete-account, without needing the application.

Deletion happens immediately, not on a queue. We remove your name, your email address and your password from the account; we end every signed-in session on every device; we cancel any invitation you are holding and any you have sent that nobody has taken up; we remove your email address and your device’s address from our security records; we remove the record of which jobs your account could see; and we stop sending you the daily digest. You can no longer sign in, and the account cannot be reopened.

We do not delete the project and warranty records themselves, and we want to be plain about why. Those records document work carried out under a contract between SJEC and your company, and both sides may need to rely on them for as long as the warranty and any claim period runs. Where an entry names you — an item you raised, a rectification you signed off, a certificate you issued — we replace your name at the moment you delete the account with a neutral description such as “a representative of the client”. The entry stays; the person does not.

Three things deliberately survive, and we would rather say so than let you find out later:

• The role the account held. We keep the fact that it was a client, supplier or SJEC account, because that is what makes the neutral description above truthful. It no longer points at a person.
• A Certificate of Completion you signed in the application — the drawn signature and the name you signed under — is kept whole, and the certificate continues to show that you issued it. This is the one record we do not anonymise, and the reason is that it is your company’s executed acceptance of handover: it is the document either side would produce if the handover were ever disputed, and a signature with the signatory’s name struck off it would not be evidence of anything. Certificates accepted without a signature are anonymised like everything else.
• Contact details your company gave us. A name, email address or telephone number written on a job, on a warranty item, or on your company’s own record with SJEC is part of the contract documentation rather than part of your account, and deleting your account does not remove it. That means job correspondence may still reach an address on one of those lists after your account is gone. If you want those details changed or removed, write to us at the address in section 14 and we will deal with it as a request under section 11.

If your company ends its relationship with SJEC, the same applies: individual accounts are closed, and the underlying project records are kept for the period described above.

SECTION 10How we protect your information

• Passwords are stored using a slow, salted hashing function and are never stored or transmitted in a readable form. Nobody at SJEC can read your password.
• All traffic between the application and our servers is encrypted in transit.
• What each account may see and do is enforced on the server on every request, against the signed-in account, and not left to the application to decide.
• Security-relevant actions are recorded with the account, the time and the originating internet address.

No system is perfectly secure. If a breach affecting your personal data occurs, we will act on it and notify you and the relevant authority where we are required to do so.

SECTION 11Your rights

Under the Personal Data Protection Act 2010 and as a matter of our own practice, you may:

• Ask what personal data we hold about you, and ask for a copy of it.
• Ask us to correct anything inaccurate or incomplete.
• Ask us to delete your account, as described in section 9.
• Ask us to limit how we process your personal data, or object to a particular use.
• Withdraw any consent you have given, without affecting what was done before you withdrew it.
• Complain to us, and to the Personal Data Protection Commissioner of Malaysia.

We answer requests within 21 days. We may need to verify your identity first, which protects you as much as it protects us.

SECTION 12Children

The application is a workplace tool. It is not directed at children, we do not knowingly issue accounts to anyone under 18, and we do not knowingly collect personal data from children. If we learn that we hold such data we will delete it.

SECTION 13Changes to this policy

We may update this policy as the application changes. The effective date at the top always shows when it was last updated, and material changes will be notified to account holders by email or in the application before they take effect. Earlier versions are available on request.

SECTION 14How to contact us

For any question about this policy, or to exercise any of the rights in section 11: