Privacy Policy

Who This Policy Covers

This Privacy Policy explains how PayrollSME handles personal information when a company, administrator, employee, or invited user visits our site, creates an account, uses a workspace, or contacts us.

If you use PayrollSME through your employer or another organization, that organization is usually the data controller of the employee records and payroll preparation data in its workspace. PayrollSME is the data processor and handles that data on the organization's instructions. We read those roles as the Personal Data Protection Act 2010 uses them, as amended by the Personal Data Protection (Amendment) Act 2024, which placed obligations on processors directly rather than only through the controller.

Information We Collect

• Account and contact details, such as name, work email, authentication details, company name, role, and support messages.
• Workspace data entered or uploaded by users, including employee records, departments, attendance records, leave requests, claims, approval decisions, payroll readiness information, audit events, and documents needed for HR operations.
• Usage, device, and security data, such as log data, IP address, browser type, session activity, error reports, and product telemetry used to keep the service reliable and secure.
• Billing or commercial details if PayrollSME offers paid plans or signed order forms, limited to what is needed to administer the customer relationship.

How We Use Information

• Provide, operate, secure, troubleshoot, and improve PayrollSME workspaces and related support.
• Process HR workflows, payroll preparation, approvals, reminders, audit trails, exports, and company settings requested by authorized users.
• Authenticate users, enforce permissions, prevent misuse, investigate security events, and maintain service integrity.
• Communicate about accounts, product updates, support requests, security notices, and administrative changes.
• Comply with legal, accounting, tax, employment, and regulatory obligations that apply to the service or to customer instructions.

AI-Assisted Features

PayrollSME includes AI-assisted features that summarize workflow state, explain payroll readiness blockers, and make changes to workspace records on an authorized user's instruction. Changes are made directly rather than queued for approval.

Customer workspace content may be processed to generate an AI response when an authorized user invokes an AI feature. AI actions are permission-aware: an AI feature cannot reach data or perform actions beyond the permissions of the account that invoked it. Every AI change is recorded in the workspace audit trail with the values before and after, and many can be reversed by an authorized user.

Some AI actions cannot be reversed, including locking a payroll run, changing bank details, and ending an employment record. Customers remain responsible for employer, HR, payroll, legal and accounting decisions taken in their workspace, whether performed by a person or by an AI feature acting on their instruction.

Some employment decisions must be made by a person under Malaysian law regardless of what the workspace makes possible. Dismissal or other punishment for misconduct needs due inquiry under section 14(1) of the Employment Act 1955. The Personal Data Protection Commissioner is developing a guideline on automated decision making and profiling, and we will revise these features and this policy as it settles.

Sharing and Service Providers

We do not sell employee records or payroll preparation data. We share personal information only as needed to provide PayrollSME, follow customer instructions, comply with law, protect the service, or complete a business transition such as a merger or acquisition.

Service providers may help with hosting, databases, authentication, storage, email delivery, analytics, security monitoring, customer support, and AI infrastructure. They are expected to handle information only for the services they provide to PayrollSME.

Retention

PayrollSME keeps personal information for as long as needed to provide the service, maintain security and audit records, comply with legal obligations, resolve disputes, and support legitimate business needs.

Customers can request deletion or export of workspace data, subject to account ownership, product limitations, backup cycles, legal retention duties, and records that must remain in audit logs for integrity and compliance.

Security

PayrollSME uses technical and organizational safeguards intended to protect personal information, including role-based access controls, tenant scoping, secure authentication, audit-oriented workflows, and infrastructure security practices.

No online service can guarantee absolute security. Customers should keep user access current, choose strong authentication practices, and avoid uploading data that is not needed for HR or payroll operations.

Your Choices and Rights

Depending on where you live and the role you have in a workspace, you may have rights to access, correct, export, delete, restrict, or object to certain processing of personal information.

For employee workspace data, PayrollSME may need to direct requests to the employer or workspace owner. To make a privacy request, contact hello@payrollsme.com.my with enough detail for us to identify the account, workspace, and request.

International Processing

PayrollSME may process and store information in countries where we or our service providers operate. When personal information is transferred across borders, we use appropriate safeguards required for the nature of the data and the applicable customer relationship.

Changes and Contact

We may update this Privacy Policy as the product, laws, or our operations change. Material updates will be posted on this page, and we may provide additional notice when appropriate.

Questions or privacy requests can be sent to hello@payrollsme.com.my.