Privacy Policy

Effective 1 October 2026 · Erazem Sdn Bhd

This policy explains how Erazem Sdn Bhd ("Erazem", "we", "us") collects, uses, protects and discloses personal data through the IzemNEXT website, the IzemNEXT application at app.izemnext.com, and the legacy Izem services at izem.my and izem.com.my (together, the "Service"). We handle personal data in line with the Personal Data Protection Act 2010 (PDPA), as amended.

1. Definitions

  • Service: the websites and cloud software operated by Erazem Sdn Bhd listed above.
  • Customer: the company or organisation that subscribes to the Service.
  • User: any individual who uses the Service, including the Customer's administrators and employees using self-service.
  • Personal Data: information that identifies a living individual, directly or indirectly.
  • Usage Data: data collected automatically when the Service is used, such as IP address and browser type.
  • Data User / Data Processor: as defined in the PDPA. For employee records a Customer enters into IzemNEXT, the Customer is the data user and Erazem processes that data on the Customer's behalf.

2. Personal data we collect

From website visitors and prospects

When you use the contact form we collect your name, company, work email, phone number, company size, the modules you are interested in and your message. We also record your IP address and the time of the request to prevent spam and abuse.

From Customers and Users of the application

  • Account details: name, email address, role, company membership and login activity.
  • Employee records entered by the Customer: name, NRIC or passport number, date of birth, sex, citizenship, address, contact details, employment details, department and branch.
  • Payroll and statutory data: salary and pay components, bank name and account number, EPF, SOCSO, EIS and income tax numbers, tax residency, reliefs, dependants and previous-employment income (Form TP3).
  • Attendance and leave data: clock-in and clock-out times, location at the time of clocking, selfie photos where the Customer enables them, leave applications and supporting documents such as medical certificates.
  • Billing details of the Customer: company name, registration number, billing contact and invoice history. We do not store payment card details.

Usage Data

IP address, browser type and version, pages visited, time and date of visits, time spent on pages, device identifiers and diagnostic logs.

3. How we use personal data

  • To provide, operate and maintain the Service, including calculating payroll and statutory contributions and producing reports and forms requested by the Customer.
  • To create and secure accounts, authenticate Users and keep an audit trail of sensitive actions.
  • To reply to enquiries, arrange demos, onboarding, training and support.
  • To send service notices such as changes to features, pricing, terms or this policy.
  • To invoice Customers and manage subscriptions and trials.
  • To monitor performance, detect and prevent fraud, spam and security incidents, and fix technical problems.
  • To improve the Service using aggregated or de-identified information.
  • To send product news and offers to business contacts. You can opt out at any time.
  • To comply with legal obligations and requests from authorities.

We use employee data that a Customer enters only to provide the Service to that Customer, under the Customer's instructions. We do not sell personal data.

4. Cookies and browser storage

The IzemNEXT website stores your language choice and last viewed product screen in your browser's local storage. It does not use advertising cookies. The application uses essential cookies and tokens to keep you signed in and secure. If we add analytics or marketing tools in future, we will update this section first. You can clear or block cookies and site data in your browser settings; parts of the application may not work without essential cookies.

5. Disclosure of personal data

We disclose personal data only:

  • to service providers who help us run the Service, such as cloud hosting, email delivery (for example Amazon Web Services), payment gateways and software development tools, under confidentiality and data protection obligations;
  • to statutory bodies or recipients when the Customer instructs us to generate or submit files for them (for example KWSP, PERKESO, LHDN or HRD Corp), or to the Customer's bank for salary payment files;
  • to our related companies, to the extent needed to provide the Service;
  • to a buyer or successor if Erazem is involved in a merger, acquisition or sale of assets, with notice to affected Customers;
  • when required by law, court order or a lawful request from authorities, or to protect the rights, property or safety of Erazem, our Customers or the public;
  • with your consent, including consent to display a Customer's name or logo as a reference on our website.

6. Transfer outside Malaysia

Our service providers may store or process data on servers located outside Malaysia. Where this happens we take reasonable steps, as required by the PDPA, to ensure the data receives a comparable level of protection.

7. Security

We protect personal data with measures that include encrypted connections (HTTPS), role-based access control, masking of NRIC, bank account and pay amounts by default, audit logging of sensitive-field reveals and data changes, and regular backups. No method of transmission over the internet or electronic storage is completely secure, so we cannot guarantee absolute security. If a personal data breach affects you, we will notify the Customer and, where required, the Personal Data Protection Commissioner and affected individuals.

8. Retention

We keep personal data only as long as needed for the purposes in this policy. Customer data is kept for the duration of the subscription and for a reasonable period after termination so the Customer can export it, after which it is deleted or anonymised unless the law requires us to keep it. Payroll and statutory records may need to be kept by the Customer for the periods required by Malaysian law; Customers should export them before closing their account. Contact form enquiries are kept for up to 24 months. Usage Data is kept for shorter periods unless needed for security or legal reasons.

9. Your rights

Under the PDPA you may:

  • request access to and a copy of your personal data;
  • ask us to correct data that is inaccurate, incomplete or out of date;
  • withdraw consent or ask us to limit processing, including for direct marketing;
  • ask for your data in a structured, commonly used format (data portability), where applicable.

If you are an employee of a Customer, please send requests about your employee records to your employer first, since they control that data. We will assist the Customer in responding. We may charge a fee permitted by the PDPA for data access requests and will reply within the time the law requires. You may also complain to the Personal Data Protection Commissioner of Malaysia.

10. Children

The Service is not intended for anyone under 18. We do not knowingly collect personal data from children except where a Customer records it as part of an employee's dependant information for tax relief purposes.

11. Links to other sites

The Service may link to websites we do not operate. We are not responsible for their content or privacy practices, so please review their policies.

12. Language

This policy is available in English and Bahasa Melayu. If there is any inconsistency, the English version prevails.

13. Changes to this policy

We may update this policy from time to time. We will post the new version on this page with a new effective date and, for material changes, notify Customers by email or in the application before the change takes effect.

14. Contact us

Erazem Sdn Bhd
Email: sales@erazemsdnbhd.com
Phone: +6016-326 2296