Privacy Policy

1. About this policy

This policy explains how Rooftop Energy Tech Sdn Bhd handles personal data in rooftopIQ, an app for solar EPC (engineering, procurement and construction) companies, and on the rooftopIQ website.

It is written to meet Malaysia's Personal Data Protection Act 2010, as amended in 2024 (the "PDPA"), which applies to all our processing. rooftopIQ is used across Southeast Asia, so section 16 sets out what also applies if you are in Brunei, Indonesia, the Philippines, Singapore or Thailand. [TBC: Vietnam, held back until counsel advises.]

This policy is published in English and in Bahasa Malaysia. [TBC by counsel: a Bahasa Indonesia version, and which version prevails if they differ.]

2. Who we are

rooftopIQ is provided by Rooftop Energy Tech Sdn Bhd (registration number 202501013544 (1614958-P)), a company registered in Malaysia ("we", "us", "our"). Our address is 3-2, Block D2, Jalan PJU 1/39, Dataran Prima, 47301 Petaling Jaya, Selangor, Malaysia.

Our Data Protection Officer answers questions and requests about personal data at jonsh@rooftop.my.

3. Your organisation's data

Work in rooftopIQ belongs to an organisation, usually a company. The organisation decides what goes in, who can see it and how long it stays. Its admins manage its members.

When a company enters data about its own customers, contacts or partners, the company controls that data, and we process it on the company's behalf under our terms with the company. If you are one of those people and want to see, correct or remove your data, ask the company first. We will help the company answer you.

For your own rooftopIQ account, and for visitors to our website, we decide how your data is handled, as this policy sets out.

4. What we collect

Account data. Your name and email address. If you sign up, the name of your company. Your profile photo, if you add one. If you sign in with Google, the name and email address on your Google account. Your password and sign-in codes are held by our sign-in provider.

Organisation data. Your organisation's name, its country and email domain, its members, and their roles and teams.

Content you put in. Projects, deals, tasks, files, photos, voice notes, notes, calendar events and chat messages. This can include details of customers and contacts that you or your colleagues enter, such as names, identity card or company registration numbers, email addresses, phone numbers, addresses and site locations.

Consent records. When you sign up, we record that you agreed to our Terms of Service and this policy, which version you agreed to, when, a one-way hash of your IP address and your browser's user agent.

Technical data. Your IP address, your device and browser type, and when you sign in. We use your IP address to protect sign-in and sign-up from abuse.

Notifications. If you turn on notifications, the address your browser or phone gives us to deliver them, and the text of each notification.

Messages to us. What you send when you email us or give us feedback.

5. Where it comes from

• From you.
• From your organisation's admins and colleagues, when they invite you or add you to work.
• From Google, if you sign in with Google.
• For a company's customers and contacts, from the company that enters them.

6. What you must give us

To create an account, you must give us your name and email address and accept our Terms of Service and this policy. Without them, we cannot provide rooftopIQ to you. Everything else is optional, though some features need it to work.

7. Cookies

The app uses cookies only to keep you signed in and to complete sign-in securely. A sign-in cookie lasts up to 30 days. None is used for advertising or tracking, and the app has no analytics.

8. Why we use it, and on what basis

• To provide rooftopIQ. We use your data to create your account, run your organisation's workspace, and deliver messages and notifications.
• To keep rooftopIQ secure. We use technical data to prevent fraud and abuse, to protect accounts and to keep an audit record.
• To improve rooftopIQ. rooftopIQ is in beta. We review how it is used, from the records the service already keeps, to find and fix problems and to decide what to build next. We may contact you to ask for feedback or to invite you to an interview. You can tell us at any time that you do not want to be contacted for feedback.
• To meet the law. We keep and disclose data when the law requires it.

Under the PDPA, we rely on the consent you give when you sign up, and on what is necessary to perform our contract with you or your organisation. You can withdraw your consent at any time; some features may then stop working. Where the law of your country recognises other bases, section 16 states which one we rely on. [TBC by counsel: the basis for security and product improvement in each country.]

We do not sell personal data, and we do not use it for advertising.

9. Who we share it with

We share personal data only with service providers that help us run rooftopIQ, and only as much as each one needs.

• Hosting, file storage, backups and logs: Amazon Web Services.
• Database: Tiger Cloud (TimescaleDB).
• Network security: Cloudflare.
• Accounts and sign-in: WorkOS, and Google if you choose to sign in with Google.
• Email delivery: Mailtrap.
• Chat: Stream.
• Notifications: Apple, Google or your browser's push service.
• GIF search in chat: Giphy.
• Fonts and emoji images, loaded by your browser: Google Fonts and jsDelivr.

When a chat message includes a link, Stream fetches the linked page to build a preview, and your browser loads the preview image from that website.

Within rooftopIQ, other people see your data according to your organisation's settings. For example, members of a project see its chat, and your teammates may see when you are busy.

We may also disclose data when the law requires it, or to protect the rights and safety of our users or of us.

10. International transfers

We host rooftopIQ in Singapore, in Amazon Web Services' Asia Pacific (Singapore) region. [TBC: confirm the Tiger Cloud database is in Singapore too.] Our providers process data in Singapore, the United States and other countries, so your data leaves your country, including when you are in Malaysia.

Each provider handles the data under its data processing terms with us. [TBC: confirm each provider's terms are in place, and with counsel, whether they meet each country's rules for transfers abroad.]

11. How long we keep it

We keep your account data while your account is active. We keep your organisation's content while the organisation uses rooftopIQ, or until its admins delete it.

When you ask us to delete your account, we delete your account, chat messages, notifications, notification addresses and sessions within 30 days of confirming the request. We keep the following after that:

• Security audit records, for seven years. They identify people only by internal IDs.
• A record of changes made in rooftopIQ, such as who edited a deal or was assigned a task, for [TBC: retention period].
• Data that the law requires us to keep, for as long as it requires.

Content you created inside an organisation, such as deals and tasks, stays with that organisation, because the organisation controls it.

To close an organisation's workspace, one of its admins emails our Data Protection Officer. On request, we first send the admin an export of the organisation's content. We then delete the organisation's content, including uploaded files, within 30 days. [TBC: confirm the staff process can meet this.]

Deleted data stays in our backups until they expire, for up to [TBC: backup retention period].

12. How we protect it

• Data travels over encrypted connections (HTTPS), and files are stored encrypted.
• Names, email addresses and phone numbers in user accounts and contacts, and the text of chat messages, are encrypted in our database.
• Access inside each organisation is limited by role.

No system is perfectly secure.

13. Your rights

Where the law that applies to you gives you the right, you can:

• Access your personal data: get a copy, and ask where we obtained it and how we have used or disclosed it.
• Correct it. You can edit your name and profile in the app, or ask us.
• Delete it, or have it anonymised. Section 11 sets out what we delete and what we keep.
• Limit or object to how we use it, including processing that is likely to cause you damage or distress, and decisions made only by automated processing.
• Take it with you, where that is technically feasible.
• Withdraw consent. We tell you what this means for your use of rooftopIQ.
• Claim compensation for harm caused by a breach of the law.
• Stop feedback requests. We stop contacting you for feedback.

Someone you authorise, or in some countries your heirs, can make a request for you. To use any of these rights, email our Data Protection Officer at jonsh@rooftop.my. We may need to confirm who you are first. We answer within 21 days. If you are unhappy with our answer, you can complain to the data protection authority listed for your country in section 16.

14. Children

rooftopIQ is for businesses and is not meant for anyone under 18. We do not knowingly collect children's data. If you think a child has given us personal data, email us and we will delete it.

15. Changes to this policy

We may update this policy. The version and date at the top of this page show which version applies. If we make a significant change, we will tell you by email or in the app before it takes effect, and where the change needs your consent, we will ask for it again in the app.

16. Where you are

Malaysia. The PDPA applies. You can complain to the Personal Data Protection Commissioner (pdp.gov.my).

Singapore. The Personal Data Protection Act 2012 also applies. We rely on the legitimate interests and business improvement exceptions for security and for improving rooftopIQ. [TBC by counsel.] You can complain to the Personal Data Protection Commission (pdpc.gov.sg).

Brunei. The Personal Data Protection Order, 2025 also applies. You can complain to the Authority for Info-communications Technology Industry of Brunei Darussalam (AITI) (pdp.aiti.gov.bn).

Indonesia. Law No. 27 of 2022 on Personal Data Protection also applies. We rely on legitimate interests for security. You can complain to the personal data protection agency, or, until it is formed, the Ministry of Communication and Digital Affairs (Komdigi).

Thailand. The Personal Data Protection Act B.E. 2562 (2019) also applies. We rely on our contract with you or your organisation to provide rooftopIQ, and on legitimate interests for security and for improving rooftopIQ. [TBC by counsel: whether a representative in Thailand is required, and the minimum age, since Thai law treats people under 20 as minors.] You can complain to the Personal Data Protection Committee (pdpc.or.th).

The Philippines. The Data Privacy Act of 2012 also applies. We rely on our contract with you or your organisation, and on legitimate interests for security and for improving rooftopIQ. Government-issued identification numbers are sensitive personal information, so a company that enters its customers' identification numbers needs their specific consent. You can complain to the National Privacy Commission (privacy.gov.ph).