| Description | Qty | Unit Price (RM) | Amount (RM) |
|---|
| Description | Qty | Unit Price (RM) | Amount (RM) |
|---|
| Description | Qty | Unit Price (RM) | Amount (RM) |
|---|
| Description | Qty | Unit Price (RM) | Amount (RM) |
|---|
| Item | Category | Unit | Current Qty | Min Qty | Cost/Unit (RM) | Value (RM) | Status |
|---|
| Ingredient | Qty | Unit | Cost/Unit (RM) | Line Cost (RM) |
|---|
• Dates in YYYY-MM-DD format (e.g. 2024-03-15)
• Amounts as numbers only, no RM symbol (e.g. 3000.00)
• Encoding: UTF-8 (save as CSV UTF-8 from Excel)
• Max file size: 10MB per import
| Staff ID | Name | Bank Account | Net Pay (RM) | Include |
|---|---|---|---|---|
No payment data
Add staff bank accounts in Staff Directory, run payroll, then click "Load from Register".
| ||||
1. Introduction
UrusKu ("we", "our", "the Platform") is a business management tool designed for Malaysian SMEs. This Privacy Notice explains how we collect, use, store, and protect personal data in compliance with the Personal Data Protection Act 2010 (PDPA) and its 2024 amendments.
Ref: PDPA 2010, Section 7 — Notice and Choice Principle
2. Data We Collect
Company data: Business name, SSM number, address, bank details, tax registration numbers.
Employee data: Full name, IC number (NRIC), salary and wage information, bank account details, EPF/SOCSO/EIS contribution numbers, leave records, attendance records, and employment documents.
Financial data: Invoices, quotations, receipts, credit notes, claims, income and expense records.
Ref: Section 6 — General Principle; Section 40 — Sensitive Personal Data
3. Purpose of Processing
Your data is processed for: payroll generation and statutory calculations (EPF, SOCSO, EIS, PCB); generating statutory submission files (Borang A, 8A, CP39, EIS); issuing business documents (invoices, quotations, receipts, payslips, offer letters); leave and attendance tracking; financial budgeting and reporting; and compliance with Malaysian employment and tax laws.
Ref: Section 6(1) — Processing must be for a lawful purpose directly related to the activity
4. Data Storage & Security
Local mode (default): All data is stored in your browser's localStorage on your device. No data is transmitted to any server. You are responsible for the security of your device.
Cloud sync (optional, future): When enabled, data will be synced to Supabase (hosted in Singapore). This constitutes a cross-border data transfer under Section 129 of the PDPA. By enabling cloud sync, you consent to this transfer.
We implement reasonable security measures in accordance with the Security Principle. However, localStorage is not encrypted — for enhanced security, we recommend enabling device-level encryption and using strong passwords.
Ref: Section 9 — Security Principle; Section 129 — Transfer of Personal Data to Places Outside Malaysia
5. Data Disclosure
UrusKu does not share, sell, or disclose personal data to third parties. Data may only be disclosed to: statutory bodies (EPF/KWSP, SOCSO/PERKESO, EIS/SIP, LHDN) via files generated by the user; and cloud infrastructure providers (Supabase) if cloud sync is enabled.
Ref: Section 8 — Disclosure Principle
6. Data Retention
Data is retained in accordance with Malaysian statutory requirements: payroll and tax records — 7 years (Income Tax Act 1967); EPF/SOCSO/EIS records — 6 years; employment records — 6 years after cessation (Employment Act 1955); financial documents — 7 years (Companies Act 2016). You may delete data at any time via the Archive & Migration page.
Ref: Section 10 — Retention Principle
7. Your Rights
Under the PDPA, you have the right to: access your personal data (Section 30); request correction of inaccurate data (Section 34); withdraw consent at any time (Section 38) — note that withdrawal may affect the functionality of the Platform; request deletion of your data; and be informed of any data breach affecting your personal data (2024 Amendment — mandatory data breach notification).
Ref: Sections 30, 34, 38, 42; PDPA (Amendment) 2024
8. Data Controller vs Data Processor
UrusKu operates as a Data Processor. The organisation using UrusKu (the SME owner/employer) is the Data Controller and is responsible for their own PDPA obligations toward their employees, including obtaining employee consent for data processing.
Ref: PDPA (Amendment) 2024 — Data Processor obligations under the Security Principle
9. Statutory Calculations Disclaimer
All statutory calculations provided by UrusKu (including EPF, SOCSO, EIS, and PCB/MTD rates) are for reference purposes only. UrusKu is not a licensed tax agent, auditor, or financial advisor. All figures must be verified against official government tables and rates before submission. UrusKu shall not be liable for any penalties, fines, or losses arising from reliance on its calculations without independent verification.
10. Contact & Complaints
For data protection inquiries, contact us at: privacy@urusku.my
To lodge a complaint, you may contact the Department of Personal Data Protection (JPDP): https://www.pdp.gov.my
Last updated: April 2026 · PDPA Notice Version 1.0