Privacy Policy

1. Introduction

This Privacy Policy explains how Webby Link (Reg. No. 002190850-M) operating the Webby BioLinks service at biolinks.webbypage.com ("we", "us", "our", "the Service") collects, uses, discloses and protects your personal data, in compliance with the Malaysian Personal Data Protection Act 2010 (Act 709), as amended, and its principles.

By accessing or using the Service, you acknowledge that you have read and understood this Privacy Policy and consent to the collection, use and disclosure of your personal data as described below.

2. Data Controller

The data controller responsible for your personal data is:

Webby Link (Reg. No. 002190850-M)
Operating as "Webby BioLinks" · biolinks.webbypage.com
https://biolinks.webbypage.com/contact
Email: [email protected]

3. Personal Data We Collect

We may collect the following categories of personal data:

• Account and registration data — name, email address, username/password (hashed), language and timezone preferences, plan and payment records, and any profile details you provide.
• Content you create — links, BioLink pages, projects, QR codes, images, and other content you store using the Service.
• Billing and payment data — payment processor identifiers and transaction history. We do not store full payment card numbers; card data is handled by our payment processors.
• Technical and usage data — IP address, device and browser type, operating system, referral source, pages viewed, and log data generated by your use of the Service.
• Communication data — support requests, correspondence, and any information you send us through contact forms or email.
• Analytics and cookie data — data collected through cookies and similar technologies, as described in Section 8.

4. How We Collect Personal Data

We collect personal data in the following ways:

• Directly from you — when you register, sign in, create content, contact us, or make a purchase.
• Automatically — through your device and browser when you use the Service, including cookies and log data.
• From connected services — such as when you sign in through WebbyCloud (Nextcloud) or social login providers, we receive the profile information you authorise (e.g. name and email address).
• From payment processors — transaction confirmations and details needed to complete and record your payments.

5. Purposes of Processing

We use your personal data for the following purposes:

• To provide, operate and maintain the Service and your account;
• To process registrations, logins, and authentication (including secure session management);
• To process payments, invoices and refunds;
• To provide customer support and respond to enquiries;
• To protect the security and integrity of the Service, including fraud prevention and the enforcement of our Terms of Service;
• To analyse and improve the Service, its performance, and user experience (using aggregated and non-identifying data where possible);
• To comply with applicable laws, regulations, and legal requests; and
• To communicate with you about the Service, including essential service notices. Marketing communications are only sent with your consent, which you may withdraw at any time.

6. Legal Bases for Processing

Under the PDPA 2010, we process personal data on the following bases:

• Consent — where you have provided consent, which you may withdraw at any time;
• Contractual necessity — processing necessary to perform the contract with you and provide the Service;
• Legal obligation — processing required to comply with applicable laws and regulators; and
• Legitimate interests — such as protecting the Service, preventing fraud, and improving our offerings, where your rights do not override our interests.

7. Disclosure of Personal Data

We do not sell your personal data. We may disclose personal data to the following categories of recipients:

• Service providers and sub-processors — hosting and cloud infrastructure, payment processors, email delivery, analytics, uptime monitoring, AI/content tools, and WebbyCloud (Nextcloud) for single sign-on;
• Payment processors — to facilitate transactions and prevent fraud;
• Professional advisers — such as auditors, accountants and legal counsel;
• Authorities and regulators — where required or permitted by law, or to protect our rights and safety; and
• Successors — in connection with a merger, acquisition or transfer of the business.

8. Cookies and Similar Technologies

We use cookies and similar technologies to operate and improve the Service. These include:

• Necessary cookies — required for core functionality such as login and security;
• Analytics cookies — to understand usage and improve the Service; and
• Targeting cookies — where enabled, to deliver more relevant content.

You can control cookies through your browser settings and through the cookie preferences available on our website. Declining non-essential cookies may affect some features of the Service.

9. Cross-Border Transfer of Personal Data

Your personal data may be stored and processed outside Malaysia (for example, on cloud servers or through third-party service providers located overseas). Where we transfer personal data out of Malaysia, we take reasonable steps to ensure the data is protected to a standard comparable to the PDPA 2010, and we rely on your consent to such transfer in accordance with the PDPA and its Cross-Border Transfer Principle.

10. Security of Personal Data

We take reasonable administrative, technical and physical measures to safeguard your personal data against unauthorised access, alteration, disclosure, loss and misuse. These include encryption in transit, hashing of passwords, access controls, and secured infrastructure. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Retention of Personal Data

We retain personal data only for as long as necessary to fulfil the purposes described in this policy, to comply with legal or accounting obligations, or to resolve disputes and enforce our agreements. When personal data is no longer required, we delete or anonymise it in accordance with the PDPA's Retention Principle.

12. Your Rights

Under the PDPA 2010, you have the right to:

• Access your personal data held by us;
• Correct inaccurate or incomplete personal data;
• Withdraw consent to processing based on consent, at any time;
• Request that we limit processing or delete data where required by law; and
• Lodge a complaint with the Department of Personal Data Protection (Jabatan Perlindungan Data Peribadi or "PDPD") if you consider that your data protection rights have been infringed.

To exercise these rights, please contact us using the details in Section 13. We will respond within the timeframe required by law.

13. Data Protection Officer

You may contact our Data Protection Officer (DPO) in relation to any matter concerning your personal data or this Privacy Policy at:

Email: [email protected]
Subject line: "Attention: Data Protection Officer"

14. Children's Privacy

The Service is intended for users aged 18 and above. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will take steps to delete the data.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with a revised effective date. Where material changes affect your rights or how we process personal data, we will notify you through the Service or by email, where appropriate.

16. Contact Us

If you have any questions, concerns or requests regarding this Privacy Policy or your personal data, please contact us:

Webby Link (Reg. No. 002190850-M)
Webby BioLinks · biolinks.webbypage.com
Email: [email protected]

Effective date: 9 October 2026