Privacy Policy
Synchroweb Technology (M) Sdn Bhd
Last updated: 14 October 2026
Previous version: 15 October 2021
1. About this policy
This policy explains how Synchroweb Technology (M) Sdn Bhd ("Synchroweb", "we", "us") collects, uses, discloses, retains and protects personal data.
It applies to:
this website, including our online shop;
our enquiries, quotations, support and sales relationship with business customers;
the Kiwire captive portal, RADIUS, and subscriber management platform, where we act as service provider; and
the Omaya indoor positioning and building operations platform, where we act as service provider.
This version replaces the policy dated 15 October 2021. It has been rewritten to reflect the Personal Data Protection Act 2010 (Act 709) of Malaysia as amended by the Personal Data Protection (Amendment) Act 2024, Singapore's Personal Data Protection Act 2012, and current EU and UK data protection law.
Where our commitments exceed the minimum required by any one law, we apply the higher standard.
2. Who we are
Synchroweb Technology (M) Sdn Bhd
C-1-5, Block C, Setiawalk, Persiaran Wawasan,
Pusat Bandar Puchong,
47160 Puchong, Selangor, Malaysia
Business Registration No. 200901005220 (848156-X)
Email: info@synchroweb.com
Telephone: +603-5880 5486
3. Who is the data controller
This is the single most important distinction in this policy, because it determines who is responsible for your data and who you should approach.
This website and our business relationships. Synchroweb is the data controller. We decide why and how your personal data is collected and used. This covers your use of this website, enquiries you send us, purchases from our shop, and our support relationship with you.
Kiwire and Omaya deployments. Synchroweb is normally a data processor under the Personal Data Protection Act 2010, a data intermediary under Singapore's Personal Data Protection Act, and a processor under the GDPR.
In these deployments, our customer — for example a WISP, hotel, multi-dwelling unit owner, enterprise or venue operator — decides why and how the personal data of their own users, guests, staff or visitors is collected and used. Synchroweb processes that data only on that customer's documented instructions, under a written data processing agreement, and for the purposes set out in that agreement.
What this means for you: if you connect to a Kiwire network at a hotel, campus, apartment building or other site, the operator of that site is normally the data controller of your connection and usage data. The operator's own privacy notice at that site tells you how your data is used, and it is the correct notice to read. For questions Synchroweb can answer on our own behalf — such as how the Kiwire platform itself operates — contact us using the details in section 20.
4. What we consider personal data
Under all three frameworks we apply, information is personal data where it relates to an identifiable living individual. This is broader than name and email address.
For Synchroweb's services, that expressly includes:
MAC addresses and other device or hardware identifiers;
IP addresses, whether yours alone or combined with other data;
DHCP lease and IP assignment records;
Wi-Fi association, authentication and deauthentication records;
RADIUS accounting records, including session start and end times, data volume and duration;
account and login identifiers;
social media identifiers where you sign in through a social login provider;
support tickets, correspondence and call notes; and
records of your device type, operating system and browser.
You do not have to give us your name for us to collect personal data about you. A device connecting to a network can be identified by its MAC address and IP address alone.
5. What we collect, and why
5.1 When you use this website
Automatic collection. We collect your IP address, browser type and version, operating system, device type, referring page, pages viewed, and the date and time of your visit. This is done for security, to keep the website working, and to understand how it is used.
Analytics and advertising. We use Google Analytics and Google Ads, connected through the Google tag. These services collect data about your use of this website and may use cookies to serve advertising based on your prior activity. We use Google's consent mode: if you decline analytics or advertising cookies in our cookie banner, no analytics or advertising cookies are set, but Google may still receive limited cookieless signals (for example, that a page was viewed and your consent choice) which it uses for aggregated measurement. See our Cookies Policy for how to control this.
If you use the chat on this website we record the messages you send and any name or contact details you give us, so we can answer you and follow up on your enquiry.
If you subscribe to our newsletter we record your email address and your subscription status, so we can send you the newsletter and stop when you ask.
If you contact us through a form, email or telephone we record your name, contact details and the content of your enquiry, so we can respond and keep a record of the discussion.
If you place an order in our shop we collect your name, email address, telephone number, billing address and delivery address. Payment card details are collected and processed by our payment gateway provider under a written agreement; we do not store full card numbers on our own servers.
If you create an account we collect your email address, a hashed representation of your password, and your account activity.
5.2 In our business and support relationship
We collect contact details of our business contacts — name, role, organisation, business email address, telephone number, correspondence and quotation history — so we can enter into and perform our contract with you, and comply with our legal and audit obligations.
We collect support ticket content and the diagnostic information you or an engineer share with us when you raise a support case, so we can investigate and resolve it. Please do not send us credentials, passwords or personal data of third parties in a support ticket unless it is necessary.
5.3 Kiwire platform — network connection and authentication data
When a device connects to a network running Kiwire, Kiwire processes the following in order to authenticate the connection, allocate an address, and account for usage:
device identifiers, including MAC address;
IP address allocated to the device, and DHCP lease duration;
SSID and BSSID of the access point used;
authentication outcome and the authentication method used;
RADIUS accounting records: session start and stop times, bytes transferred in and out, and session duration;
where a user registers or signs in to the captive portal, the identity provided, which may be an email address, a mobile number, a social media account identifier, or details you choose to submit.
Optional destination data. Kiwire supports optional logging of network destinations — for example DNS query records, domain-level browsing data, or per-device traffic breakdowns. Whether this is enabled depends entirely on how the site operator has configured the deployment.
This is the site operator's decision, not ours. If the operator of the network you are connecting to has enabled destination logging, the operator is the data controller for that data and is responsible for its collection, retention and disclosure. Synchroweb processes and stores it only on that operator's instructions.
If you wish to know whether destination logging is enabled on the network you are connected to, ask the network operator. If it is enabled and you wish to access, correct or delete the data, contact the operator as the data controller. You can also contact us and we will route your request to the relevant operator, or handle it ourselves where we are the controller.
5.4 Kiwire platform — social login
If you sign in to a Kiwire captive portal using a third-party account such as Facebook or Google, the provider returns the profile details you have chosen to share. Kiwire creates and stores its own account record based on the details returned by the provider. We do not receive or store your social media password.
Deleting your activity with the provider, or unlinking the app, does not by itself delete the Kiwire account created from those details. To delete the Kiwire account and everything we hold as a result, follow the instructions in section 19.
5.5 Omaya platform
The Omaya platform processes data about positioning, movement and, where deployed, building and operational events. What is collected depends on the specific deployment and the sensors enabled at that site. In every deployment the site operator determines the purposes and is the data controller; Synchroweb acts as processor on that operator's instructions.
5.6 Our AI-assisted operational tools
Synchroweb uses AI-assisted operational tooling internally to monitor service health, detect anomalies and summarise operational data. These tools operate on operational and telemetry data, are restricted by role-based access controls, and are used by our staff. We do not use your personal data to train third-party AI models. See section 15 for what happens when you interact with an AI system we provide.
6. Why we are allowed to use your data
Our lawful basis depends on which law applies and which processing activity it covers. We rely on the following.
Malaysia (Personal Data Protection Act 2010 as amended). We process personal data with your consent, and where consent is not required, where processing is necessary for the performance of a contract with you, for steps taken at your request before entering into a contract, for compliance with a legal obligation, to protect your vital interests, for the administration of justice, or for the exercise of a statutory function. Where we rely on consent, we record it so that we can demonstrate that it was given.
Singapore (Personal Data Protection Act 2012). We comply with the consent, purpose limitation, notification, access and correction, accuracy, protection, retention limitation, transfer limitation, data breach notification and accountability obligations. Where consent is required, we obtain it, and we do not use your data beyond the purposes notified to you at or before collection.
European and United Kingdom (GDPR / UK GDPR). We rely on consent; performance of a contract or steps at your request prior to one; compliance with a legal obligation; protection of your vital interests; and our legitimate interests in securing and operating our network and protecting our services, balanced against your rights. For the Kiwire and Omaya platforms, where we act as processor, our customer determines the lawful basis and we act on their instructions.
Direct marketing. We only send direct marketing where we have a lawful basis to do so. Where you have an existing relationship with us, this may be permitted without separate consent; otherwise we ask first. Every direct marketing message includes a way to unsubscribe, and you can ask us to stop using your data for marketing at any time by contacting us. Under the Malaysian Personal Data Protection Act you may require us to cease processing your personal data for direct marketing purposes at any time by written notice.
7. Sensitive personal data
Sensitive personal data is information about an individual's health or physical or mental condition, political opinions, religious or philosophical beliefs, biometric data, the commission or alleged commission of an offence, or any other category designated by the Minister.
Since 1 January 2025, biometric data is expressly classified as sensitive personal data under the amended Malaysian Personal Data Protection Act.
Our position is that we do not seek to collect sensitive personal data. We do not use biometric identification in the Kiwire captive portal, and we do not ask for health, religious, political or biometric information.
If you voluntarily include sensitive personal data in a support ticket or an email, we will process it only to the extent necessary to resolve your request, and we ask that you avoid doing so.
8. Who we share your data with
We do not sell your personal data.
On this website and in our business relationship, we share personal data only with the categories of provider below, and only where they are needed to deliver the service:
our website hosting and platform provider (Wix.com), which also provides the website chat, forms and online shop;
our payment gateway provider, for payment processing;
Google Analytics and Google Ads, for analytics and advertising, subject to your cookie choices;
our email and business communications providers;
professional advisers, auditors and insurers;
and public authorities where we are required to disclose by law.
In Kiwire and Omaya deployments, we share data only as the site operator instructs. We disclose it to our own infrastructure and hosting sub-processors necessary to run the platform, and we may disclose it to the site operator's nominated payment, identity or messaging providers.
Legal and security disclosure. We may disclose personal data where we believe we are required to do so by law, to enforce our agreements, or to protect the rights, property or safety of Synchroweb, our customers or others. Where we are not legally prohibited from doing so, we will take reasonable steps to notify the affected data subject before disclosure.
Aggregated and de-identified data. We may use aggregated or de-identified information for capacity planning, service performance analysis and improving our products. We take reasonable steps to ensure it cannot reasonably be used to identify an individual, and we will not attempt to re-identify it.
9. International transfers
Some of our service providers are located outside Malaysia and Singapore. Where personal data is transferred across borders, we rely on an appropriate transfer mechanism.
From Malaysia, the amended Personal Data Protection Act allows a transfer where the destination has laws substantially similar to the Act, or where the destination ensures an adequate level of protection at least equivalent to the Act. A transfer is also permitted where the data subject has consented, where the transfer is necessary for performance of a contract with the data subject, where we have taken all reasonable steps and exercised due diligence to ensure the data will not be processed inconsistently with the Act, or where the transfer is necessary to protect the data subject's vital interests. We do not maintain a whitelisted list of countries for transfers out of Malaysia; we assess each transfer on its own basis.
From Singapore, we comply with the transfer limitation obligation and ensure that the standard of protection in the receiving country is comparable to that under Singapore's Personal Data Protection Act.
From the EEA or UK, where we transfer personal data to a country that does not have an adequacy decision from the European Commission or the UK, we rely on Standard Contractual Clauses, Binding Corporate Rules, or another derogation permitted by Article 49 of the GDPR, supported by a transfer impact assessment.
We note that the legal position on transfers to the United States under the EU-US Data Privacy Framework is currently subject to review. Our approach is set out in section 14.
10. How long we keep your data
We keep personal data only for as long as it is necessary for the purposes for which it was collected, or as required by law.
Indicative periods are set out below. Where a deployment's actual retention is configured differently by the site operator, the operator's configuration and notice apply.
Enquiry, quotation and correspondence records: Duration of the business relationship plus 7 years
Shop orders and invoices: 7 years
Newsletter subscription: Until you unsubscribe
Support tickets: 24 months after last activity
Website analytics and server logs: Up to 14 months
Kiwire / Omaya platform operational data: As instructed by the site operator
RADIUS accounting and session records are retained for the period required by the site operator for billing, bandwidth accounting, lawful interception and regulatory purposes. We do not set that period ourselves. Where no instruction exists, we keep them only for as long as needed to run and support the service, and delete them when the service ends or when the site operator asks us to.
When data is no longer needed, we delete it or convert it into a form that cannot identify an individual. Retention requirements under Malaysian law, including those applicable to communications operators, override our deletion schedule.
11. Your rights
11.1 Malaysia
Under the Personal Data Protection Act 2010 as amended, you have the right to:
be informed of the purposes for which your personal data is collected and the categories of data concerned;
access the personal data we hold about you;
require us to correct personal data that is inaccurate, incomplete, misleading or out of date;
withdraw your consent to any processing, where we rely on consent;
require us to cease or not begin processing that is causing, or is likely to cause, substantial damage or substantial distress to you or another person, where that is unwarranted;
require us to transmit your personal data to another data controller of your choice, by electronic means, where technically feasible and where the data format is compatible. This right has applied since 1 June 2025;
refuse, or require us to cease, processing of your personal data for direct marketing purposes; and
complain to the Commissioner for the Administration of Data Protection Law if you believe we have not complied with the Act.
You also have a right, where processing is based on consent, to withdraw consent as easily as you gave it.
11.2 Singapore
Under Singapore's Personal Data Protection Act, you have the right to:
be notified of the purposes for which we collect, use and disclose your personal data;
access personal data in our possession or under our control, and correct any inaccuracy;
withdraw consent, where processing is based on consent;
and complain to the Personal Data Protection Commission of Singapore.
11.3 European Union and United Kingdom
Where the GDPR or UK GDPR applies, you have the right to:
access your personal data;
request rectification of inaccurate data and erasure of data where no longer necessary;
request restriction of processing;
request portability of your data in a structured, commonly used, machine-readable format;
object to processing based on legitimate interests, and to direct marketing at any time;
withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal;
not be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects about you, subject to statutory exceptions;
lodge a complaint with your local supervisory authority or the Information Commissioner's Office in the UK; and
bring proceedings before a competent court or tribunal if your rights are infringed.
11.4 How to exercise your rights
Email info@synchroweb.com or write to us at the address in section 2. We will ask you to verify your identity before acting on a request, and we will respond within the period required by the law that applies to your request — 21 days for access and correction requests under the Malaysian Act, as soon as reasonably possible (normally within 30 days) under the Singapore Act, and one month under the GDPR, extendable by two further months for complex requests where we notify you.
If your data is held by a Kiwire or Omaya site operator rather than by us, forward your request to that operator, who is the data controller. We will assist in routing it. Contact us and we will help identify the relevant operator.
We do not charge a fee for a reasonable request. We may charge a reasonable administrative cost, or refuse a manifestly unfounded or excessive request, where the law allows.
12. Children
We do not knowingly and do not intentionally collect personal data from children, and we do not market to children.
Kiwire and Omaya networks are frequently used by people under 18, and a network may be used by a child with a parent's permission. We process the connection data described in section 5.3 in order to run the network, under the site operator's instruction.
Under the Malaysian Personal Data Protection Regulations 2013, where we are the data controller and consent is required from a person under 18 years of age, we must obtain consent from the parent, guardian or person with parental responsibility. In our website context we do not knowingly collect data from anyone under 18, and where we become aware that data was collected from a child without the required consent, we delete it.
Where the site operator of a network has a policy in place for users under a given age, that policy applies to that network and the operator is responsible for it.
13. Cookies
We use cookies and similar technologies to operate the website and to understand how it is used. These include cookies required for the site to function and cookies set for analytics and advertising.
You can control cookies through your browser settings and through the cookie settings on this website. Disabling some cookies will not affect your access to information, but may mean that some services do not function properly. Placing orders in our shop will not be affected.
See our Cookies Policy for detail, and Cookie Settings to change your choices.
14. Transfers to the United States
If you are in the European Economic Area or the United Kingdom and your personal data is transferred to the United States, we rely on the transfer mechanisms described in section 9.
We want to be straightforward about the current position, because it is unsettled. The EU-US Data Privacy Framework, which permits transfers to certified US organisations without additional safeguards, remains in force and was upheld by the EU General Court in September 2025, but it continues to face legal challenge and review.
We have therefore retained Standard Contractual Clauses and a transfer impact assessment for United States transfers, rather than relying on the Framework alone. If the Framework is suspended, amended or annulled, we will not lose our lawful basis for those transfers. See section 17 for how we will notify you of changes that affect you.
15. Automated decision-making and AI systems
Our own decisions. We do not use automated decision-making that produces legal or similarly significant effects about you in our website operations. If that changes, we will tell you and give you the right to obtain human intervention.
AI systems provided to you. Where Synchroweb provides you with an AI system that interacts with you directly, we are required under EU law to inform you that you are interacting with an AI system, unless it is obvious to a reasonably well-informed person that you are. We do so in the interface itself. Where an AI system is deployed at a site by a customer of ours, that customer is responsible for that disclosure.
AI and your personal data. We do not use your personal data to train third-party AI models. AI-assisted operational tools operate under role-based access controls and are used by our staff, with queries and outputs reviewed by those staff rather than applied automatically.
16. How we protect your information
Websites and services are encrypted in transit using TLS (HTTPS).
Administrative and platform access is restricted by role-based access control and is subject to authentication. For customer sites, we strongly recommend individual named accounts rather than shared credentials.
Production systems are separated from other environments.
Backups are maintained and restore capability is tested.
We monitor for malware, security weaknesses and known vulnerabilities.
We review and update our platforms on an ongoing basis.
Access to personal data is limited to those whose role requires it, and those individuals are bound by confidentiality.
Payment card data is handled by our payment gateway provider under a written agreement and is not stored on our own servers.
No system is perfectly secure. If a compromise affects your personal data, we will handle it under section 18.
17. Changes to this policy
We review this policy at least annually, and whenever we make a material change to how we handle personal data or when the law changes.
Where we make a significant change, we will notify you by an appropriate means, which may include notice on this page, an email to business contacts, or an in-product notice. We will ask for further consent where the change requires it.
18. Data breach notification
If a personal data breach affects us, we will respond as follows.
Malaysia. Since 1 June 2025, data controllers must notify the Commissioner of a personal data breach as soon as practicable, and must notify the affected data subject without unnecessary delay where the breach causes or is likely to cause significant harm. Failure to comply can result in a fine of up to RM250,000 and/or imprisonment of up to 2 years. We will cooperate with the Commissioner and will make available the information it requires.
Singapore. We assess whether a breach is notifiable. A breach is notifiable if it results in, or is likely to result in, significant harm to an affected individual, or if it is or is likely to be of significant scale. Where a breach is notifiable, we notify the Personal Data Protection Commission no later than three calendar days after we determine that it is notifiable, and we notify affected individuals as soon as practicable, at the same time as or after notifying the Commission. Where we act as a data intermediary for a customer, we notify that customer without undue delay on detecting a breach.
European Union and United Kingdom. We notify the relevant supervisory authority within 72 hours of becoming aware of a breach where the breach is likely to result in a risk to the rights and freedoms of individuals, and we notify affected individuals without undue delay where the breach is likely to result in a high risk to them.
Our internal target is to notify affected individuals and, where required, regulators as quickly as the circumstances allow and always within the periods above.
If you are a Kiwire or Omaya user and your data is held by a site operator, the operator is responsible for notification to you and to the regulator for that processing. Synchroweb will notify the operator promptly so they can meet their own deadlines.
19. Data deletion — Kiwire and social login
This section applies to the Kiwire Wifi application and social login data.
When you sign in to Kiwire using a third-party account, Kiwire creates a Kiwire account using the details returned by that provider. Deleting your details with the provider means deleting the Kiwire account as well. When the Kiwire account is deleted, the details we stored from that provider are deleted.
To remove your Kiwire activity through Facebook:
Go to your Facebook account's Settings & Privacy, then select Settings.
Go to Apps and Websites, where you will see the apps and websites linked to your Facebook account.
Select the Kiwire Wifi app and click Remove.
Mark the option boxes according to your preference and click Remove again.
You have now removed Kiwire Wifi from your Facebook activities.
To have the Kiwire Wifi application delete all information it holds from Facebook, email info@synchroweb.com with the subject "Kiwire Wifi data deletion request". After removing the app, Facebook shows you a User ID — please include it, together with the name of the site or Wi-Fi network you used, so we can locate and delete the correct records.
To have any of your Kiwire data deleted, contact info@synchroweb.com or write to the address in section 2. We will need to verify your identity before deleting records. We will confirm to you when the deletion is complete.
If your account is held against a paid or active service with the site operator, we may need to coordinate deletion with that operator.
20. How to contact us, and how to complain
Synchroweb Technology (M) Sdn Bhd
C-1-5, Block C, Setiawalk, Persiaran Wawasan,
Pusat Bandar Puchong,
47160 Puchong, Selangor, Malaysia
Email: info@synchroweb.com
Telephone: +603-5880 5486
If you have a question, concern or complaint about this policy or our handling of your personal data, contact us first at the address above. We aim to acknowledge and resolve enquiries promptly.
If you are not satisfied with our response, you may complain to the regulator in your jurisdiction:
Malaysia — Commissioner for the Administration of Data Protection Law (Jabatan Perlindungan Data Peribadi). Current contact details and the complaint form are at www.pdp.gov.my.
Singapore — Personal Data Protection Commission. Current contact details and the complaint form are at www.pdpc.gov.sg.
European Union — your local data protection supervisory authority, which you can find at the European Data Protection Board's website.
United Kingdom — Information Commissioner's Office, ico.org.uk.