Personal Data Protection Notice
SENTRAFLOW SOLUTION · SSM 202503342999 (PG0581026-K) · Last updated 28 July 2026
English
1. Who we are
Kira is operated by SENTRAFLOW SOLUTION, a business registered in Malaysia under SSM registration number 202503342999 (PG0581026-K). This notice is issued under section 7 of the Personal Data Protection Act 2010 (“PDPA”).
2. Two different roles — please read this part
Kira holds two kinds of personal data, and our responsibilities differ for each.
- Your account. When you sign up we collect your name, email address, a one-way hash of your password, and your company name. For this we are the data controller — we decide why it is held.
- What you put into your books. Your employees’ names, wages, NRIC or passport numbers, tax (TIN), KWSP and PERKESO numbers; your customers’ and suppliers’ names, contact details and tax numbers; your invoices, receipts, bank statement lines and ledger entries. This is mostly other people’s personal data, and we hold it as a data processor acting on your instructions. You remain the data controller for it, which means it is you — not us — who must have told those people how their data is used.
3. Why we process it
- To provide the service: bookkeeping, invoicing, payroll, SST and reporting.
- To produce statutory filings you ask for (e.g. CP39, EA, EPF and SOCSO exports, LHDN e-Invoice submissions).
- To authenticate you, keep the service secure, and investigate faults.
- To bill you for a subscription, where you have one.
We do not sell personal data, and we do not use your books to advertise to you or anyone else.
4. Sensitive personal data
Payroll data — wages, NRIC or passport numbers, and statutory identifiers — is sensitive and is treated as such. It is held to run payroll and produce the filings Malaysian law requires of an employer, and for nothing else.
5. Who else sees it
We use a small number of service providers, each for one purpose:
- Render — hosting and the database in which your data is stored.
- Resend — sending email (password resets, invoice and payslip delivery you trigger).
- Billplz — collecting subscription payments. Card and banking credentials are handled by Billplz and never reach Kira.
- Anthropic — the AI features, and only once they are switched on for your company. AI is off by default. The Ledger Copilot can read your books to answer a question; it cannot change them.
- LHDN (MyInvois) — e-Invoice submissions, when you choose to submit one.
6. Transfer outside Malaysia
Our hosting and the providers above operate outside Malaysia, so your data is stored and processed outside Malaysia. Section 129 of the PDPA permits this where the destination affords protection at least equivalent to the PDPA, or where you have consented. By using Kira you consent to that transfer. If you need your data to remain in Malaysia, Kira is not currently suitable for you, and we would rather tell you that plainly than bury it.
7. How long we keep it
While your account is open, and afterwards for as long as Malaysian law requires accounting and payroll records to be retained. Records kept for that reason are retained even if you ask for deletion, because the law requires it of you as well as of us.
8. Your rights
Under the PDPA you may:
- ask for a copy of the personal data we hold about you;
- ask us to correct it if it is wrong;
- withdraw consent, or limit how we process it — noting that this may make the service unusable;
- ask us to stop processing it for direct marketing (we do not currently do any).
If the data in question is your employer’s record of you — your wages, for instance — ask your employer, because they are the data controller and we act on their instructions.
9. Security, and a breach
Access is limited by role, the ledger is append-only and hash-chained so entries cannot be silently altered, and stored API keys are encrypted. If a personal data breach occurs we will notify the Personal Data Protection Commissioner as soon as practicable and within 72 hours, and will tell affected users where the breach is likely to cause significant harm.
10. Contact
Questions, or to exercise any right above, contact SENTRAFLOW SOLUTION at the address on your invoice or through the support channel in the app. We aim to respond within 21 days, the period the PDPA allows for a data access request.
Bahasa Malaysia
Notis ini dikeluarkan dalam dua bahasa seperti yang dikehendaki oleh seksyen 7 Akta Perlindungan Data Peribadi 2010.
1. Siapa kami
Kira dikendalikan oleh SENTRAFLOW SOLUTION, sebuah perniagaan berdaftar di Malaysia dengan nombor pendaftaran SSM 202503342999 (PG0581026-K). Notis ini dikeluarkan di bawah seksyen 7 Akta Perlindungan Data Peribadi 2010 (“APDP”).
2. Dua peranan berbeza — sila baca bahagian ini
- Akaun anda. Semasa anda mendaftar, kami mengumpul nama, alamat e-mel, cincangan sehala kata laluan anda, dan nama syarikat anda. Bagi data ini kami ialah pengawal data.
- Apa yang anda masukkan ke dalam akaun perniagaan anda. Nama, gaji, nombor kad pengenalan atau pasport, nombor cukai (TIN), KWSP dan PERKESO pekerja anda; nama dan butiran pelanggan serta pembekal anda; invois, resit, baris penyata bank dan catatan lejar. Ini kebanyakannya data peribadi orang lain, dan kami memegangnya sebagai pemproses data mengikut arahan anda. Anda kekal sebagai pengawal data bagi data tersebut.
3. Tujuan pemprosesan
- Menyediakan perkhidmatan: perakaunan, invois, penggajian, SST dan laporan.
- Menghasilkan penyerahan berkanun yang anda minta (CP39, EA, eksport KWSP dan PERKESO, penyerahan e-Invois LHDN).
- Mengesahkan identiti anda, menjaga keselamatan perkhidmatan, dan menyiasat kerosakan.
- Mengebil langganan anda, jika ada.
Kami tidak menjual data peribadi dan tidak menggunakan rekod perniagaan anda untuk pengiklanan.
4. Data peribadi sensitif
Data penggajian — gaji, nombor kad pengenalan atau pasport, dan nombor berkanun — adalah sensitif dan dikendalikan sedemikian. Ia disimpan untuk menjalankan penggajian dan menghasilkan penyerahan yang dikehendaki undang-undang Malaysia daripada seseorang majikan, dan tiada tujuan lain.
5. Pihak lain yang terlibat
- Render — pengehosan dan pangkalan data.
- Resend — penghantaran e-mel.
- Billplz — kutipan bayaran langganan. Butiran kad dan perbankan dikendalikan oleh Billplz dan tidak pernah sampai kepada Kira.
- Anthropic — ciri AI, dan hanya selepas ciri itu dihidupkan untuk syarikat anda. AI dimatikan secara lalai.
- LHDN (MyInvois) — penyerahan e-Invois, apabila anda memilih untuk menyerahkannya.
6. Pemindahan ke luar Malaysia
Pengehosan kami dan penyedia di atas beroperasi di luar Malaysia, maka data anda disimpan dan diproses di luar Malaysia. Seksyen 129 APDP membenarkan pemindahan ini apabila destinasi memberikan perlindungan sekurang-kurangnya setara dengan APDP, atau apabila anda memberikan keizinan. Dengan menggunakan Kira, anda bersetuju dengan pemindahan tersebut.
7. Tempoh penyimpanan
Sepanjang akaun anda aktif, dan selepas itu selama tempoh yang dikehendaki undang-undang Malaysia bagi penyimpanan rekod perakaunan dan penggajian. Rekod yang disimpan atas sebab tersebut kekal disimpan walaupun anda meminta pemadaman.
8. Hak anda
- meminta salinan data peribadi anda yang kami simpan;
- meminta pembetulan jika data itu tidak tepat;
- menarik balik keizinan atau menghadkan pemprosesan — perlu diingat ini boleh menyebabkan perkhidmatan tidak dapat digunakan;
- meminta kami berhenti memproses data bagi pemasaran langsung (kami tidak menjalankannya buat masa ini).
Jika data berkenaan ialah rekod majikan anda tentang anda, sila hubungi majikan anda, kerana merekalah pengawal data.
9. Keselamatan dan pelanggaran data
Capaian dihadkan mengikut peranan, lejar bersifat tambah-sahaja dan dirantai cincang supaya catatan tidak boleh diubah secara senyap, dan kunci API yang disimpan disulitkan. Sekiranya berlaku pelanggaran data peribadi, kami akan memaklumkan Pesuruhjaya Perlindungan Data Peribadi secepat mungkin dalam tempoh 72 jam, dan akan memberitahu pengguna yang terjejas apabila pelanggaran itu berkemungkinan menyebabkan kemudaratan yang ketara.
10. Hubungi kami
Untuk sebarang pertanyaan atau untuk melaksanakan hak di atas, hubungi SENTRAFLOW SOLUTION di alamat pada invois anda atau melalui saluran sokongan dalam aplikasi. Kami berhasrat untuk membalas dalam tempoh 21 hari.