Skip to content
Torus

TORUSLABS PLT

Privacy Policy

This document explains how TORUSLABS PLT collects, uses, and protects your personal data — both when you simply visit or contact us through toruslabs.my, and when you register as a Member of the Torus Platform. Please read it before submitting an enquiry or a registration.

Effective Date: 14 August 2026 · Version 1.1

Contents

Scope

TORUSLABS PLT is committed to protecting your personal data in accordance with the Personal Data Protection Act 2010 (PDPA) of Malaysia. This policy explains what data we collect, why we collect it, how we use and protect it, and what rights you have. It covers two distinct relationships, and not every clause applies to everyone: Visitors and enquirers — anyone browsing toruslabs.my or sending us a message through the enquiry form, whether about Torus Assembly, Torus Virtual, Torus Academy, a partnership or a media request. If this is you, Clauses 2.5, 6 and 8 are the ones that concern you. Members — single mothers who register for and take part in the Torus community work programme. If this is you, the whole policy applies.

1. Who We Are

TORUSLABS PLT is the data controller responsible for your personal data. TORUSLABS PLT Registration No: 202604001035 (LLP0046266-LGN) Level 2, Tower 3, Avenue 7 Horizon 2 Bangsar South City, Bangsar South, 59200 Kuala Lumpur Email: alinsaramali@toruslabs.my Phone: +60 13-863 1003 Website: https://www.toruslabs.my/

2. What Personal Data We Collect

2.1 Registration Information When you apply to become a Member, we collect: Full name (as per MyKad); MyKad number; Mobile phone number; Residential address; Bank account details (bank name, account number, account holder name). 2.2 Identity and Eligibility Documents As part of the registration process, you upload: MyKad front and back images; A selfie photograph holding your MyKad; Proof of single mother status (divorce certificate, death certificate, or court order); Proof of residential address. These documents are used solely to verify your identity and eligibility. Once your registration is submitted, these documents are stored securely and are not accessible through the Member-facing application. 2.3 Work and Earnings Data When you participate in work through the Platform, we collect data relevant to that work, which may include: Work assignments accepted and completed; Payment amounts calculated and credited; Savings amounts deducted or accrued; Quality assessments and outcomes; Withdrawal requests and payment references; Any disputes raised and their outcomes. 2.4 Platform Activity Data We collect limited technical and usage data to operate and maintain the Platform, including: In-app actions and timestamps; Device type and operating system version; Notification delivery status; Login and session activity. 2.5 Website Enquiry Data If you send us a message through the enquiry form at toruslabs.my/contact, we collect only what you type into it: your name, your email address, your phone number if you choose to give one, the reason for your enquiry, the language you were reading the site in, and your message. You do not need an account and we do not ask for identity documents to make an enquiry. Enquiries are delivered straight to our team as a message and are not written to any customer database. Registration for the community work programme is collected through a Google Form; the data you enter there reaches us through that form and is then handled as Registration Information under Clause 2.1.

3. Why We Collect and Use Your Data

We collect and process your personal data to: Verify your identity and confirm your eligibility as a Member; Create and manage your Member account on the Platform; Make work opportunities available to you and manage your participation; Calculate and process payments for completed work; Operate your Wallet and process withdrawal requests; Manage any savings arrangements applicable to your work; Send you operational notifications relevant to your account and work; Maintain audit records for accountability, dispute resolution, and governance; Detect and prevent fraud or misuse of the Platform; Comply with our legal and regulatory obligations under Malaysian law; Improve the Platform and our services over time.

4. Legal Basis for Processing

We process your personal data on the following bases under the PDPA 2010: Consent — You give explicit consent when you submit your registration and confirm the consent statement at sign-up. You may withdraw consent at any time (see Clause 7), subject to legal or contractual constraints. Contractual Necessity — Processing is necessary to fulfil our obligations to you, including managing your account, processing payments, and providing access to work opportunities. Legal Obligation — Certain data must be retained to comply with applicable Malaysian law, including record-keeping and anti-money laundering requirements.

5. How We Store and Protect Your Data

5.1 All personal data is stored on secure, encrypted servers. We apply appropriate technical and organisational measures to protect your data against unauthorised access, loss, alteration, or disclosure. 5.2 Your KYC documents are accessible only to authorised administrative staff and are not visible through the Member-facing application after submission. 5.3 Your bank account details are stored in encrypted form and accessed only for payment processing. 5.4 We retain your personal data for as long as your account is active. After account closure, we retain your data for seven (7) years in accordance with Malaysian record-keeping requirements, or longer if required by law. Website enquiries are not account data: we keep them only for as long as we need to answer you and to keep a record of the conversation, and you can ask us to delete yours at any time using the contact details in Clause 10. 5.5 In the event of a data breach likely to affect you, we will notify you and the relevant authority in accordance with our obligations under the PDPA.

6. Who We Share Your Data With

We do not sell, rent, or trade your personal data. We share it only in the following limited circumstances: Group Leaders and Hub Managers — Where relevant to your work, they may access limited operational data. They do not have access to your KYC documents or financial account details. Payment Partners — Your bank account details are shared with payment processing partners solely for the purpose of disbursing your earnings and withdrawals. Technology Service Providers — We engage third-party providers for hosting, data storage, and application services. They process data on our behalf under strict agreements and may not use your data for any other purpose. For the website specifically, these are: Vercel Inc. (website hosting and delivery); Google LLC (Google Forms, which collects programme registrations, and Google Analytics, described in Clause 8); and Telegram Messenger, through which enquiry-form messages are delivered to our team. Some of these providers operate servers outside Malaysia, which means an enquiry or registration you send may be processed abroad. Regulatory and Law Enforcement Authorities — We may disclose your data to Malaysian authorities if required by law, court order, or valid government directive.

7. Your Rights

Under the PDPA 2010, you have the right to: Access the personal data we hold about you; Request correction of inaccurate or incomplete data; Withdraw your consent to processing at any time (note: this may affect your ability to use the Platform); Request that we restrict processing of your data in certain circumstances. To exercise any of these rights, contact us at alinsaramali@toruslabs.my or +60 13-863 1003. We will respond within twenty-one (21) calendar days. If you are not satisfied with our response, you may refer your complaint to the Department of Personal Data Protection Malaysia (JPDP) at www.pdp.gov.my.

8. Website, Cookies and Analytics

8.1 Website analytics This website uses Google Analytics 4 to understand how people find and move through toruslabs.my — which pages are read, which are ignored, and roughly where visitors are in the world. Google Analytics sets cookies in your browser and processes a truncated version of your IP address on our behalf. We use it to improve the site; we do not use it to build advertising profiles, and we do not run advertising or remarketing tags. 8.2 Cookies we set The only cookies placed by this website are the Google Analytics cookies described above. We do not use cookies to log you in, and we do not use a cookie to remember your language — the language you choose is carried in the page address instead. You can block or delete these cookies through your browser settings, or use Google's opt-out browser add-on, without losing access to any part of the site. 8.3 Mobile application The Torus mobile application is separate from this website. It collects only the data necessary to operate the Platform. We do not use advertising identifiers, third-party tracking tools, or behavioural analytics in the Member-facing application. Location data is not collected unless you explicitly grant permission and a specific feature requires it.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Members will be notified of material changes via in-app notification or SMS at least fourteen (14) days before they take effect. For visitors, the current version is always published at https://www.toruslabs.my/register/privacy with its version number and effective date at the top, so you can see whether anything has changed since you last read it. Continued use of the website or the Platform after the effective date constitutes acceptance of the updated policy.

10. Contact

TORUSLABS PLT Level 2, Tower 3, Avenue 7 Horizon 2 Bangsar South City, Bangsar South, 59200 Kuala Lumpur Email: alinsaramali@toruslabs.my Phone: +60 13-863 1003 Website: https://www.toruslabs.my/

Back to Registration

TORUSLABS PLT · Registration No: 202604001035 (LLP0046266-LGN) · Level 2, Tower 3, Avenue 7 Horizon 2 Bangsar South City, Bangsar South, 59200 Kuala Lumpur