Privacy Policy

This policy explains what www.clms.cc collects when you visit it, why, and what you can ask us to do about it. The site is operated by ES Vision, Malaysia (“ES Vision”, “we”, “us”), and for the purposes of Malaysia’s Personal Data Protection Act 2010 (“PDPA”) we are the data user for the personal data described here.

This policy covers the marketing website only. Personal data inside a CLMS Cloud workspace — your borrowers, your staff, your loan records — is a separate matter: there you are the data user and we process it on your instructions under the agreement that governs your subscription. Nothing in this policy grants us any right to use workspace data for our own purposes.

1. What we collect

Information you give us

When you submit the contact form we collect your name, company, work email, WhatsApp or phone number, country, the topic you choose and your message, together with a hidden field recording which part of the site you came from.

When you start a trial through the sign-up form we collect your company name, chosen workspace address, country, business type, your name, phone, work email and a password, plus the currency and time zone derived from your country and any campaign tags (utm_*) in the link that brought you.

If a form cannot reach our server it offers to hand your message to WhatsApp instead, with the details pre-filled, so you can review and send it yourself. Your password is never included in that fallback.

Information collected automatically

• Server and network logs. Our hosting and our content delivery network record the usual technical data — IP address, time, page requested, browser and referring page — to serve the site and protect it from abuse.
• Approximate country. To show prices in your local currency the page asks our content delivery network which country the request came from. It returns a two-letter country code and nothing more. If that is unavailable we fall back to your browser’s time zone, and then to Malaysia. No location is stored on our side.
• Browser storage. The site stores two small values in your browser: your chosen language and your chosen pricing country. They stay on your device, are readable only by this site, and are never sent to us. Clearing your browser data removes them.
• Anti-bot check. Our forms use Cloudflare Turnstile, which looks at signals from your browser to tell people from bots. Cloudflare may set a cookie for this purpose.

Analytics and advertising

As at the date of this policy, no analytics or advertising tags are active on this site — the identifiers are blank and nothing loads. If we switch them on we expect to use Google Analytics 4, Google Ads conversion tracking and the Meta pixel, which set their own cookies and share data with those providers. We will update this policy and the date below when that happens.

2. Why we use it, and our lawful basis

We do not sell personal data, and we do not use it to make automated decisions that produce legal or similarly significant effects.

3. Who we share it with

We share personal data only with providers that help us run the site, and only as far as each needs:

We may also disclose personal data where the law requires it, or to establish or defend a legal claim.

4. Transfers outside Malaysia

The site and its data are hosted in a secured data centre within the Asia-Pacific region, matched to the business location of the customer, and the providers above operate globally, so your personal data may be processed outside Malaysia. The exact hosting location and the identity of our hosting sub-processor are disclosed on request. We use providers that offer contractual and technical protections appropriate to the data, and we transfer no more than the purpose requires.

5. How long we keep it

• Enquiries: up to 24 months after our last exchange, then deleted or anonymised.
• Trial sign-ups that never activate: up to 12 months.
• Active customers: for the life of the relationship and then as the subscription agreement and Malaysian tax and accounting law require.
• Server and security logs: short rolling periods set by our hosting and CDN providers.

6. Security

Traffic to the site is encrypted in transit. The application stores passwords as one-way bcrypt hashes, keeps customer files in private storage rather than public buckets, and takes nightly encrypted database backups. Our security page has more detail. No system is perfectly secure, and we do not claim otherwise.

7. Your rights

Under the PDPA you may ask us to give you access to the personal data we hold about you, correct it if it is wrong or incomplete, limit how we process it, or stop using it for direct marketing. You may withdraw consent at any time; that does not affect processing already carried out. Ask by emailing [email protected]. We may need to confirm your identity first, and we aim to respond within 21 days. If you are not satisfied you may complain to the Personal Data Protection Commissioner, Malaysia.

8. Children

The site is aimed at businesses and is not directed at children. We do not knowingly collect personal data from anyone under 18.

9. Changes

We may update this policy. The version published here, with the date at the foot of the page, is the one that applies. Material changes will be reflected in that date.

10. Contact

Privacy questions and PDPA requests: [email protected], or WhatsApp +60 19-443 4341. ES Vision, Malaysia.

Annex — other countries we serve

CLMS Cloud is sold across Southeast Asia. This policy is written to Malaysian law; where you are located, your own data protection law may also give you rights, and we will honour a request made under it in the same way as one made under the PDPA. The laws we have in view:

Customers who need a formal data processing agreement for the service should ask us; we provide one on request.

Last updated: 17 September 2026 · ES Vision, Malaysia · CLMS Cloud · Privacy · Terms · Security