Privacy Policy

Malaysian PDPA 2010 Compliance: Campus Hub is operated by QL Studio, a division of Qim Lab Enterprise (SSM: 202603007186 / 003810616-X). For the master group privacy policy, visit policies.qimlab.com.my/privacy.html.

Master Privacy

Campus Hub Privacy Policy

Personal Data Protection Notice for Student App Users and Retailer SaaS Subscribers.

1.0 Statutory Notice & Scope

This Personal Data Protection Notice is issued by Campus Hub (campushub.my), a digital product brand developed and operated by QL Studio, a software development division of Qim Lab Enterprise (Malaysian Companies Commission / SSM Registration No: 202603007186 / 003810616-X), in strict compliance with the Personal Data Protection Act 2010 of Malaysia ("PDPA").

This policy outlines how we collect, process, manage, and safeguard the personal data of students, campus residents, and app users who purchase or use in-app credits for campus services (such as printing and dobby laundry), as well as campus retail merchants subscribing to our Point of Sale (POS) and Parcel Management Systems (PMS).

2.0 Categories of Data Collected

Depending on whether you use Campus Hub as a student app user or as a commercial retailer, we collect the following categories of data:

A. For Students & Consumer App Users

Account Profile: Full name, university or college campus, student/matriculation ID number, email address, and mobile phone number.
Wallet & Credit Ledger: Current Campus Hub Credit balance, top-up receipts, payment gateway reference numbers, and transaction timestamps.
Printing & Dobby Service Logs: File metadata (e.g., page count, grayscale/color selection, submission timestamp) for automated print releases, and washing machine/dryer ID with cycle duration for dobby services.
Device Telemetry: Device model, operating system, unique app instance identifiers, and push notification tokens.

B. For Campus Retailers (POS & PMS Subscribers)

Merchant Information: Store/business name, SSM registration number, business email, contact phone number, and physical campus store location.
POS Commerce Records: Inventory listings, product categories, SKU codes, pricing, and counter sales receipt summaries.
Parcel Management Records (PMS): Courier name, incoming tracking/consignment numbers, recipient student name, recipient phone number/matric ID, check-in timestamps, and OTP/QR collection verification logs.

3.0 Camera & Device Permissions

The Campus Hub mobile app requests specific device permissions strictly to deliver core automated on-campus functionality:

Camera Permission

Requested exclusively to scan QR codes on self-service printing kiosks, smart dobby washing machines, and parcel counter verification codes. We do not capture background photos, access your photo gallery without explicit command, or stream video.

Push Notifications

Delivers critical operational updates, such as when your uploaded print job is ready for pickup, your laundry cycle is completed, or a parcel addressed to you has arrived at the campus collection hub.

4.0 Payment Processing & Zero Card Storage

Strict Payment Protection Guarantee

Campus Hub and Qim Lab Enterprise never store, log, or handle full debit/credit card numbers, CVV/CVC verification codes, or bank login passwords on our servers.

All top-up credit transactions and retailer subscriptions are processed directly through Bank Negara Malaysia (BNM) regulated payment providers and PCI-DSS Level 1 compliant gateways (supporting FPX Online Banking, DuitNow QR, and Visa/Mastercard). Encrypted webhooks inform our system of transaction completion without exposing sensitive cardholder data.

5.0 Purposes of Data Processing

We process personal data solely for legitimate, transparent operational purposes:

Administering user accounts and maintaining accurate digital credit ledger balances.
Authenticating IoT device triggers to release self-service print jobs and initiate laundry machine cycles.
Notifying students when incoming courier parcels are scanned into campus parcel hubs and verifying collection identity.
Providing campus merchants with cloud POS cashiering, inventory alerts, and sales reporting.
Investigating equipment jam reports, technical errors, and issuing prompt in-app credit reinstatements.
Fulfilling statutory tax, billing, and accounting requirements under Malaysian law.

6.0 Data Sharing & Third Parties

We do not sell, rent, or trade your personal data to third-party advertisers. We share data strictly with authorized entities where necessary to perform our services:

Licensed Payment Gateways: To authorize and settle wallet top-up transactions and SaaS subscriptions.
Cloud Infrastructure Providers: Secure database and server hosting partners operating under strict contractual confidentiality and data residency terms.
Campus Mailrooms & Retailers: Recipient student names and tracking numbers are accessible only to the authorized campus parcel hub handling package delivery.
Law Enforcement & Regulatory Authorities: Only when strictly compelled by valid legal summons, court orders, or statutory legislation in Malaysia.

7.0 Retention & Security Standards

In accordance with the master security framework of Qim Lab Enterprise:

Encryption in Transit: All HTTP traffic between our apps, websites, and cloud APIs is encrypted using TLS 1.3 / 1.2 with HSTS preloading.
Encryption at Rest: All user databases, transaction ledgers, and document queues are encrypted using AES-256 bit encryption.
Tenant Isolation: Merchant data and campus institutional clusters operate under strict multi-tenant logical partitioning and Row-Level Security (RLS).
Data Retention Period: Personal records are maintained during your active account tenure. Invoicing and financial transaction receipts are retained for seven (7) years to satisfy Malaysian tax laws (Income Tax Act 1967).
Account Deletion: Students may request account closure and deletion of non-statutory personal data upon graduation or leaving the institution.

8.0 Your Rights under Malaysian PDPA & DPO Contact

Under the Malaysian Personal Data Protection Act 2010, you are entitled to:

Request confirmation of and access to your personal data held in our systems.
Request correction or updating of incomplete, inaccurate, or outdated records.
Withdraw consent for non-essential push notifications or marketing communications.
Request deletion of non-statutory personal data upon account termination.

Data Protection Officer Contact

To exercise any of your statutory rights or submit a data inquiry regarding Campus Hub, please contact our centralized compliance desk:

Entity: Qim Lab Enterprise (QL Studio)

Email: contact@qimlab.com.my (Subject: [PDPA - Campus Hub])

Master Privacy Document: policies.qimlab.com.my/privacy.html