Privacy Policy

1. Who this policy covers

This policy applies to the CUVIC Android and iOS apps and the CUVIC services that support them. It covers staff members who sign in and people whose information staff enter when arranging a visit, meeting or other work activity. CUVIC is intended for authorised workplace use, not for children.

CTC's broader Personal Data Protection Notice also describes its company-wide handling of personal data.

2. Information we handle

The information depends on which features you use:

Account and work profile

User ID, name, work email, role, department, work contact details, profile photo, sign-in records and authentication information supplied by CTC's staff systems.

Workplace transactions

Attendance and shift records; leave requests and supporting documents; claims, receipts and reimbursement details; room bookings; visitor identity, contact, company, host, visit time, approval and access records; and messages or other content entered in these features.

Images and face information

Photos or documents you capture or upload for attendance, claims or visits. Where face verification or visitor access is used, images may be processed to compare or enrol a face for the requested workplace or building access function.

Location

Location collected with permission for attendance verification, room check-in, location-aware help and field service assignments. Opening Attendance can start a location watcher and send frequent updates to CTC's field-service system, including while the app is in the background.

Optional AI and voice content

Questions, conversation context, attached files, optional location context, voice recordings and transcriptions when you use ChatCTC, speech-to-text or related tools. Avoid entering information unrelated to your work request.

Device and service data

Push notification tokens, app version, device/platform information, network address, timestamps and technical logs needed to deliver notifications, secure accounts and troubleshoot the service.

You may also provide information about another person, such as a visitor or meeting guest. Please provide only what is needed for the work activity.

3. Device permissions

CUVIC asks for permissions when a feature needs them. These include camera and photos for QR scanning, face checks and uploads; location for attendance or field work; microphone for voice input; notifications for work alerts; and contacts or calendar access for saving selected colleague details or booking events to your device. Device biometric authentication, where offered, uses the phone's system authentication.

You can change permissions in your device settings. A feature that relies on a denied permission may be unavailable. Location updates may continue after you leave the Attendance screen, including while the app is in the background, until the app or device stops tracking or you revoke location permission.

4. How we use information

• Authenticate users, manage access and protect CTC systems.
• Complete attendance, leave, claims, room booking and visitor workflows.
• Verify attendance or identity and enable approved building access where required.
• Send work notifications, approval requests and service updates.
• Respond to optional AI or speech requests that you initiate.
• Maintain records, investigate problems, prevent misuse and meet legal or company obligations.

CUVIC is not an advertising app. Its work records are not collected for personalised advertising.

5. Who may receive information

Information may be available to authorised CTC staff, managers, approvers, hosts, HR, finance, reception and security personnel according to their duties and the feature involved. A visitor's details, for example, may be shown to the host and visit approvers; claim details may be shown to the relevant approvers and finance staff.

CTC also uses service providers and connected systems to run CUVIC. These include infrastructure and face-access services, Google Firebase Cloud Messaging for push delivery, and OpenAI or connected AI services when you use relevant chat, image or speech functions. The information sent depends on the feature: for example, a device token and notification content for push, or the content you submit for an AI request. Such providers may process information outside Malaysia. We may disclose information where required by law or to protect people and systems.

6. Retention and deletion

CTC's published Personal Data Protection Notice states a seven-year personal-data retention period and describes deletion when a business relationship ends. CUVIC work records are handled under that policy and any applicable record-keeping requirements. You can ask about a particular record or request deletion using the contact below. We will review the request and explain if a record must be kept for a continuing work, security or legal purpose.

CUVIC access is normally provisioned through CTC rather than by public self-sign-up. To request that an account be closed or related personal information be removed, contact the privacy team. Removing the app from a phone does not itself remove records held by CTC.

7. Security and international processing

CTC uses sign-in controls, role-based access and technical safeguards for information handled by CUVIC. Data is transmitted to the app's services over HTTPS. No system can guarantee absolute security; please protect access to your device and report suspected misuse promptly.

Some connected providers or facilities may process or store data outside Malaysia. CTC's company-wide notice explains its approach to such transfers.

8. Your choices and rights

You may ask CTC to access or correct personal information it holds about you, request deletion where applicable, or raise a concern about how it is used. You can also change optional device permissions in your phone settings. If you withdraw a permission needed for a feature, that feature may no longer work.

Send a request from your work email where possible so we can verify your identity. We may need to coordinate an employment or visitor record request with the relevant CTC team.

9. Changes to this policy

We may update this page when CUVIC features or data practices change. The effective date at the top shows when this version took effect. Material changes will be communicated through an appropriate app or company channel.

10. Contact us

For privacy questions, access or correction requests, and account or data deletion requests, contact: