This notice describes how System Canvaspoint (“we”) handles personal data when you use https://system-canvaspoint.click or write to us. It is written for people who enquire about a retention review or related assessment for a health or wellness app. It is not a notice for the end users of those apps; we do not want their health files.
Data controller
The controller is System Canvaspoint, Office 7, 76 Placeholder Avenue, Kuala Lumpur 00000, email info@system-canvaspoint.click, telephone +60 3 0000 3070.
We handle personal data in line with the Personal Data Protection Act 2010 of Malaysia and, where an enquiry comes from elsewhere, with any other law that actually applies to that enquiry.
What we collect
From the contact form or an email: your name, email address, the assessment you selected, the kind of app (if you say), and the message you wrote. If we later work together, we may also hold a billing name, a studio visit time, and the names of colleagues you invite to a working session.
We do not ask for identity card numbers, payment card numbers (we are not a checkout), or the health records of your users. If an export arrives with names, emails, sleep scores tied to a person, meal photographs, or other health detail, we will not use it as a source. We will ask you to send a stripped file, and we will delete the original when we can.
Server logs may record an IP address and the pages requested, for a short period, to keep the site standing. The cookie banner stores a preference in this browser under the key systemcanvaspoint_cookie_consent. See the cookies page for that mechanism.
Why we hold it
- To reply to an enquiry and to say whether the brief fits
- To perform a contracted assessment
- To send invoices and keep records the tax law expects
- To defend a legal claim if one arises
We do not sell lists. We do not send a newsletter unless you have asked for one in a separate, clear request — and this site does not currently offer one.
How long we keep it
Enquiries that do not become work are deleted within twelve months, unless we must keep a note of why we refused a file. Contracts, invoices, and the correspondence needed to understand them are kept for seven years after the engagement ends, which is the period we use for ordinary commercial records in Malaysia. Working copies of stripped event exports are deleted within ninety days after the written review is delivered, unless a dispute is open.
Who sees it
The three people named on the About page, and a bookkeeper under confidence. Hosting for this static site may process technical logs. We do not pass enquiry contents to advertisers.
If we must disclose data to a Malaysian authority or under a court order, we will do so only to the extent required.
International transfers
The studio is in Kuala Lumpur. Email and hosting may store copies on servers outside Malaysia. Where we control a transfer, we keep it to what the engagement needs. If you are writing from the European Union or another region with transfer rules, say so in your first note so we can be careful about where drafts sit.
Your rights
Subject to the Personal Data Protection Act 2010, you may ask to access the personal data we hold about you, to correct it, and to withdraw consent where consent was the basis for holding it. You may complain to the Department of Personal Data Protection in Malaysia.
To make a request, write to info@system-canvaspoint.click from the address we have on file, or include enough detail for us to know you are the person in the record. We may need to verify that before we release anything.
Children
The site and the assessments are for people acting on behalf of an app business. We do not knowingly collect data from children.
Changes
We will update this page when our practices change. The date of the current text is 20 August 2026.