Legal

Privacy Policy

How we protect your data and your customers' data.

Last updated: 24 October 2026

This Privacy Policy explains how Vital Design Sdn Bhd ("we") collects, uses, shares and protects personal data on the salonsoftware.my website and in the CCS Plus system. We handle personal data under Malaysia's Personal Data Protection Act 2010 (PDPA) as amended in 2024.

1. Our role

  • Website visitors and prospects: when you contact us through the website or WhatsApp, we are the data controller.
  • Salons using CCS Plus: for customer and staff data a salon manages in the system, the salon is the data controller and we are the data processor, processing only on the salon's instructions to provide the service.

2. What we collect

Website visitors

  • What you enter in the demo form: name, salon name, business type, number of outlets, current system, preferred time and your questions. Submitting the form opens WhatsApp and sends this to us as a WhatsApp message.
  • Your conversations with us by WhatsApp, phone or email.
  • Technical data: the website runs on Cloudflare, which processes IP addresses and browser data for security and attack protection. We currently use no advertising-tracking or analytics cookies on the website.

CCS Plus customers (salons)

  • Account data: company name, person in charge, contact details and outlet details.
  • Payment data: the monthly fee is charged to a credit card by auto-debit; card details are handled by the payment provider.
  • Business data: customer, staff, transaction, package, booking, photo, consent-form and attendance data the salon enters.

3. How we use data

  • To answer enquiries, arrange demos and provide quotes.
  • To provide, maintain and improve CCS Plus, including backups, security and technical support.
  • To charge fees, issue invoices and meet legal obligations (such as LHDN e-Invoicing).
  • With your consent, to send product updates or business insights; you can opt out at any time.

4. Sensitive personal data

Under the amended PDPA, biometric data (such as face data used for face-recognition attendance) is sensitive personal data. Before using face-recognition attendance, before-and-after photos or other sensitive data, a salon must obtain the explicit consent of the person concerned (staff or customer). CCS Plus provides PDPA consent forms to help salons record consent. We process this data only to provide the feature, for no other purpose.

5. Who we share data with

We do not sell personal data. To provide the service we share necessary data with these types of providers and require them to protect it:

  • Cloud hosting: Amazon Web Services (AWS).
  • Website and network security: Cloudflare.
  • Messaging: WhatsApp (Meta), for daily reports, reminders and messages sent by salons.
  • Payments: our credit card payment provider, and online payment gateways a salon enables.
  • Government: LHDN MyInvois e-Invoicing and other authorities where the law requires.

6. Cross-border transfers

Data is stored on AWS cloud servers, which may be outside Malaysia. We transfer data only where protection substantially similar to the PDPA, or equivalent safeguards, are in place.

7. Retention

  • Website enquiries: kept until no longer needed to respond or follow up.
  • CCS Plus business data: kept while the service is active; kept for 29 days after the service ends, during which the salon can copy or export its data, then permanently deleted, except records the law requires us to keep.

8. Security

  • Each salon's data is kept separate and cannot be seen by other salons; the system is backed up daily.
  • Salons set staff permissions by role and can restrict login to the salon.
  • Our staff are not permitted to log in to customer accounts or view customers' business data, except within the scope a customer explicitly requests and authorises for technical support.
  • If a personal data breach occurs, we will notify the Personal Data Protection Commissioner as the PDPA requires, and the affected individuals where significant harm is likely. As a data processor, we will notify the affected salon promptly.

9. Your rights

You may ask to access or correct your personal data, withdraw consent, limit processing, request data portability, or opt out of direct marketing. Contact us using section 12 and we will respond within the time the law requires.

If you are a customer or staff member of a salon, your data is controlled by that salon, so please contact the salon first; we will help the salon handle your request.

10. Third-party websites

This website may link to third-party sites (such as WhatsApp or LinkedIn). Their privacy practices are not covered by this policy.

11. Changes

We may update this policy and will change the date at the top when we do; significant changes will be notified to CCS Plus customers.

12. Contact us

  • Data Protection Officer (DPO): Dr. Dave Tan
  • Email: wecare@vitaldesign.com.my
  • Phone: 03-6263 6301
  • Address: Vital Design Sdn Bhd (200201029605 · 597268-K), B-3A-21, Ativo Plaza, 52200 Kuala Lumpur, Malaysia

This policy is available in Chinese and English; if they differ, the English version prevails.