Privacy Policy

We collect three categories of information, summarised below.

Information you give us directly. When you fill in a contact form, request a consultation, register for a demo, or otherwise communicate with us, you provide us with information such as your name, email address, phone number, organisation name, role, and the contents of your message. When you subscribe to our services, you additionally provide billing information, which is processed by our payment provider — we do not store full card numbers on our servers.

Information we collect automatically. When you visit our website or use the Platform, we automatically log certain technical information: your IP address, browser type and version, operating system, the pages you visit, the time and duration of your visit, the referring URL, and coarse location (country or city level). We use this information to keep the Platform secure, to diagnose performance issues, and to understand how our audience uses the site.

Information from third parties. Where you have given us permission, or where the law allows, we may receive information about you from integration partners, identity verification providers, or public registries. For example, when an organisation signs up as an enterprise customer, we may receive basic company registration information from the relevant national registry to streamline onboarding.

We use the information we collect for the following purposes:

To provide and operate the Platform. This includes authenticating users, processing transactions, syncing records between modules (Membership, Accounting, Reporting), and sending operational communications such as password reset emails and security alerts.

To respond to your enquiries. When you submit a contact or consultation form, we use the information you provide to reply, follow up, and deliver the consultation or demo you asked for.

To improve the Platform. Aggregated, de-identified usage data helps us identify which features are most useful, where to invest engineering effort, and how to make the experience more inclusive across devices and languages.

To send marketing communications, but only where you have opted in (or where the law allows us to send you information about similar services without opt-in). You can opt out at any time using the unsubscribe link in any marketing email or by contacting us directly.

To comply with our legal obligations and to protect the rights, safety, and property of Taawonion, our customers, and third parties. This includes record-keeping, audit trails, fraud prevention, and lawful disclosure to regulators where required.

Where the General Data Protection Regulation (GDPR) or similar laws apply, we rely on the following legal bases to process your personal data:

Performance of a contract when processing is necessary to provide the services you have signed up for.

Legitimate interests for things like securing the Platform, preventing fraud, improving our products, and understanding how customers use our services — balanced against your rights and freedoms.

Consent when you have actively opted in, for example to receive marketing emails or to integrate with specific third-party services.

Legal obligation when we must keep certain records, respond to lawful requests, or comply with regulatory reporting.

We do not sell your personal information. We share information with carefully selected recipients only as described below.

Service providers. We work with trusted third parties who help us run the Platform: cloud hosting (encrypted, regional), payment processing, email delivery, customer support tooling, and analytics. Each provider is bound by a data processing agreement and may only use your data to perform the services we have asked them to provide.

Cooperative members and partners. Where you participate in shared services — for example, a member of a cooperative that uses our Platform — your name and limited profile information may be visible to other authorised users within the same organisation.

Regulators and authorities. We may disclose information where required by law, in response to a valid court order, or to protect the safety, rights, or property of Taawonion, our users, or third parties.

Business transfers. If Taawonion is acquired, merged, or sells a portion of its assets, your information may be transferred as part of that transaction, subject to a commitment to honour this Privacy Policy.

We take the security of your information seriously. Our security measures include encryption in transit (TLS 1.2 or higher) and at rest, role-based access controls, two-factor authentication for administrative users, regular third-party security assessments, and continuous monitoring for anomalous activity.

No system, however, is 100% secure. We cannot guarantee absolute security, but we will notify affected users without undue delay where a data breach is likely to result in a high risk to their rights and freedoms, as required by applicable law.

We keep your personal information only for as long as we need it to provide you with our services, comply with our legal obligations, resolve disputes, and enforce our agreements. Specific retention periods depend on the type of data:

Account data: for as long as your account is active, plus a reasonable period afterwards to handle account reactivation and to comply with legal record-keeping.

Transactional records: for at least seven years where required by tax and accounting law; longer where required by other legal obligations.

Support communications: for up to three years after the last interaction, to enable continuity of support.

Marketing consent records: for as long as your consent is active and for a reasonable period afterwards to demonstrate that you consented.

Depending on where you live, you may have some or all of the following rights with respect to your personal information:

Access: request a copy of the personal data we hold about you.

Correction: ask us to correct inaccurate or incomplete data.

Deletion: ask us to delete your data, subject to legal retention requirements.

Restriction: ask us to suspend processing of your data while a complaint is being investigated.

Portability: receive your data in a machine-readable format and transmit it to another provider.

Objection: object to processing based on legitimate interests, including profiling.

Withdrawal of consent: where we rely on your consent, you can withdraw it at any time without affecting prior lawful processing.

To exercise any of these rights, contact us at privacy@taawonion.com. We respond within 30 days. If you are unhappy with our response, you may have the right to lodge a complaint with your local data protection authority.

Taawonion is headquartered in Malaysia and operates cloud infrastructure in multiple regions. When we transfer your personal data across borders — for example, from a customer in Southeast Asia to our hosting region — we rely on lawful transfer mechanisms such as Standard Contractual Clauses approved by the European Commission, or other legally recognised transfer mechanisms appropriate to your jurisdiction.

We aim to keep data within the region where it was collected whenever this is commercially and operationally feasible. Customers on the Enterprise plan can request regional data residency for additional compliance assurance.

The Platform is not directed at children under the age of 16, and we do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us so we can delete it promptly.

Our website may contain links to third-party websites and integrations. We are not responsible for the privacy practices of these third parties. We encourage you to read their privacy policies before providing them with your personal information.

We may update this Privacy Policy from time to time to reflect changes to our practices or for legal, operational, or regulatory reasons. When we make material changes, we will notify you by email or by a prominent notice within the Platform at least 30 days before the changes take effect, where the law requires it. The "Last updated" date at the top of this policy reflects when it was most recently revised.

If you have any questions about this Privacy Policy, our handling of your personal information, or if you would like to exercise one of your rights, please contact us:

Taawonion (operated by the Taawonion cooperative platform team)
Email: privacy@taawonion.com
Office: Kuala Lumpur, Malaysia

We aim to acknowledge all enquiries within two business days and to substantively respond within 30 days.