Legal
Privacy Policy
This Privacy Policy explains how Kassanto (“Kassanto”, “we”, “us”) collects, uses, discloses, and protects personal data when you visit kassanto.com (the “Site”) and when a payment is processed through the Kassanto payment and checkout platform (the “Service”). We handle personal data in accordance with Malaysia's Personal Data Protection Act 2010 (the “PDPA”).
1. Who we are
Kassanto is a payment and checkout technology platform operating in Malaysia. We provide the technology that businesses (“Merchants”) use to accept payments — Kassanto is not the seller of the goods or services you purchase. For any privacy question, contact us at support@kassanto.com.
2. What personal data we collect
When you visit our website
We collect usage and device data through analytics tools, including pages viewed, approximate location (derived from your IP address), browser and device type, and referring links. Through Microsoft Clarity we also capture aggregated interaction metrics and session recordings or heatmaps. This data is collected using cookies and similar technologies (see Section 4).
When a payment is processed
We collect transaction details such as the amount, date, currency, the Merchant you paid, and a payment reference. Card and bank credentials are entered directly into our PCI-DSS-compliant payment providers — Kassanto does not see or store your full card number.
When you contact support
We collect the contact details and information you choose to provide, such as your email address and the amount, date, and store relating to a payment.
3. How we use personal data
- To process and secure payments, and route them to the correct provider and Merchant;
- To detect, investigate, and prevent fraud and misuse;
- To operate, maintain, and improve the Site and Service, including analytics;
- To respond to your enquiries and provide support;
- To comply with our legal, regulatory, and financial-industry obligations.
4. Cookies, analytics, and session recording
We use cookies and similar technologies to run analytics and improve the Site:
- Google Analytics 4 — measures how the Site is used. You can opt out with the Google Analytics opt-out browser add-on.
- Microsoft Clarity — captures aggregated usage metrics and session recordings/heatmaps to help us understand and improve the Site. Clarity masks sensitive input fields by default.
You can control or block cookies through your browser settings. Some parts of the Site may not function as intended if cookies are disabled.
5. How we share personal data
- Payment providers — Stripe, Payex (Xendit), and senangPay process payment credentials and transactions on our behalf, under their own terms and security standards.
- Merchants — the business you purchased from receives the information needed to fulfil and account for your order.
- Service providers — analytics and infrastructure providers (for example, Google and Microsoft) acting on our instructions.
- Legal and regulatory — where required by law or by regulators such as Bank Negara Malaysia, or to protect our rights and prevent fraud.
We do not sell your personal data.
6. Payment security
Connections use 256-bit TLS encryption. Card payments use 3-D Secure, as required by Bank Negara Malaysia. Card data is captured and held only by our PCI-DSS-compliant payment providers, and is never stored on Kassanto's own servers.
7. International transfers
Some of our providers (for example, Stripe) operate globally and may process personal data outside Malaysia. Where this happens, we take reasonable steps to ensure your data remains protected to a standard consistent with the PDPA.
8. Data retention
We keep personal data only for as long as necessary for the purposes described in this Policy and to meet our legal, tax, and regulatory requirements. After that, it is deleted or anonymised.
9. Your rights under the PDPA
Subject to the PDPA, you may request access to or correction of your personal data, withdraw your consent, or limit how we process it. To make a request, contact support@kassanto.com. We may need to verify your identity before acting on a request.
10. Children
The Service is not directed at children, and we do not knowingly collect personal data from them.
11. Changes to this Policy
We may update this Policy from time to time. The “Last updated” date above shows the latest revision.
12. Contact us
Questions about this Policy or your personal data: support@kassanto.com.