User Agreement

1. Acceptance of Terms

By accepting a quotation or service agreement that incorporates these terms, clicking to accept them in-product, or using a trial or subscribed service after these terms have been made available to you and you have been notified that they govern that use, you agree to this User Agreement, the Service Level Agreement (SLA) and any applicable quotation, order form, service scope, invoice, subscription plan, support arrangement or written agreement issued by BizCloud Asia Sdn Bhd (Registration No. 201301027403 (1057232-T)) ("BizCloud", "we", "us"). The Mutual Non-Disclosure Agreement (NDA) applies when expressly incorporated into an accepted agreement or separately executed.

Our Privacy Policy explains personal data processing. Acceptance of service terms is not blanket consent to every processing purpose or future privacy change. Any consent required by law must be obtained separately from the appropriate individual or authorised person.

If you act for a company, employer, association or organisation, you confirm that you are authorised to bind that organisation. If you do not agree to the applicable service terms, do not place the order or activate the affected service. Merely viewing a website or legal page does not by itself accept a new service contract.

1.1 Electronic Acceptance and Record of Acceptance

Acceptance may be given electronically, including by clicking "I Agree", ticking an acceptance box, signing electronically or sending an express acceptance by email. Electronic contracting and signatures are subject to applicable Malaysian law, including the Electronic Commerce Act 2006 and, where a digital signature is used, the Digital Signature Act 1997.

Acceptance records may include the accepted document version, customer and authorised representative details, date, time, signed documents, email correspondence and, where collected, account, IP address and device information. Records that are retained may be used as evidence of acceptance and of the terms in force, subject to applicable evidential requirements. Merely viewing a legal page does not itself execute a separately signed NDA.

1.2 Re-Acceptance on Material Change

Material changes follow Section 14. We may request express acceptance of revised service terms for a new order, renewal, optional feature or an agreed change to existing services. Declining new terms does not by itself remove rights under an existing paid commitment. Privacy notices and any consent required for personal data processing are handled separately under the Privacy Policy.

1A. Order of Precedence

If there is a conflict between documents, the following order applies, from highest to lowest priority, unless a document expressly states that it overrides this clause:

1. A separately signed written agreement between you and BizCloud.
2. The accepted quotation, order form, proposal or service scope.
3. Module-specific terms in Section 6B of this Agreement.
4. This User Agreement.
5. The published Service Level Agreement, for support scope and operational service targets.
6. The published Mutual Non-Disclosure Agreement, where expressly incorporated, for mutual confidentiality.
7. The Privacy Policy.
8. Any other documentation, marketing material, brochure, feature list, demonstration or verbal representation.

Each document governs its own subject matter. The NDA's Section 6A expressly incorporates the monetary liability arrangements in Section 10 of this User Agreement for NDA claims. A service target, confidentiality clause or quotation does not waive or increase a liability limit, create a service credit or indemnity, or transfer intellectual property unless an agreement expressly identifies that change and is signed by an authorised representative of BizCloud. Mandatory legal obligations apply regardless of this order of precedence.

Marketing material, screenshots, demonstrations, roadmaps and verbal statements are not contractual commitments and do not form part of the agreed scope unless expressly written into a quotation or signed agreement.

2. Services and Scope

BizCloud Asia Sdn Bhd may provide cloud business software and related services including BMO HRM, payroll, e-Leave, e-Claim, e-Attendance, POS, CRM, iCRM, inventory, membership, accounting/e-Invoice preparation, Queue System, WhatsApp Business API chatbot, AI and automation features, implementation, training, support, hosting and related modules.

The exact functions, limits, support level, implementation scope, customisation, integrations, users, storage, message volume, AI usage allowance and commercial terms are determined by the subscribed package, quotation, invoice, written agreement or accepted service scope.

2A. Cloud, Client-Hosted and On-Premise Services

Services may be provided as cloud-hosted services managed by BizCloud Asia Sdn Bhd or as client-hosted, PC-hosted, local server, NAS, virtual machine, third-party hosting or on-premise installations, depending on the agreed scope.

For cloud services, we are responsible only for the application, database and infrastructure elements that are within our control and service scope. For client-hosted or on-premise installations, our responsibility is limited to the BMO software under active maintenance or support. The customer remains responsible for hardware, operating system, network, internet connectivity, antivirus, firewall, power protection, backup, restore testing, access control, physical security, third-party hosting and local environment maintenance.

We are not liable for data loss, corruption, downtime, ransomware, malware, disk failure, operating system failure, user deletion, misconfiguration, expired licences or unavailable backups caused by customer-controlled environments. Recovery, repair or reconfiguration work outside the subscribed support scope may be chargeable.

3. Accounts, Access and Security

Customers are responsible for all activities under their accounts and user credentials. You must ensure authorised users keep passwords confidential, use appropriate access permissions, remove users who no longer require access and notify us promptly of suspected unauthorised access.

We are not responsible for losses caused by weak passwords, shared accounts, unauthorised internal users, compromised devices, inaccurate data entry, customer-side approval failures or misuse of administrator permissions.

You are responsible for reviewing and maintaining role permissions, approval workflows and segregation of duties inside your account, particularly for payroll approval, claim approval, leave approval, discount authority, void transactions, price overrides, stock adjustment, credit note issuance and data export rights.

4. Customer Data and Customer Responsibilities

Customers retain responsibility for data entered, uploaded, imported, transmitted or generated through the services, including employee, payroll, tax, attendance, biometric, claim, leave, customer, member, queue, CRM, WhatsApp, POS, inventory and accounting data.

You represent that you have obtained all consents, notices, permissions and legal bases needed to collect, process and submit customer data through our systems. You grant us a limited, non-exclusive licence to host, process, transmit, back up and display customer data solely to provide, support, secure and maintain the services.

If the services include file management or document storage, customer files may be stored in the cloud or in customer-controlled storage depending on setup. Where files are stored on customer devices, mapped drives, local servers or third-party storage, the customer is solely responsible for backup, redundancy, antivirus, encryption, access control and physical security.

4A. Customer Verification Duty

This is a fundamental obligation of the customer and a condition of use of the services. The services generate figures, documents, files, messages and reports from data that the customer supplies and settings that the customer configures. Output is only as accurate as that input and configuration.

Before any payment, disbursement, statutory submission, tax filing, e-Invoice submission, bank file upload, customer communication, WhatsApp broadcast, published document or business decision, the customer must have an authorised and competent person independently check and approve the relevant output. This applies to every service and module, including but not limited to:

• Salary, wages, overtime, allowances, deductions, unpaid leave, prorated pay, bonus, commission and final settlement figures.
• PCB/MTD, EPF/KWSP, SOCSO/PERKESO, EIS/SIP, HRDF/HRD Corp, EA forms, CP8D, CP21/CP22/CP22A and any statutory rate, ceiling, category or exemption setting.
• Leave balances, carry-forward, entitlement tables, prorated entitlement, replacement leave, and statutory minimum entitlements under the Employment Act 1955 and its amendments.
• Claim amounts, claim limits, approval routing, mileage rates and reimbursement categories.
• Attendance, clock-in/out records, shift assignment, overtime eligibility, rest day and public holiday treatment.
• Accounting entries, tax codes, SST settings, chart of accounts mapping, opening balances, e-Invoice profiles, TIN, MSIC and classification codes.
• Customer and supplier master data, pricing, discounts, stock counts, costing and inventory valuation.
• Any AI-generated or automation-generated text, summary, reply, classification, score, recommendation or draft document.

Supplying software does not appoint BizCloud Asia Sdn Bhd to review, audit, certify or approve customer data or output, or to provide regulated accounting, tax, audit, payroll, legal, HR or statutory advice. Any separately agreed professional service requires an appropriate scope and any legally required qualification or authorisation. Where professional advice is needed outside that scope, the customer must engage a suitably qualified adviser.

Failure to perform this verification may make the customer responsible for resulting loss, penalties, corrections or claims to the extent caused by that failure. It does not automatically excuse an independent breach or statutory duty of BizCloud. Any claim against BizCloud remains subject to Section 10, including its lawful limits and mandatory exceptions.

4B. Data Protection Roles under the PDPA

For data that you or your users enter into, generate in, or transmit through the services in the course of operating your own business, you are the data controller and BizCloud Asia Sdn Bhd acts as data processor under the Personal Data Protection Act 2010 as amended by the Personal Data Protection (Amendment) Act 2024. This includes employee, payroll, attendance, leave, claim, member, customer, patient, student, contact and messaging records held in your account.

BizCloud acts as data controller only in respect of our own business records, such as your billing account, our sales and support communications, website visitor data, and telemetry used to operate and secure the platform.

As data controller, you are responsible for:

• Issuing your own personal data protection notice to your employees, customers, members and other data subjects, in both Bahasa Malaysia and English as required by section 7 of the PDPA, and obtaining valid consent or establishing another lawful basis.
• Appointing a data protection officer where required, and notifying the Personal Data Protection Commissioner of that appointment.
• Responding to data subject access, correction, withdrawal, portability and direct-marketing cessation requests relating to your data. Where such a request reaches us, we will refer it to you rather than act on it directly, unless you have instructed us otherwise in writing.
• Notifying the Commissioner and, where required, affected individuals of a personal data breach within the statutory timelines. Where we become aware of a security incident affecting your data in systems under our control, we will notify you without undue delay and provide reasonable information to support your notification, but the notification obligation to the regulator and to data subjects remains yours as data controller.
• Determining lawful retention periods and providing authorised deletion instructions. Retention and deletion follow those instructions, the agreed service scope, our Privacy Policy and applicable law. The absence of an instruction does not permit indefinite retention of personal data that is no longer necessary.

As data processor, we will process personal data in accordance with your documented instructions and the subscribed service scope, apply reasonable security measures consistent with the Security Principle, and impose confidentiality obligations on personnel with access. You warrant that your instructions are lawful, and you indemnify us in respect of instructions that are not.

These allocations do not transfer or exclude BizCloud's own statutory duties as a data controller or data processor, including applicable security and breach-notification duties. Each party remains responsible for the obligations imposed directly on it by law. Contractual liability limits apply only to the extent legally permitted.

Some processing occurs outside Malaysia, including cloud hosting, messaging providers, push notification services, email and SMS gateways and AI providers. Current categories of sub-processors are described in our Privacy Policy. Where required by law, you are responsible for carrying out your own transfer impact assessment for your data, using the information we make available.

4C. Sensitive and Biometric Data

Biometric data is classified as sensitive personal data under the amended PDPA and requires the explicit consent of the individual, unless a statutory exemption applies.

If you use fingerprint, facial recognition, palm, iris or other biometric clocking, or biometric-linked e-Attendance, kiosk, door access or POS login features, whether through BMO or through connected devices, you are solely responsible for obtaining and recording explicit written consent from each affected employee or individual, for providing an alternative non-biometric method where consent is refused or where required by law, and for the lawful configuration, retention and deletion of biometric templates.

The same applies to other sensitive categories that may be entered into HRM, payroll or CRM modules, including health and medical certificate information, disability records, religious information used for leave or dietary settings, and records of offences or disciplinary action.

We do not verify that consent has been obtained. We are not liable for any regulatory action, employee claim, industrial court claim or penalty arising from your collection or use of biometric or other sensitive personal data.

5. WhatsApp, Messaging and Third-Party Platforms

Where services connect to WhatsApp Business API, Meta platforms, SMS, email, payment gateways, government portals such as MyInvois, cloud providers, social platforms, PBX or telephony providers, AI providers or other third-party services, your use is also subject to the terms, policies, fees, approval processes and technical limits of those third parties.

We do not control third-party approval, account suspension, delivery rates, template approval, message delays, platform outages, API deprecation, pricing changes, model changes or policy enforcement. Customers are responsible for lawful message content, opt-in and consent, opt-out handling, and compliance with applicable anti-spam, privacy and communication rules, including section 43 of the PDPA regarding direct marketing cessation notices.

Third-party charges, including messaging, template, telco and AI usage charges, are payable as stated in the accepted commercial terms. Providers may change their charges. Any pass-through to the customer follows the agreed pricing mechanism and applicable notice requirements; a provider change does not by itself alter an agreed fixed price.

6. Fees, Payment and Suspension

Fees, subscriptions, setup charges, renewal periods, usage charges and payment terms are as stated in the relevant quotation, invoice, proposal, order form or written agreement. Fees paid are non-refundable except as provided in the accepted agreement or required by law.

We may suspend or restrict access for overdue payment, chargeback, suspected fraud, security risk, misuse, legal risk, breach of terms, end of subscription, or failure to provide information required for service delivery.

Unless stated otherwise, subscriptions are billed in advance, fees are exclusive of SST and other applicable taxes, and customers are not entitled to set off, withhold or deduct amounts from our invoices except where required by law. Late payment charges apply only where agreed in the accepted commercial terms or permitted by law. Reasonable, documented recovery costs may be claimed to the extent permitted by the agreement and law.

6A. Support, Maintenance and Service Levels

Our standard support coverage, response and resolution targets, onsite services and quotation arrangements are set out in the Service Level Agreement (SLA).

Standard support requests are submitted during Malaysian business hours through our designated WhatsApp line at +603-2780 3801, unless another intake channel is expressly agreed in writing. Email assistance and authorised remote access may be arranged through our support team. Messages outside SLA working periods are handled from the next working period. After-hours support is subject to availability and may be chargeable.

Any response or uptime targets are operational targets, not absolute guarantees. Resolution time depends on issue complexity, customer cooperation, access to logs, sample data, third-party providers and whether the issue is caused by our system or by customer hardware, network, browser, device, local installation, customisation, third-party service or misconfiguration.

Service level targets do not apply to free trials, demo accounts, beta features, AI features, test environments, non-production systems, client-hosted or PC-hosted installations, or issues caused by customer-controlled environments or third-party systems unless expressly agreed in writing.

Support targets do not guarantee a permanent fix, continuous availability or completion of new development within a stated time. A practical workaround may constitute operational resolution under the SLA. Service credits, automatic refunds, financial penalties and guaranteed uptime apply only if expressly stated in a separate written agreement signed by an authorised representative of BizCloud. Nothing in this provision excludes a remedy or liability that cannot lawfully be excluded.

6B. Module-Specific Terms

The following terms apply in addition to the rest of this Agreement where the relevant module is subscribed. They do not limit Section 4A, which applies to every module.

6B.1 Payroll

BMO Payroll is a calculation and record-keeping tool. It is not a payroll bureau, tax agent or statutory filing agent. The employer remains the party legally responsible for correct remuneration, deductions, contributions, submissions and record retention.

Statutory rates, tables, ceilings, categories and file formats issued by LHDN, KWSP, PERKESO, HRD Corp and other authorities change from time to time. We will use commercially reasonable efforts to update the software within a reasonable period after an authority publishes a change and its technical specification, but we do not warrant that an update will be available before any particular payroll run or submission deadline. The customer is responsible for confirming, before each run, that the configured rates, categories, exemptions and employee setup are correct and current.

The customer is responsible for verifying every payroll run before payment or submission, for retaining its own statutory records for the periods required under the Employment Act 1955, the Income Tax Act 1967 and related legislation, and for any correction, resubmission, amended return, penalty, interest or back-payment arising from incorrect setup, incorrect employee data, late detection or regulatory change.

6B.2 e-Attendance and Time Records

Attendance capture may rely on mobile devices, GPS, network location, Wi-Fi, QR codes, biometric or card devices, and third-party hardware. Location accuracy, device clock accuracy, device permissions, connectivity, battery state, operating system restrictions and hardware condition are outside our control. Geofence and GPS readings are indicative and must not be treated as conclusive proof of an employee's location.

The customer is responsible for shift configuration, rest day and public holiday setup, overtime rules, rounding rules, and for reconciling attendance records against its own records before using them for payroll, discipline, dismissal or any Industrial Relations Act 1967 or Employment Act 1955 process. Section 4C applies where biometric capture is used.

6B.3 e-Leave and e-Claim

Entitlement tables, accrual rules, carry-forward rules, approval routing, claim categories, claim limits and mileage rates are configured by the customer. The system applies the configuration given to it and does not determine or guarantee statutory minimum entitlements. The customer is responsible for ensuring configuration complies with the Employment Act 1955 and its amendments, applicable collective agreements and its own employment contracts and handbook, and for verifying balances before approval, payment or final settlement.

6B.4 POS, Inventory and Membership

The customer is responsible for pricing, discount authority, tax and SST configuration, cash handling, till reconciliation, void and refund controls, stock counts and costing method. Where offline or local caching mode is used, transactions held on a local device before synchronisation may be lost if the device fails, is reset, is stolen or is not synchronised, and the customer is responsible for daily reconciliation and end-of-day closing procedures.

Payment terminals, card readers, e-wallets and payment gateways are third-party services governed by their own agreements. Standard BMO business records are not intended to store full payment card numbers or card security codes; customers must use the approved payment provider's collection method and must not enter those details into general records, attachments or support messages. Each party remains responsible for payment-security obligations applicable to its own role.

6B.5 CRM, iCRM, Queue and Messaging

The customer is responsible for the lawful basis of every contact record, for message content, for opt-in and opt-out handling, for honouring direct-marketing cessation notices, and for the accuracy of any automated or scheduled campaign, follow-up sequence or chatbot flow it configures or approves. Where an AI or automated agent replies to end users, Section 9A applies and the customer is responsible for appropriate disclosure to those end users.

6B.6 Accounting and e-Invoice

Unless expressly agreed in writing, BizCloud is not appointed as your e-Invoice intermediary, peppol service provider or tax agent, and does not submit on your behalf. The customer is responsible for TIN, business registration details, classification codes, tax types, exemption status, buyer details, submission timing, and for monitoring validation, rejection and cancellation windows in the LHDN MyInvois system. We are not liable for rejected, late, duplicated or incorrect submissions, or for any resulting penalty or audit exposure.

6B.7 AI Features

See Section 9A, which applies in full to every AI feature in every module. AI features may be metered, capped, throttled, priced separately, changed or withdrawn.

7. Acceptable Use and Restrictions

• Do not use the services for unlawful, fraudulent, harmful, abusive, defamatory, misleading or unauthorised purposes.
• Do not bypass security, access another customer account, reverse engineer, copy, scrape, overload, disrupt or damage our systems.
• Do not upload malicious code, infringing content, unlawful personal data, spam, phishing content or materials that violate third-party rights.
• Do not use the services to send messages without proper consent, opt-in or lawful basis.
• Do not use AI features to generate unlawful, deceptive, discriminatory, defamatory or infringing content, to impersonate a person without disclosure, or to make final decisions about an individual without human review.
• Do not use output of the services, including AI output, to train, fine-tune, benchmark or develop a competing product or model.
• Do not resell, sublicense or commercially exploit the services except as expressly agreed in writing.

We may investigate suspected breaches, and may suspend accounts, features, messaging or AI access where we reasonably believe there is a security, legal, platform-compliance or abuse risk.

7A. Confidentiality

For our standard mutual confidentiality terms and customer-specific NDA arrangements, see the Mutual Non-Disclosure Agreement (NDA).

Each party may receive confidential information of the other, including pricing, quotations, system design, source code, configuration, security information, business data and customer data. The receiving party will keep it confidential, use it only for the purposes of this Agreement, and disclose it only to personnel, contractors and advisers who need it and are under equivalent obligations.

These obligations do not apply to information that is public through no breach, was already lawfully known or is independently developed. Legally required disclosure is permitted to the extent required, with reasonable notice where lawful. Confidentiality obligations continue for three years after termination; for trade secrets, source code and non-public security information, they continue while that information remains confidential. Personal data remains protected for as long as it is held and as required by law. Any expressly accepted NDA also applies.

8. Intellectual Property

All software, website design, source code, database structures, templates, workflows, documentation, graphics, trade names, logos, product names, know-how, prompts, model configurations and materials provided by BizCloud Asia Sdn Bhd remain owned by us or our licensors, excluding customer data. No rights are transferred except the limited right to use the subscribed services during the active subscription period.

You retain ownership of your customer data. Where you voluntarily provide suggestions, feature requests, feedback or improvement ideas, you grant us a perpetual, irrevocable, royalty-free right to use them without obligation or attribution. This feedback licence does not transfer ownership of customer data, override confidentiality or data protection obligations, or grant rights in third-party material you are not authorised to license.

You must not access or use the services as a direct competitor, for benchmarking, feature copying, reverse engineering, competitive analysis or development of competing products without our prior written consent.

9. Disclaimers

The services are provided on an "as is" and "as available" basis to the fullest extent permitted by law. We do not guarantee that the services will be uninterrupted, error-free, immune from cyber incidents, compatible with every device, suitable for every legal, tax, payroll or employment scenario, or capable of replacing professional advice.

Any payroll, accounting, tax, e-Invoice, HR, attendance, leave, claim, statutory, queue analytics, CRM, chatbot, AI or reporting output must be reviewed by authorised and qualified personnel before reliance, filing, payment, submission or business action, in accordance with Section 4A.

Complex software may contain bugs, defects, vulnerabilities or compatibility issues. For a confirmed defect within the agreed support scope, our standard support response is to use reasonable efforts to provide a fix, workaround or assistance to regenerate affected reports where practical. This does not remove an express contractual remedy or a remedy that cannot lawfully be excluded. Responsibility for historical corrections, resubmissions, penalties or losses is assessed under the agreed scope and Section 10, including the effect of customer data errors, incorrect setup or failure to review outputs.

9A. Artificial Intelligence, Automation and Beta Features

9A.0 Summary in Plain Language

• AI features are assistants. They draft, summarise, classify and suggest. They do not decide.
• AI output is produced by a computer model. It is not written, checked or approved by BizCloud Asia Sdn Bhd.
• AI can be confidently wrong. It can invent facts, figures, names, dates and references that look correct.
• A competent person on your side must check every AI output before it is sent, published, paid, filed or acted on.
• The customer is responsible for harm caused by skipping the required review, subject to the allocation of responsibility and lawful limits in Sections 4A and 10.

9A.1 Nature of AI Features

The services may include artificial intelligence, machine learning, large language model, generative AI, automation, agentic workflow or robotic process automation features. These may be provided by us, embedded in our software, or supplied by third-party AI providers whose models we do not build, own, train or control.

AI output is generated by a statistical model, not authored, reviewed, verified or approved by BizCloud Asia Sdn Bhd. We do not adopt AI output as our own statement, advice, representation or recommendation. AI and automation features are assistance tools only and do not replace human review, professional advice or management judgment.

9A.2 AI Output May Be Wrong

The customer must assume that AI output may contain errors. Known and expected limitations include:

• Fabrication. AI may invent facts, figures, names, dates, legal provisions, statutory rates, citations, product details or references that do not exist, and may present them fluently and confidently.
• Arithmetic and calculation errors. AI is not a calculator and must never be used to compute or confirm salary, statutory contributions, tax, discounts, stock values or any other figure that has financial or statutory consequence.
• Outdated information. Models are trained on historical data and may not reflect current Malaysian statutory rates, thresholds, forms, deadlines, formats or regulatory positions.
• Misclassification. Categories, sentiment, priority, intent and entity extraction may be wrong, especially with mixed-language, colloquial, abbreviated or handwritten input.
• Non-determinism. The same input may produce different output on different occasions. Output is not reproducible and must not be treated as an audit trail.
• Bias and unsuitability. Output may be biased, culturally inappropriate, wrongly toned, or unsuitable for the recipient or context.
• Third-party rights. Output may resemble existing material and may raise copyright, trademark, confidentiality or publicity issues.
• Prompt injection and untrusted content. Where AI reads incoming messages, uploaded files or web content, that content may contain instructions designed to manipulate the AI. AI output derived from untrusted input must be treated with particular caution.

AI output is not a certification, audit, legal opinion, tax position or professional advice of any kind.

9A.3 Customer Obligation to Review

The customer must review, verify, correct and approve all AI-generated content, calculations, classifications, scores, summaries, recommendations, correspondence, drafts, reports and decisions before relying on them, acting on them, sending them to any third party, publishing them, or submitting them to any authority. A human with appropriate authority and competence must remain in control of the final decision.

AI features must not be used as the sole basis for any decision that has a legal, financial, disciplinary, employment or similarly significant effect on an individual, including hiring, dismissal, promotion, disciplinary action, payroll adjustment, claim rejection, leave rejection, credit assessment or customer blacklisting. Meaningful human review is required in every such case, and the customer is responsible for maintaining a record of that review.

9A.4 Data Sent to AI Providers

Where AI features are enabled, prompts, inputs, documents, records or customer data reasonably necessary for the feature may be transmitted to third-party AI providers, which may process the data outside Malaysia. Categories of AI providers are described in our Privacy Policy.

The customer is responsible for deciding whether to enable AI features, for restricting which users may use them, for ensuring lawful basis and PDPA compliance for data submitted to them, for internal policy approval, and for not submitting sensitive personal data, credentials, confidential third-party information or regulated data to AI features where that would be unlawful or inappropriate. Where we control the integration, we will use commercially reasonable efforts to limit the data shared to what is reasonably necessary and to use provider settings that do not permit customer data to be used to train the provider's general models. We do not control all third-party AI provider processing, retention, model behaviour or subsequent changes to their terms.

9A.5 Transparency to End Users

Where the customer deploys AI or automated agents to communicate with its own employees, customers or the public, including WhatsApp and chatbot replies, the customer is responsible for making appropriate disclosure that the interaction is automated, for providing a route to a human where appropriate, and for compliance with any applicable AI governance guideline, code or legislation now or later in force in Malaysia.

9A.6 Ownership and Rights in AI Output

As between the parties, and to the extent permitted by law, AI output generated from your inputs is treated as your customer data. We make no warranty that AI output is original, non-infringing, protectable by copyright, or free from similarity to output generated for other users. You are responsible for checking AI output for third-party rights before publication or commercial use.

9A.7 Beta and Experimental Features

Beta, experimental, preview, pilot or early-access features are provided as-is, without an additional contractual warranty, SLA or support commitment unless expressly agreed. Liability remains subject to Section 10 and any mandatory legal protection. These features may be unstable, incomplete, modified, withdrawn or produce incorrect results, and must not be used for production, payroll, statutory or compliance-critical workflows without customer testing and validation.

9A.8 Changes to AI Features

We may change, replace, retrain, reconfigure, throttle, meter, price, restrict or withdraw AI models and AI features as services and providers develop, subject to Section 14 and the accepted commercial terms. Model outputs may vary; variation alone is not a promise of identical results or proof of a defect. Material reductions to an agreed paid service remain subject to the applicable contractual and legal remedies.

9A.9 Module-Specific AI Risk Notes

Payroll and HRM. AI must never be used to determine, confirm or explain PCB/MTD, EPF, SOCSO, EIS or HRD Corp rates, ceilings, categories or exemptions. Statutory figures must come from the configured payroll engine and be checked against the current official tables published by the relevant authority.

e-Leave and e-Claim. AI summaries or suggested approvals do not determine statutory entitlement under the Employment Act 1955. Entitlement, accrual and carry-forward must be verified against the customer's configuration and its employment contracts.

e-Attendance. AI anomaly flags, absence patterns and exception summaries are indicative only. They must not be used as evidence in disciplinary, dismissal or Industrial Court matters without independent verification of the underlying records.

POS and Inventory. AI-generated product descriptions, categories, reorder suggestions and demand forecasts are estimates. Pricing, tax codes, costing and stock figures must be verified before they affect a transaction or a valuation.

CRM, iCRM and Messaging. AI-drafted replies, follow-ups and campaign content are drafts. Factual claims, prices, commitments, delivery dates and warranty statements must be verified before sending. An AI-generated message sent from the customer's account is the customer's message and may bind the customer.

Accounting and e-Invoice. AI must not be relied on for TIN, classification codes, tax type, exemption status, buyer details or submission validity. These must be verified against the customer's records and the MyInvois requirements before submission.

9A.10 Prohibited AI Uses

• Generating unlawful, deceptive, discriminatory, harassing, defamatory or infringing content.
• Impersonating a real person or organisation without clear disclosure and authorisation.
• Producing content designed to mislead a regulator, auditor, court, employee or customer.
• Making automated decisions about individuals without human review, as set out in Section 9A.3.
• Submitting other people's confidential or regulated data to AI features without a lawful basis.
• Attempting to extract, reverse engineer or circumvent model safeguards, system prompts or usage limits.
• Using AI output to train, fine-tune, benchmark or build a competing product or model.
• Bulk or automated generation of unsolicited messaging in breach of consent or anti-spam requirements.

We may suspend or restrict AI access where we reasonably believe there is a security, legal, platform-compliance, cost-abuse or misuse risk.

10. Limitation of Liability

Application throughout the service terms. Every disclaimer, exclusion, limitation and customer indemnity in this Agreement and its incorporated service documents is subject to the mandatory exceptions in this Section. A customer responsibility does not transfer a statutory duty imposed directly on BizCloud.

To the fullest extent permitted by Malaysian law, BizCloud Asia Sdn Bhd, its directors, employees, contractors, suppliers and affiliates will not be liable for indirect, incidental, special, consequential, punitive or exemplary damages, loss of profit, loss of revenue, loss of goodwill, loss of anticipated savings, loss of business opportunity, business interruption, loss or corruption of data, inaccurate customer input, third-party platform failure, messaging failure, unauthorised customer-side access, AI output, or statutory submission errors.

Subject to the paragraph headed "Exceptions" below, our total aggregate monetary liability for all claims arising from or related to the services, this User Agreement, the SLA and the standard NDA where incorporated, whether in contract, tort, negligence, statute or otherwise, is limited to:

• for a paid service, the total fees actually paid by the customer to BizCloud Asia Sdn Bhd for the affected service during the twelve (12) months immediately before the first event giving rise to the claim; and
• for any free trial, demonstration account, beta feature, unpaid feature or service provided at no charge, or a pre-contract discussion governed by the standard NDA where no service fees have been paid, RM500.

Where a separate signed written agreement specifies a different limit, that limit applies instead.

Claims arising from the same or related events are aggregated, and no separate monetary limit is created merely by bringing claims under several documents or legal grounds. These limits do not prevent a party from commencing lawful proceedings or seeking an injunction; they govern monetary recovery only to the extent permitted by law.

Subject to the exceptions below, BizCloud is not responsible to the extent a loss is caused by the customer's breach of its review or consent duties, unlawful instructions, customer-controlled systems or credentials, or an event beyond BizCloud's reasonable control. The presence of AI, an integration or a third-party provider does not by itself excuse BizCloud's independent breach of an agreed obligation. Other monetary claims remain subject to the lawful exclusions and aggregate cap above.

Exceptions. Nothing in this Agreement excludes or limits liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for any other liability that cannot lawfully be excluded or limited under Malaysian law. The customer's obligations to pay fees and its indemnity obligations under Section 11 are not subject to the limit above.

No contractual exclusion, liability limit or indemnity releases BizCloud from a statutory duty owed directly by it, prevents regulatory enforcement, or requires reimbursement of a fine or liability where that arrangement would be unlawful.

Each limitation and exclusion in this Section operates separately. If any part is held unenforceable, the remaining parts continue to apply to the fullest extent permitted by law.

11. Indemnity

You agree to indemnify and hold harmless BizCloud Asia Sdn Bhd, its directors, employees, contractors and service providers from claims, losses, lawfully recoverable penalties, liabilities and reasonable documented costs, including legal expenses permitted by law, arising from your data, your users, breach of this Agreement, unlawful use, third-party platform breach, messaging content, failure to obtain consent, inaccurate submissions or misuse of the services, subject to the allocation of responsibility below.

This indemnity includes claims arising from AI output that you use, publish, submit or rely on, your failure to validate AI or system output, your breach of data protection laws, your collection or use of biometric or other sensitive personal data, unlawful messaging, uploaded files, employee or industrial relations claims relating to payroll, attendance, leave or claim records, customer-controlled environments and third-party integrations enabled by you.

The indemnity applies to the extent the claim or loss is caused by the customer's acts, omissions or breach, and does not cover the part caused by BizCloud's own fraud, negligence, breach of contract or statutory non-compliance. BizCloud will give reasonable notice of a third-party claim, allow reasonable participation in its defence and take reasonable steps to mitigate loss. A settlement imposing an admission or non-monetary obligation on the customer requires the customer's written consent, which must not be unreasonably withheld.

12. Termination

We may suspend or terminate affected access for non-payment, material breach, misuse, or a genuine security or legal risk, subject to the accepted agreement and applicable law. Where a breach can reasonably be remedied, we will give notice and a reasonable opportunity to remedy it unless immediate action is necessary to protect systems, people or legal compliance. Where practical, restrictions will be limited to the affected services.

If BizCloud needs to discontinue a paid service for commercial or technical reasons unrelated to customer breach, we will give reasonable advance written notice and address the remaining service period, transition arrangements and unused prepaid fees under the accepted agreement and applicable law. This clause does not remove any refund or other remedy required by either.

For cloud services, an authorised customer may request export of available customer data within thirty days after termination or expiry, subject to any different agreed period and lawful retention requirements. Standard export arrangements follow the agreed service scope; custom formats or migration assistance may be quoted separately. Outstanding fees remain payable, but no payment condition or thirty-day request window overrides a mandatory personal data right or requires unlawful retention. After the applicable period, data may be deleted, anonymised or retained only for justified periods under the Privacy Policy and applicable law.

You remain responsible for retaining your own statutory records. Termination does not transfer your record-keeping obligations to us.

13. Governing Law and Disputes

This User Agreement is governed by the laws of Malaysia. The parties agree to submit to the exclusive jurisdiction of the courts of Malaysia, unless a separate signed agreement specifies another dispute resolution process.

Please notify us in writing of a claim or potential claim as soon as reasonably practicable, with sufficient information to investigate and reduce further loss. This request does not impose a contractual time bar, shorten a statutory limitation period or remove a party's right to commence legal proceedings.

The parties will seek to resolve disputes in good faith through discussion between senior representatives. Either party may commence proceedings where necessary to protect its rights, meet a statutory deadline or seek urgent relief. Discussion does not suspend or extend a statutory limitation period unless lawfully agreed.

13A. Force Majeure

We are not liable for delay or failure to perform caused by events beyond our reasonable control, including natural disasters, acts of God, war, riot, labour dispute, government action, pandemic, epidemic, utility failure, telecommunications failure, data centre outage, cloud provider failure, AI provider outage or withdrawal, third-party system failure, cyberattack or other events outside our reasonable control. Our obligations are suspended for the duration of such event, and we will use reasonable efforts to mitigate its impact where practical.

13B. Usage Monitoring, Security and Product Improvement

We may collect system telemetry, audit logs, error logs, performance metrics, anonymised usage data and aggregated analytics to operate, secure, troubleshoot, improve and monitor the services, prevent abuse and develop product improvements. We will not sell identifiable customer data to third parties for their marketing purposes, and we will not use identifiable customer data to train general-purpose AI models for third parties.

13C. Protection of Confidential Personnel Information

You must not misuse confidential personnel information obtained through the services or induce an unauthorised disclosure of BizCloud's confidential information. This provision protects confidentiality and does not impose a general restriction on lawful recruitment, employment, trade or business.

13D. Reference and Publicity

Unless you notify us in writing that you object, we may identify you as a customer and use your business name and logo in customer lists, our website and proposals. We will not disclose your confidential information or customer data in doing so.

14. Changes to Terms

BizCloud Asia Sdn Bhd reserves the right to revise its published service terms and to develop its services from time to time. Minor corrections or clarifications that do not materially affect rights or obligations may take effect upon publication without individual notice.

For material changes affecting existing customers, including changes to agreed charges, service commitments or liability arrangements, we will give reasonable advance notice of the change and its proposed effective date by email to the registered contact or a prominent in-product notice. Any longer notice period in an accepted agreement or required by law applies. Changes to an existing contract follow its agreed amendment procedure and any required acceptance; website publication or continued use alone does not override a requirement for express agreement.

Revised terms may be offered for new orders, renewals or optional features after they have been made available to the customer. If a customer declines those terms, BizCloud may decline the new order, renewal or optional feature, while existing commitments remain governed by the terms already accepted unless lawfully varied or terminated.

We may make operational changes reasonably necessary to comply with law or address an urgent security risk without advance notice where permitted by law and the applicable agreement. We will give notice as soon as reasonably practicable where lawful. This does not authorise retrospective changes to agreed prices, liability for past events, accrued rights or an executed NDA.

Customer-specific agreements and accepted quotations retain their agreed precedence. NDA variations follow the NDA's written amendment procedure. Privacy Policy updates and any consent required for changed data processing follow Section 19 of the Privacy Policy. Customers and BizCloud should retain copies of the applicable terms and acceptance records.

14A. Survival

Sections relating to customer data, verification duty, data protection roles, confidentiality, intellectual property, disclaimers, limitation of liability, indemnity, payment obligations, AI and automation, cybersecurity, data export and deletion, governing law and any provision that by its nature should survive will survive termination or expiry of this Agreement, for the duration specified in the relevant provision or required by law.

14B. General

Assignment. You may not assign or transfer this Agreement without our written consent. We may assign or novate to an affiliate or to a successor in connection with a reorganisation, merger or sale of business, and may use subcontractors and sub-processors, remaining responsible for their performance within our service scope.

Entire agreement. This Agreement, together with the documents listed in Section 1A, is the entire agreement between the parties on its subject matter and supersedes prior discussions, proposals and representations, other than fraudulent misrepresentation.

Severability. If any provision is held invalid or unenforceable, it is modified to the minimum extent necessary or severed, and the remainder continues in full force.

No waiver. A failure or delay in exercising a right is not a waiver of it.

Notices. Notices to us must be sent to the contact details below. Routine notices may be posted on our website. Material contractual changes, suspension and termination notices follow the specific provisions above and any agreed notice procedure; a routine website posting does not replace a required direct notice. Customers must keep their registered contact details current.

No third-party rights. No person who is not a party to this Agreement has any right to enforce it.

Relationship. Nothing creates a partnership, joint venture, agency or employment relationship between the parties.

Language. This Agreement is issued in English. Where a translation is provided for convenience, the English version prevails in the event of inconsistency, except where Malaysian law requires otherwise.

15. Contact

BIZCLOUD ASIA SDN. BHD. (Registration No. 201301027403 (1057232-T))
General: sales@bizcloud.asia
Privacy enquiries: sales@bizcloud.asia
WhatsApp: +603-2780 3801