Privacy notice

When you register: your full name, company e-mail address (@lamsoon.com.my), Employee Number, the department you select, and a password. The password is stored only in scrambled (hashed) form; nobody at Lam Soon can read it.

While you use the platform: your verified department, account status, which systems you have access to and your roles in them, e-mail verification codes, sign-in sessions, and for administrators an authenticator-app sign-in step.

What you put into the systems: A3 reports and tasks; APEX tickets, messages and attachments, and Wall posts; Room Booking reservations, including titles, purpose, notes and attendee numbers.

Records and logs: a record of administrator actions (who changed what, for whom, when and why), activity history inside each system, the e-mails the platform sends you, and security events such as failed sign-ins.

• To create your account, confirm you are a Lam Soon employee, and sign you in once across every system.
• To decide which systems you can open and what you can do in them.
• To run each system: route APEX tickets to the right department, track A3 tasks, schedule rooms.
• To send you e-mails about your account, requests, reports, tickets and bookings.
• To keep the platform secure, investigate misuse, and keep an audit trail of administrator changes.

We do not sell your data, use it for advertising, or use it for any purpose unrelated to your work.

• Portal administrators see account details, access, roles and the audit log so they can manage access.
• People with a role in a system see what that role needs: for example an APEX Reviewer sees tickets sent to their department, the A3 GM sees submitted reports, and Room Booking administrators see all bookings.
• Other employees see only what each system shows them: for example a room's schedule, with private bookings shown only as “Private Meeting”. On the APEX Wall your name is not shown to other users.
• Service providers that host and run the platform for us: Supabase (database and sign-in), Cloudflare (website hosting and security) and Resend (sending e-mail). They process data only on our instructions. Their servers may be outside Malaysia.

We may also disclose data where the law requires it.

Your account and records are kept while you work at Lam Soon. When you leave, your account is set to inactive and all your access stops. Your records stay in the systems for the company's records, in line with Lam Soon's record-retention practice. Hidden APEX Wall posts are deleted permanently after 12 months.

The platform uses only the cookies it needs to keep you signed in across lamsoonpsg.org and its systems, plus short-lived security cookies. There are no advertising or analytics cookies.

Access is checked by the database itself on every request, administrators must use an authenticator app, connections are encrypted, and every administrator change is logged. Please keep your password to yourself (see the acceptable-use policy).

Under the PDPA you may ask to see the personal data we hold about you, ask us to correct it, and ask questions or raise a complaint about how it is used. Your department and Employee Number can be corrected by a Portal administrator. Some data is needed to give you access to the systems you use for work, so if you ask us to stop using it, we may not be able to give you that access.

Contact PSG IT at lyko@lamsoon.com.my. We may need to confirm who you are before acting on a request.

We will update this notice when the platform changes, and show the date at the top.