01 Who we are
We are LabNexa Technologies, registration number 060419020751, a small company registered in Malaysia. There is no head office you can visit because the team works remotely, and there is no legal department behind this page. The people who wrote it are the same people who write the code.
Lab Nexa itself is a lab management system. An NFC card or a phone taps a sticker on a lab PC, and the system records who sat where, for how long. Universities and polytechnics use it to run computer labs without paper logbooks. That is the whole product, and it shapes everything below. We collect lab usage data because that is the job, and very little else.
This policy covers everyone who touches the system: students, lecturers, supervisors, school admins, university admins, guests, and the platform admins who keep the lights on.
We collect what a lab logbook would collect, we keep it only as long as it is useful, we do not sell it or hand it to advertisers, and you can ask us for a copy or the delete button at any time.
If you would rather not agree to this, the honest option is to not use the service. But do email us first, because most objections turn out to be misunderstandings we can clear up in one reply.
02 What we collect
Three small piles. We can list all of it here because there is not much, and we would like to keep it that way.
Things you or your institution hand us
Account details
Name, IC number, email, role, university and school. Usually typed in by an admin during enrolment, not by you.
Guest details
Name, IC, email and the reason for the visit. Collected only when someone requests a temporary lab pass.
What you write to us
Complaints, fault reports and contact form messages, including whichever lab and PC you mention.
Emails
Anything you send to our one inbox, kept so we can answer it and remember what was asked.
Things the system creates while you use it
- Session records showing which PC, which lab, when you tapped in and out, how long it lasted, and whether you logged in by card, password or guest pass.
- Audit entries like logins, password changes, permission changes, and force logouts. Written so that power leaves a trace.
- Error and performance logs, the boring diagnostics that tell us the system broke before you notice.
Things your browser gives every website
Your IP address and user agent string, plus a device fingerprint if and only if you tick "stay logged in". We use that fingerprint for one job: making a stolen login token useless on another machine.
If we ever start collecting something new, this page changes first and we tell you. A privacy policy that quietly grows new paragraphs is a privacy policy you should not trust.
03 What we do with it
Almost everything is boring, in the best way. Your name is shown to your lecturer because they need to know who is in the room. Your tap times become your attendance, so nobody has to count heads. Your email is used to reply when you write to us. Your session history is shown to you, because it is yours.
Beyond that, there are only four less obvious uses, and here they are in full:
- Security checks. Spotting strange logins, blocking brute force attempts, and keeping each role inside its own lane.
- Aggregate analytics. Counts and averages, like which labs are busy and which PCs keep failing, with the personal details stripped out first.
- Notifications. In app alerts about your class, your guest request, or a complaint you filed. No push spam.
- Legal requests. If a court or regulator lawfully asks, we answer. We tell you when we can.
And three things we do not do at all: we do not advertise to you, we do not build marketing profiles, and we do not feed your data into machine learning models. Not ours, not anyone's.
04 Our lawful reasons
Malaysia's Personal Data Protection Act 2010 asks companies to have a reason for each thing they do with personal data. Here are ours, translated from lawyer into human:
| The reason | What it covers, plainly |
|---|---|
| You agreed | You or your institution on your behalf accepted this policy, you ticked "stay logged in", or you chose to email us. |
| It is the deal | Your account, your taps, your lab access. We cannot run the service you signed up for without them. |
| It is sensible | Security logging, fraud prevention, diagnostics. We weigh this against your privacy and keep it minimal. |
| The law says so | Answering lawful requests and keeping the records Malaysian law requires us to keep. |
If you live somewhere whose laws give you more protection than the PDPA does, write to us. Where we are able, we will honour those rights too rather than hiding behind geography.
05 Taps and sessions
This is the part people worry about most, so here it is without varnish.
What a tap record actually contains
- Your user ID and the PC you tapped
- The lab, school and university (so one institution cannot see another's data)
- When you tapped in, when you tapped out, and how you logged in
- If someone ended your session for you: who, and the reason they gave
That is it. A tap record says a seat was used. It says nothing about what you did on the machine. We do not monitor screens, files, keystrokes or browsing, because we never built anything that could.
Who can see your sessions
- You, always, in your own history.
- Your lecturer or supervisor, for the lab they are running, while the class is running.
- Your school and university admins, as counts and reports for their own institution.
- Platform admins, only when something is broken across the whole platform.
About the card itself
Your NFC card stores a random token. Not your name, not your IC number, nothing personal. Lose the card and a supervisor kills that token with one click. Whoever finds it holds a random string that opens nothing.
06 Who we share with
The short answer: almost nobody, and never for money. We do not sell data, rent it, or trade it, and "anonymised data partnerships" are not a thing we do.
Your own institution
Your university and school admins see data for their own institution like attendance, lab usage, and tickets, because they run the labs you sit in. They are responsible for that data under their own policies and the PDPA, and our contracts say they may not resell it either.
Nobody else, except:
- The law. A court order or a lawful regulator request. We answer those, and we tell you when we are allowed to.
- Safety. The rare case where withholding information would put someone at risk.
- A change of ownership. If Lab Nexa is ever sold or merged, your data travels with the same promises, and we will notify you.
There are no third party processors, cloud analytics suites or data brokers in the loop. Everything in this policy happens inside systems we operate ourselves. It makes our lives harder and your data safer, and we have made peace with that trade.
07 How long we keep it
Data you no longer need is data that can leak, so we delete on a schedule rather than "someday". Here is the schedule:
| What | How long | Why that long |
|---|---|---|
| Account details | While active, plus 90 days | Room to restore a mistaken deletion |
| Session logs | 24 months | Attendance disputes and audits mostly surface within two years |
| Security audit logs | 36 months | Long enough for forensic work and legal requests |
| Complaints and tickets | 18 months after closing | Long enough to spot repeat faults and repeat liars |
| "Stay logged in" tokens | 30 days | Convenience should have a short fuse |
| Device fingerprints | 30 days idle, then gone | They exist only to protect your login |
| Guest session data | 4 hours live, 30 days as audit | A visit is a visit. Afterwards it is just a log line |
| Backups | Up to 90 days | Disaster recovery only. Nobody browses backups |
When a deadline passes we delete properly or anonymise beyond recovery. And if you ask us to delete your account earlier, we will, except for the specific rows the law tells us to keep. We will tell you exactly which rows those are and why, rather than saying "legal reasons" and hoping you stop asking.
08 Your rights
These are not favours we grant. They are rights you have, and exercising them costs you nothing and will not get your account treated differently.
See it
Ask what we hold about you and get a copy, in a format you can actually open.
Fix it
Wrong name, wrong IC, old email? We correct it, usually the same day.
Delete it
Request deletion. We do it except where statute forces us to keep a record.
Take it with you
Get your data as a structured export if you are moving institutions.
Say stop
Object to or limit processing that is not essential to running your lab.
Change your mind
Withdraw consent for the optional things like remember me, any time.
One email to labnexatechnology@gmail.com is enough. Say which right you are using. We reply within 30 days, usually much sooner. If we cannot give you what you asked for, we will explain which law stops us, by name.
If our answer does not satisfy you, you can complain to Malaysia's Personal Data Protection Department (PDPD). We would rather fix it ourselves first, but that route is yours and we will not make it awkward.
09 Cookies
Four cookies, all ours, all with actual jobs. You may have noticed there is no cookie banner on our site. That is not an oversight. It is because there is nothing optional to consent to.
| Cookie | Job | Lifetime | Can you refuse? |
|---|---|---|---|
PHPSESSID | Keeps you signed in during a visit | Until you close the browser | No. The site cannot work without it |
remember_token | "Stay logged in" on your own device | 30 days | Yes. Just do not tick the box |
device_fingerprint | Binds that token to your device | 30 days idle | No. It is what makes the token safe |
csrf_token | Stops forged form submissions | Until you close the browser | No. It protects you |
No advertising cookies, no analytics cookies, no social media pixels. You can still clear cookies in your browser whenever you like. You will just have to sign in again.
10 Security, briefly
The full story lives on our Security Policy page. The short version for this page: passwords are stored as bcrypt hashes we cannot read back, every connection is encrypted with TLS, every form carries a forgery proof token, every database query uses bound parameters, every privileged action lands in an audit log, and each university's data is walled off from every other university's.
We are a small team and we say so there too, including what we have not built yet. We would rather be honest about the gaps than impressive on paper.
11 Children
Lab Nexa is built for polytechnics and universities, so nearly everyone on it is an adult. We do not knowingly collect personal data from children below Malaysia's age of digital consent without a parent or guardian standing behind that consent.
If a child's data reaches us anyway, perhaps a younger visitor or a mistyped enrolment, tell us and we will delete it the same day. No forms, no proof demanded, no argument.
12 Changes
When this page changes, the date at the top changes with it, so you can always see how stale what you are reading is.
If a change actually matters, like a new kind of data, a new use, or a new recipient, we will also put a notice inside the app. Where the law asks for fresh consent we will ask for it instead of assuming it. Continuing to use Lab Nexa after a change means you accept it. We know that is a legal fiction, which is exactly why we prefer to tell you plainly and let you decide.
13 Questions people ask
No. The system records that the seat was occupied, by whom, and for how long. Nothing on the screen, no files, no browsing. There is no monitoring agent on lab PCs, because we never wrote one.
Your institution decides whether your account stays open for alumni use. If they close it, your session logs live out their 24 month audit life and then get anonymised. Or you can ask us to delete earlier and we will, minus whatever the law insists we keep.
On your own device, yes. The token is random, hashed, tied to that device's fingerprint, rotated each use, and dead after 30 days. On a shared lab PC, do not use it. The next person sits at the same machine, and no token design fixes that.
No. Our contracts with institutions prohibit resale outright, and they are independent data controllers bound by the PDPA anyway. If you ever find evidence otherwise, email us and we will take it seriously.
Email labnexatechnology@gmail.com or ask your admin. Done within 30 days, except rows the law forces us to keep. We will name those rows rather than hide behind "legal reasons".
No. Not our models, not anyone else's. The only analytics we run are counts and averages with the personal details stripped out first.
Bulk enrolment cannot hand deliver three hundred passwords, so imported accounts start with the IC number as a temporary password. The system forces a change at first login. It is a convenience with a short fuse, and it is deliberate.
14 Talk to a human
There is no support desk with a phone tree and hold music. There is one inbox, and the small team that builds this system reads it. Write at 2am and you will get a reply at nine the next working morning, from a person, not an auto responder pretending to be awake.
Privacy and everything else
LabNexa Technologies · Registration No. 060419020751 · Registered in Malaysia, working remotely
Privacy requests get an answer within 30 days at the outside. In practice it is days, not weeks. If we ever need longer, we will say so in writing before the deadline, not after.
And if we get it wrong and stay wrong, the Personal Data Protection Department (PDPD) is the regulator to tell. We would rather fix it ourselves first, but the choice is yours.