Privacy Policy

1. Who we are

OINC Sdn. Bhd. (1513728-H) (“OINC”, “we”, “us”) is a company incorporated in Malaysia that builds and runs modular mushroom farms in Sibu, Sarawak. We are the data controller for the personal data described in this policy, and we handle it in line with Malaysia’s Personal Data Protection Act 2010, as amended (the “PDPA”).

You can reach us at contact@oinc.farm, on +60 19-840 3699, or by post at 2A, Lorong 1, Jalan Tun Ahmad Zaidi Adruce, 96000 Sibu, Sarawak, Malaysia.

2. What this policy covers

This policy covers:

• this website, www.oinc.farm;
• messages you send us by email, phone, WhatsApp or LinkedIn, and our dealings with customers, suppliers and partners; and
• the internal software tools OINC uses that connect to Google accounts, described in section 7.

If we sign a contract with you, that contract may contain further terms about personal data.

3. Personal data we collect

When you browse this website

This website has no sign-up, no account and no contact form. We do not set cookies, and we do not use analytics, advertising or tracking tools. Like any website, our hosting provider, Vercel, automatically receives technical information when your browser requests a page: your IP address, browser and device type, the page requested, the referring page, and the date and time. This is used only to deliver the website and protect it from abuse.

The contact section of our home page shows an embedded Google Map. When the map loads, your browser connects to Google, which may receive your IP address and set its own cookies under the Google Privacy Policy. Links to Google Maps, Waze, WhatsApp, LinkedIn and the programmes we belong to take you to other websites, which have their own privacy policies.

When you contact us or do business with us

We collect what you choose to give us: usually your name, email address, phone number, the organisation you work for and the content of your messages. If you become a customer, supplier or partner, we also keep the details needed for that relationship, such as delivery addresses, orders, invoices and payment records. Most of this comes from you directly. Sometimes it comes from your organisation, for example when a colleague introduces you as the contact for a project.

We do not ask for sensitive personal data, such as health information or religious beliefs, and we ask you not to send it to us.

Giving us personal data is voluntary. If you choose not to, we may be unable to reply to your enquiry or to do business with you.

4. How we use personal data

We use personal data to:

• reply to your enquiries and keep in touch about the matter you raised;
• discuss, plan and carry out collaborations, farm projects, supply and offtake;
• process orders, deliveries, invoices and payments;
• run, secure and fix this website; and
• meet our legal, tax, accounting and regulatory obligations.

We process personal data with your consent, which you give when you contact us or hand us your details, or where the PDPA otherwise allows it, such as when it is needed for a contract with you or to meet a legal obligation. We do not send you marketing messages unless you have agreed to receive them, and you can ask us to stop at any time.

5. Who we share it with

We do not sell personal data. We share it only with:

• service providers who run systems for us, such as Vercel (website hosting), Google Workspace (email, calendar and documents) and our cloud accounting software, and the messaging platforms you choose to contact us on, such as WhatsApp and LinkedIn;
• couriers and logistics partners, when we deliver to you;
• our professional advisers, such as auditors, company secretary, tax agents and lawyers;
• government bodies, regulators, courts or law enforcement, when the law requires it; and
• a buyer or successor of our business, under confidentiality, if OINC is reorganised, merged or sold.

Some of these providers, including Vercel and Google, store or process data outside Malaysia. We use established providers that protect data under contract and with security measures, as the PDPA requires for transfers abroad.

6. How long we keep it

• Enquiries and correspondence: for as long as the conversation is active and for a reasonable period afterwards, normally up to two years after our last contact, unless it leads to a business relationship.
• Business and financial records, such as invoices and payment records: for seven years, as Malaysian company and tax law requires.
• Website server logs: for a short period, under our hosting provider’s retention settings.
• Google sign-in tokens used by our internal tools: until the account owner revokes access or stops using the tool (see section 7).

When we no longer need personal data, we delete it or make it anonymous.

7. Google user data

OINC staff use small internal software tools, run on their own computers, that connect to their own Google accounts. The current one is a calendar tool, which appears on Google’s sign-in consent screen as “Khai Claude Code”. These tools are for OINC’s own use only. They are not offered to the public, and only the owner of each Google account signs in to them.

What we access

The calendar tool asks Google for one permission: to view and edit events on Google Calendar (the calendar.events scope). It uses that permission only to:

• create events on the signed-in account’s own calendar, with the title, time, location, notes, reminder and guest email addresses that the account owner enters;
• send Google Calendar invitations to those guests and, when asked, add a Google Meet link; and
• read the account’s own calendar to confirm that the sign-in belongs to the right account before anything is written, and to read back the event and invitation it has just created.

It does not access Gmail, contacts, Google Drive or any other Google data.

How we use it

Google user data is used only to carry out the action the account owner asked for. We do not use it for advertising, we do not use it to build profiles of anyone, and we do not use it to develop, improve or train generalised artificial-intelligence or machine-learning models.

How we store it

The sign-in tokens Google issues are stored as files on the account owner’s own computer, readable only by that computer’s user account. They are not uploaded to OINC servers or anywhere else. The events themselves live in the owner’s Google Calendar. The tool also keeps a local log of the actions it takes (the time, event title and guest addresses) on the same computer, so the owner can check what it has done.

Who sees it

We do not sell Google user data, and we do not share it except as needed to carry out the account owner’s own request. Event details and guest addresses go to Google, which stores the event and emails the invitation to the guests named in it. The owner sometimes runs the tool through an AI assistant on the same computer (Claude Code, by Anthropic); when that happens, the details of the requested event and Google’s confirmation pass through the assistant so it can carry out the instruction. Apart from that, no one sees the data other than the account owner, unless it is needed for security or to comply with the law.

Limited Use

OINC’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Removing access

The account owner can withdraw the tool’s access at any time from Google Account permissions; deleting the token file on the computer also stops it working. If you received a calendar invitation from us and want your email address removed from the event, contact us at contact@oinc.farm.

8. How we protect personal data

We take practical steps to keep personal data secure, in line with the PDPA’s security principle. We limit access to the people who need it, use established providers that encrypt data in transit, and keep credentials on computers protected by their user’s login. No system is perfectly secure, but if a personal data breach occurs we will notify the Personal Data Protection Commissioner and, where required, the people affected, as the PDPA requires.

9. Your rights

Under the PDPA you can ask us to:

• tell you whether we hold personal data about you, and give you a copy;
• correct personal data that is inaccurate, incomplete, misleading or out of date;
• stop or limit processing, or withdraw your consent, in full or in part (we may then be unable to continue some dealings with you);
• stop processing that is likely to cause you substantial damage or distress;
• stop using your personal data for direct marketing;
• send your personal data to another organisation, where this is technically feasible; and
• delete personal data we no longer need.

To make a request, email contact@oinc.farm with the subject “Personal data request”, or write to us at the address in section 1. We may need to confirm your identity first. We will respond within 21 days, as the PDPA requires. If you are not satisfied with our response, you can complain to the Personal Data Protection Commissioner of Malaysia.

10. Changes to this policy

We will update this page when our practices change, and change the effective date at the top. If a change is significant, we will say so on this page.

This policy is available in English and in Bahasa Malaysia. If the two versions differ, the English version prevails.

11. Contact us