Tellus — ESG data & assurance platform, a product of Joshua Rayan Communications (“JRC”).
Version 2.0 · Effective 20 June 2026
🌐 Bahasa Malaysia: Baca Dasar Privasi dalam Bahasa Malaysia
This Privacy Policy explains how JRC collects, uses, discloses and protects personal data in connection with the Tellus platform (the “Platform”). It is written to align with the Malaysian Personal Data Protection Act 2010 (the “PDPA”, as amended) and, where the Platform is used by people in the European Union or European Economic Area or to monitor their behaviour, with the EU General Data Protection Regulation (Regulation (EU) 2016/679) (the “GDPR”). By using the Platform you acknowledge the practices described here. Capitalised terms used but not defined here (such as Client, Controller, Processor and Commercial Agreement) have the meanings given in our Terms of Service and Data Processing Agreement. In this Policy, “personal data” includes “personal information” under the PDPA and “personal data” under the GDPR; “data user” (PDPA) and “controller” (GDPR) are used interchangeably, as are “data processor” (PDPA) and “processor” (GDPR).
Joshua Rayan Communications (“JRC”) is the provider of the Platform. JRC is established in Malaysia and can be contacted at tom@jr.com.my. For matters within the scope of this Policy, JRC is the controller of account, usage and security data, and acts as processor for the ESG and operational data it handles on behalf of Client organisations (see below).
Where JRC acts as a processor for a Client’s ESG data, the Client organisation is the controller and you should direct controller-level requests to that organisation; JRC will support it as set out in the Data Processing Agreement.
The Platform serves two kinds of data:
| Category | Examples | Purpose |
|---|---|---|
| Account data | Name, work email address, role, and the Client and entities you are assigned to | Authentication, access control, and maintaining the audit trail |
| ESG & operational data | Energy, emissions, water, waste, social and governance figures, and the supporting evidence files your organisation uploads | To provide the reporting and assurance service to your organisation |
| Usage & security data | Sign-in events, the record of who changed what and when, and session activity | Security, the in-app audit log, and prevention of misuse |
The Platform is designed to process aggregated ESG figures (including aggregated health-and-safety statistics), not individual-level health data. Client organisations must not upload sensitive personal data (as defined in the PDPA) or special categories of personal data (GDPR Article 9 — such as data concerning health) without first obtaining the explicit consent or other lawful condition that the PDPA and the GDPR require. We do not use your ESG data to train artificial-intelligence models, and we do not sell personal data.
We process personal data to: operate, secure and support the Platform; authenticate users and enforce role-based access; maintain the audit log required for assurance; communicate service and account information (such as invitations, password resets and deadline reminders); and comply with our legal obligations. We process ESG data only to provide the service to the Client organisation and on its documented instructions.
The PDPA is principally a consent-based regime, supplemented by the conditions in section 6(2) of the PDPA. The GDPR requires a lawful basis under Article 6 for each processing activity. The table below maps each purpose to its PDPA basis and its GDPR lawful basis.
| Processing purpose | PDPA basis | GDPR lawful basis (Art. 6) |
|---|---|---|
| Creating and managing your account; authenticating you; enforcing role-based access; providing the Platform you were invited to use | Consent given on registration; and s.6(2) processing necessary for performance of the agreement between JRC and your organisation | Art. 6(1)(b) — performance of a contract (or steps prior to it); and, for account data of the Client’s personnel, Art. 6(1)(f) legitimate interests in providing a service to the Client that authorised your account |
| Service and account communications (invitations, password resets, deadline reminders) | Consent; and s.6(2) performance of the agreement | Art. 6(1)(b) — performance of a contract; Art. 6(1)(f) — legitimate interests in administering the service |
| Security, the append-only audit log, fraud and misuse prevention, and protecting the integrity of the reporting/assurance record | S.6(2) — processing necessary for JRC’s legitimate interests and for compliance with legal obligations; consent to the Platform’s operation | Art. 6(1)(f) — legitimate interests in securing the Platform and preserving an auditable record; Art. 6(1)(c) — compliance with a legal obligation, where applicable |
| Processing ESG & operational data on behalf of the Client | Client (as data user) is responsible for the lawful basis; JRC processes on instructions under the DPA | The Client controller relies on its own Art. 6 basis (typically Art. 6(1)(c) legal obligation or Art. 6(1)(f) legitimate interests); JRC processes as processor under Art. 28 |
| Complying with legal, regulatory, tax and accounting obligations; establishing, exercising or defending legal claims | S.6(2) — compliance with a legal obligation; legitimate interests | Art. 6(1)(c) — legal obligation; Art. 6(1)(f) — legitimate interests in defending claims |
Where we rely on legitimate interests (Art. 6(1)(f)), we have balanced those interests against your rights and freedoms; you may object as described in section 11, and you may ask us for more detail about that balancing. Where we rely on consent, you may withdraw it at any time without affecting processing carried out before withdrawal; withdrawal may mean we can no longer provide the service to you.
We do not disclose personal data except to the service providers below (who act as our processors / sub-processors on our instructions and under written contract), to your own organisation in accordance with its access controls, or where required by law or to protect rights and safety. Our sub-processors are:
| Provider | Role | Data location |
|---|---|---|
| Supabase / Amazon Web Services (AWS) | Database (PostgreSQL), authentication and evidence-file storage | Singapore (AWS ap-southeast-1) |
| Cloudflare | Application hosting and content delivery | Global edge network |
| Resend | Transactional email (invitations, password resets, reminders) | Tokyo, Japan |
We will update this list and notify Client administrators before adding or changing a sub-processor that materially affects the processing. Each sub-processor is bound by data-protection terms consistent with the PDPA and, where applicable, GDPR Article 28.
The Platform’s primary data store is hosted in Singapore (AWS ap-southeast-1). In addition, limited personal data — account email addresses and the content of invitation, password-reset and reminder emails — is processed by our email provider in Japan, and our hosting/CDN provider operates a global network. This means personal data is transferred outside Malaysia and, for data in scope of the GDPR, outside the EU/EEA.
We keep personal data only for as long as necessary for the purposes set out in this Policy:
Evidence files that are deleted in the Platform are removed from storage on a scheduled basis. Where we are required to keep certain records to meet a legal obligation, we retain them for the period the law requires and no longer.
We apply technical and organisational measures appropriate to the data, including: encryption in transit; role-based access that is enforced on the server and scoped to each user’s assigned entities; an append-only audit log of changes; validation of uploaded evidence files (checking the true file type and rejecting files with macros or active content); and the ability to lock a reporting year so that assured figures cannot be changed. No system is perfectly secure, but we work to protect your data and to improve our controls over time.
JRC does not use the Platform to make decisions about you based solely on automated processing, including profiling, that produce legal or similarly significant effects within the meaning of Article 22 GDPR. The Platform performs calculations on the figures your organisation enters (for example, greenhouse-gas estimates using published emission factors) as a reporting aid; these are not automated decisions about individuals.
Subject to the PDPA and, where it applies, the GDPR, you have the following rights in relation to your personal data:
For ESG data we hold on behalf of a Client organisation, please direct your request to that organisation (the controller); JRC will assist it as set out in the Data Processing Agreement. For your account data, contact us using the details in section 14. We will respond within the time required by the applicable law — under the GDPR, normally within one month (extendable by two further months for complex requests, with notice). We do not charge for exercising your rights except where a request is manifestly unfounded or excessive, as the law permits.
For personal data for which JRC is the data user / controller (such as account and usage data):
For ESG data processed on behalf of a Client organisation, JRC will notify the Client controller without undue delay after becoming aware of a breach so that the controller can meet its own notification obligations; JRC’s breach obligations are set out in the Data Processing Agreement.
If you have a concern about how your personal data is handled, please contact us first at tom@jr.com.my so we can try to resolve it. You also have the right to lodge a complaint with a supervisory authority:
The Platform uses browser storage that is strictly necessary to keep you signed in and to remember basic preferences (such as light/dark mode). It does not use advertising or third-party tracking cookies, so no separate cookie consent is required for these strictly necessary functions.
The Platform is a business tool and is not directed at children. We do not knowingly collect personal data from children.
For privacy and data-protection matters — including to exercise your rights or raise a concern — contact JRC’s data-protection contact at tom@jr.com.my. We will respond within the time required by the applicable law.
We may update this Policy from time to time. We will post the updated version here, change the version and effective date above, update the Bahasa Malaysia version, and notify Client administrators of material changes.