Privacy Policy

1. Introduction

FELDA Plantation Management System Berhad ("FPMSB", "we", "our", or "us") operates the Felda Dashboard (TiTO), an internal management platform provided to authorised personnel and administrators. This Privacy Policy describes how we collect, use, store, and protect personal information when you use our platform, including any integrations with third-party services such as Facebook and Instagram.

2. Information We Collect

We collect the following categories of information:

• Account information — name, email address, staff ID, and role assigned by your organisation.
• Login credentials — hashed passwords; we do not store plaintext passwords.
• Social media tokens — when you connect your Facebook Page or Instagram Business account, we store an access token issued by Meta on your behalf. This token is used solely to publish content to your pages.
• Usage data — logs of actions taken within the platform (e.g. articles published, reports generated) for audit and operational purposes.
• Device information — IP address, browser type, and session identifiers for security purposes.

3. How We Use Your Information

• To authenticate and authorise your access to the platform.
• To publish news articles and updates to your connected Facebook Page and Instagram account on your instruction.
• To send system notifications (e.g. approval alerts, report summaries) via WhatsApp or email.
• To maintain activity logs for compliance and internal audit requirements.
• To improve platform performance and user experience.

4. Facebook & Instagram Integration

When you connect your Facebook or Instagram account, you authorise FPMSB's registered Meta application to access your Page on your behalf. We request only the minimum permissions necessary:

• pages_show_list — to identify which Facebook Pages you manage.
• pages_manage_posts — to publish content to your Page.
• instagram_content_publish — to publish content to your linked Instagram Business account.

Your access tokens are encrypted at rest. We do not share your social media credentials or tokens with any third party other than Meta's own API. You may disconnect your accounts at any time from the Social Accounts settings page.

5. Data Sharing & Disclosure

We do not sell, rent, or trade your personal information. We may share information only:

• With authorised personnel within FPMSB for operational purposes.
• With Meta Platforms, Inc. as required to facilitate the Facebook/Instagram publishing integration.
• Where required by Malaysian law or a valid court order.

6. Data Retention

Personal data is retained for as long as your account is active, or as required by applicable law. Social media access tokens are deleted when you disconnect your account or upon your formal request. Audit logs are retained for a minimum of 2 years.

7. Your Rights

Under the Personal Data Protection Act 2010 (PDPA), you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Request deletion of your data (subject to legal retention requirements).
• Withdraw consent for specific data processing activities.

To exercise these rights, contact your system administrator or submit a request through the Account Deletion Request page.

8. Security

We implement industry-standard security measures including HTTPS encryption, hashed password storage, and session management. However, no system is completely secure. You are responsible for maintaining the confidentiality of your login credentials.

9. Changes to This Policy

We may update this Privacy Policy from time to time. The effective date at the top of this page will be updated accordingly. Continued use of the platform after changes constitutes acceptance of the revised policy.

10. Contact

For any privacy-related inquiries, please contact the FPMSB IT Department at it@fpmsb.com.my.