Vespera is an operating system for automotive dealerships in Malaysia. It covers official WhatsApp conversations, leads, stock, test drives, sales, service, finance records, runner jobs, and the staff tools around them.

This notice applies to people who visit the public site, staff and platform operators who sign in, runners who register, and customers whose details a dealership handles in Vespera. It is written for Malaysia. Display time is Asia/Kuala_Lumpur. Currency is MYR. Phone numbers are stored in E.164 format.

SCOP IT Solutions decides the purposes and means for personal data it collects for its own operations: the public website, staff and platform accounts that SCOP provisions, security of the service, product support, and billing of the Vespera subscription.

Each dealership is the data user for personal data about its own customers, leads, and related commercial records. SCOP IT Solutions processes that data only to provide Vespera, on the dealership’s instructions, and keeps each organisation’s data separate from every other organisation.

If you are a buyer messaging a dealership on WhatsApp, your relationship for that enquiry is with the dealership. Contact the dealership first about access, correction, or deletion of that record. SCOP will help the dealership carry out a valid request.

Depending on how you use Vespera, the data may include:

• Staff and platform operators. Name, work email, role, branch or brand assignment, invitation status, and any phone number the organisation stores. Passwords are stored only as Argon2id hashes. Sessions and multi-factor secrets are protected, and sign-in attempts record a hash of the IP address for lockout and abuse controls, not the raw address as a marketing identifier.
• Customers and leads, for the dealership. Name, WhatsApp phone number, message text, media the customer sends, vehicle interest, lead status, test-drive bookings, sales and service records, and a timestamp when the dealership records PDPA consent. Identity is scoped to that organisation. The same phone number at another dealership is a separate record.
• Documents a dealership or customer uploads. Loan packs, status pages, quotations, receipts, and service photos. These links are private. Anyone with a token link can use that link, so treat it as confidential.
• Runners. Account details needed to offer and complete jobs. Where identity or payout checks are required, national identity numbers and bank details are stored only as encrypted ciphertext, with a masked last-four for lists. Evidence photos stay in private storage.
• Devices. If you allow notifications, an Expo push token, platform, app install id, and an optional device name. Camera and photo-library access is used only when you choose to attach a photo.
• Mail. Invitation and service messages, and mail that staff send through Vespera mailboxes on @vespera.my.

Vespera does not ask for payment card numbers or full card data. Card payments, where a dealership enables them, are handled by the payment provider. We do not use customer WhatsApp numbers as a global identity across dealerships.

• To provide the workspace the dealership has subscribed to: inbox, leads, stock answers, test drives, sales, service, and finance.
• To deliver and receive WhatsApp messages through the official Meta WhatsApp Cloud API, including a deterministic chatbot and handover to a salesperson.
• To authenticate staff, keep sessions safe, and record an audit trail of sensitive actions.
• To send invitations, operational notices, and push notifications you or your organisation have turned on.
• To host runner jobs, evidence, and payouts where that module is enabled.
• To meet legal duties, including financial record-keeping and PDPA access, correction, and erasure requests.
• Where a dealership explicitly enables it, to draft replies or brief a manager from that dealership’s own data. Those features do not train on another organisation’s records.

We do not sell personal data. We do not use dealership customer chats for advertising profiles.

• From you, when you submit a form, sign in, message a dealership number connected to Vespera, upload a document, or register as a runner.
• From the dealership, when staff enter or import customer and operational records.
• From Meta, as webhook events for the dealership’s WhatsApp business account.
• From your device, for the push token and the photos you attach.

Some data is obligatory. A staff account needs a work email and a password. A WhatsApp customer record needs a phone number. A runner payout needs the payment details the payout flow asks for. If you do not provide obligatory data, the related feature cannot be provided.

Other data is voluntary: optional device name, extra notes, and photos you choose to attach. Refusing a voluntary item limits only that feature. You can withhold consent for a consent-based use, and you can ask the dealership to record that choice. Withdrawing consent does not undo processing that was already lawful, and it does not stop uses we must keep for law, security, or a contract already in progress.

We disclose personal data only as needed for the purposes above:

• The dealership’s own staff, according to their role. A salesperson does not automatically see every conversation in the organisation.
• Meta, for WhatsApp Cloud API delivery, media, and webhooks on the dealership’s business number.
• Infrastructure providers that host the application, database, and private file storage. Production storage is intended for the Singapore region.
• Expo, when the mobile app sends a push notification. Notification text stays generic. Customer detail stays inside the app.
• Stripe, only if the dealership enables card payments or runner payouts.
• OpenAI, only if the dealership turns on an AI feature. The prompt is limited to that organisation’s context.
• Authorities, when Malaysian law requires it, or to establish or defend a legal claim.

Platform operators at SCOP IT Solutions are not members of a dealership. Break-glass access to a tenant is audited and uses a separate control path.

Vespera is built for organisations in Malaysia. Some processors operate outside Malaysia, including infrastructure in Singapore and Meta, Expo, Stripe, or OpenAI when those services are in the path. Where personal data leaves Malaysia, SCOP IT Solutions takes steps consistent with the PDPA, including contracts that limit use to the service we asked for.

• Dealership customer and operational records stay for as long as that organisation’s workspace is active, then follow the dealership’s instruction, a PDPA erasure or offboarding job, and any law that requires a longer hold. Financial documents and the audit log may be retained after identifiers are removed or reduced.
• Raw WhatsApp webhook payloads are deleted after the configured retention window, 30 days unless a shorter or longer operations setting is applied.
• Staff sessions end on sign-out or expiry. Account data is removed or anonymised when the organisation closes the account and no legal hold remains.
• An erasure request anonymises customer identifiers, archives leads, and redacts message and note bodies. It does not rewrite financial history that must be kept.
• Offboarding a dealership suspends the organisation, revokes sessions, clears WhatsApp tokens, redacts customer personal data, and deletes webhook rows.

Each organisation’s rows are isolated in PostgreSQL with row-level security, and queries also filter by organisation. WhatsApp access tokens are encrypted. Media is served through authenticated access, not public file URLs. Logs record request and organisation ids. They are not written to include chat bodies, passwords, cookies, or tokens. WhatsApp is connected only through the official Meta Cloud API.

No method of transmission or storage is perfectly secure. Use a unique password, keep invitation and upload links private, and tell your organisation administrator if you suspect misuse of an account.

Under the PDPA you may, subject to the Act and any exemptions:

• Ask whether we hold your personal data and request access.
• Request correction of data that is inaccurate, incomplete, misleading, or not up to date.
• Withdraw consent for a use that depends on consent.
• Ask a dealership administrator to export or erase your customer record. Vespera provides those tools to authorised organisation managers.
• Limit processing to what the service and the law require, including optional push notifications and optional AI features.

Staff requests can go to your organisation administrator or to SCOP IT Solutions. Customer requests about a dealership’s records should go to that dealership; SCOP will assist the dealership. We may need to confirm you are the person the record is about before we act.

You may also complain to the Personal Data Protection Commissioner of Malaysia. We ask that you contact us first so we can try to resolve the matter.

The public marketing site does not use advertising or third-party analytics cookies. The staff and platform apps set a session cookie that is strictly necessary to keep you signed in. The mobile app stores a session on the device for the same reason. You can clear cookies in the browser or sign out. Clearing them ends the session.

Vespera is a business tool for dealership staff and for customers enquiring about vehicles. It is not directed at children, and we do not knowingly collect personal data from children under 18. If you believe a child’s data has been stored, contact the dealership or SCOP IT Solutions and we will delete it where the law allows.

SCOP IT Solutions may update this notice when the product or the law changes. The date at the top of this page is the latest version. Continued use of Vespera after an update means the new notice applies. If a change materially affects a consent-based use, we will ask the affected dealership to refresh consent where the PDPA requires it.

Privacy enquiries and complaints about Vespera go to the owner:

SCOP IT Solutions
Owner of Vespera
https://scop.my

Use the contact details published on that site. Include your name, the dealership if the request is about a customer record, and enough detail for us to find the data without collecting more than we need.