Effective Date: 23 December 2025 These Terms and Conditions ("Terms") govern your access to and use of the cloud-based facial verification and authentication service (the "Service") provided by TFX Islamic Sdn Bhd ("TFX Islamic", "we", "us", or "our"), a company incorporated in Malaysia with its registered address at D-1-3, Jalan PJU 5/1, Encorp Strand Garden Office, Kota Damansara, 47810 Petaling Jaya, Selangor, Malaysia. By registering for, accessing, or using the Service, you ("Customer", "you") agree to be bound by these Terms. If you are entering into these Terms on behalf of a company or other legal entity, you represent that you have the authority to bind such entity. These Terms, together with our Privacy Policy (available [insert link]), constitute the entire agreement between you and TFX Islamic regarding the Service. Important Note: The Service processes sensitive personal data (biometric data including facial images and templates) under the Personal Data Protection Act 2010 (Act 709) as amended ("PDPA"). As a data processor, we act only on your instructions as data controller. You remain solely responsible for obtaining explicit consent from data subjects, providing notices, and ensuring lawful processing. 1. Service Description The Service provides API-based facial verification (1:1 matching) and authentication capabilities, including liveness detection to prevent spoofing. We generate irreversible facial templates from submitted images/videos. Raw images are processed temporarily and not stored long-term unless instructed by you. 2. Access and Use of the Service Account. You must create an account to use the Service. You are responsible for maintaining the confidentiality of your API keys and credentials. License. Subject to these Terms, we grant you a limited, non-exclusive, non-transferable, non-sublicensable license during the subscription term to use the Service for your internal business purposes or to provide services to your end users. API Usage. Use must comply with our API documentation and rate limits. Excessive usage may result in throttling or additional charges. 3. Customer Responsibilities and Obligations You agree to: Obtain explicit written consent from data subjects before submitting any biometric data (unless a PDPA exemption applies). Provide clear privacy notices to data subjects explaining the processing of their biometric data by TFX Islamic as processor. Ensure all submitted data is lawfully obtained and processed. Not use the Service for any unlawful, discriminatory, or harmful purpose, including surveillance without consent, profiling for discriminatory decisions, or processing of children's data without proper safeguards. Implement appropriate security measures to protect API keys and prevent unauthorized access. Comply with all applicable laws, including PDPA, anti-money laundering regulations, and any guidelines from Bank Negara Malaysia (if applicable). Not reverse engineer, decompile, or attempt to derive the underlying algorithms or facial templates. 4. Prohibited Uses You shall not: Use the Service to process data of individuals without lawful basis. Submit synthetic, manipulated, or non-consensual images/videos. Use the Service for law enforcement purposes without proper authorization (note: certain high-risk uses may require additional approvals). Attempt to circumvent security features, including liveness detection. Use the Service to build a competing facial recognition product or service. Upload viruses, malware, or harmful code. Violation of prohibited uses may result in immediate suspension or termination without refund. 5. Fees and Payment Fees are based on your selected plan and actual usage (e.g., number of verifications). Payment is due in advance or as invoiced. Late payments accrue interest at 1.5% per month. We may adjust fees with 30 days' notice. 6. Data Processing and Ownership Your Data. You retain ownership of all data you submit. You grant us a limited license to process it solely to provide the Service. Our Rights. We own all rights to the underlying software, algorithms, and aggregated/anonymized performance data. We process data as your processor under a data processing agreement (incorporated herein). We do not use your data for our independent purposes except for aggregated, anonymized improvements (with opt-out option). 7. Confidentiality Both parties agree to keep confidential any non-public information disclosed and use it only for the purposes of these Terms. 8. Intellectual Property The Service and all related materials remain our exclusive property. You may not remove or alter any proprietary notices. 9. Warranties and Disclaimers Your Warranty. You warrant that you have all necessary rights, consents, and authority to submit data to the Service. Our Warranty. We warrant that the Service will perform substantially in accordance with documentation. EXCEPT AS EXPRESSLY PROVIDED, THE SERVICE IS PROVIDED "AS IS" WITHOUT WARRANTIES OF ANY KIND, INCLUDING ACCURACY, RELIABILITY, OR FITNESS FOR A PARTICULAR PURPOSE. Facial recognition involves probabilistic matching; results are indicative only and should not be relied upon as sole proof of identity. 10. Limitation of Liability To the maximum extent permitted by law: Our total liability shall not exceed the fees paid by you in the 12 months preceding the claim. We shall not be liable for any indirect, consequential, special, or punitive damages, including loss of profits, data, or business opportunities. You agree to indemnify and hold us harmless from claims arising from your breach of these Terms, unlawful use, or failure to obtain consents. 11. Termination Either party may terminate for material breach (with 30 days' cure period, except non-payment: 15 days). We may suspend or terminate immediately for prohibited use, non-payment, or legal requirements. Upon termination, you must cease use, delete all copies, and we will delete your data (subject to legal retention). 12. Governing Law and Dispute Resolution These Terms are governed by the laws of Malaysia. Any disputes shall be resolved exclusively in the courts of Malaysia. 13. Changes to Terms We may update these Terms. Material changes will be notified via email or in-app notice at least 30 days in advance. Continued use constitutes acceptance. 14. Contact Us For questions regarding these Terms: Data Protection Officer TFX Islamic Sdn Bhd D-1-3, Jalan PJU 5/1, Encorp Strand Garden Office, Kota Damansara, 47810 Petaling Jaya, Selangor, Malaysia Email: privacy@tfx.global These Terms and Conditions are provided as a general template. We strongly recommend that you have them reviewed and customized by qualified Malaysian legal counsel to ensure full compliance with the PDPA (as amended), other applicable laws, and your specific business operations.