CertLink Terms of Service

1. Who you are contracting with

1.1 CertLink in Malaysia is operated by BADGE TECH SDN. BHD., a private company limited by shares incorporated in Malaysia on 24 June 2025 under the Companies Act 2016, SSM registration no. 202501028600 (1630012-A) ("we", "us", "Badge Tech").

1.2 Registered address: UG16, Tower A, PJ Midtown, Jalan Kemajuan, Seksyen 13, 46200 Petaling Jaya, Selangor, Malaysia. Telephone: +60-12-3300576. Email: info@badgetech.ai. Data Protection Officer: Lee Ai Mun (info@badgetech.ai, +60-12-3300576).

1.3 The platform is built and operated on our behalf by World Vertex Co., Ltd. (Republic of Korea) as our subcontractor. Where an institution contracts instead with that company, it is identified on the Korean-language pages. The two are separate companies, and the applicable one is the one named on the agreement you sign.

2. Definitions

"Customer" or "you" — the institution named in an Order Form or that creates an issuer account. "Authorised User" — a person you allow to use the Service on your behalf. "Recipient" — a person to whom you issue a Credential. "Verifier" — anyone who checks a Credential. "Credential" — a digital certificate or badge conforming to 1EdTech Open Badges 3.0 that you issue through the Service, together with its rendered image and PDF. A Credential is a verifiable credential signed with your issuer key; it is not a "certificate" within the meaning of the Digital Signature Act 1997 (see section 17). "Verification Artefacts" — the public material that lets a Verifier check a Credential: the issuer's public key documents (JWKS and DID document), status lists and the published context and schema URLs. "Customer Content" — everything you upload or enter: Recipient data, achievement definitions, designs, marks and logos. "Order Form" — the quotation or agreement that states your plan, Fees and term. "Fees" — the amounts stated in the Order Form. "SST" — service tax under the Service Tax Act 2018.

3. What the Service does and does not do

3.1 CertLink assembles, signs, renders and delivers Credentials on behalf of the issuing institution, and publishes the Verification Artefacts that allow third parties to check them.

3.2 The issuing institution decides what is issued and to whom. CertLink does not award, assess or accredit anything, and does not verify that a Recipient in fact earned what you say they earned.

4. Accounts, eligibility and issuer approval

4.1 The Service is for organisations — universities, training providers, professional bodies and agencies — not for individuals. By accepting these Terms, signing an Order Form or creating an issuer account, the person doing so confirms that they are authorised to bind the Customer, and the Customer agrees to be bound. A contract may be formed by electronic means (Electronic Commerce Act 2006, section 7).

4.2 Creating an account does not by itself entitle you to issue. Before issuance is enabled we confirm that the institution exists and that the person requesting access may act for it. We may decline or withdraw approval where we cannot make that confirmation, where the account would be used to issue in another body's name, or where these Terms are breached.

4.3 You are responsible for your Authorised Users, for keeping log-in details confidential and for enabling the two-factor authentication the Service requires. Tell us at once if you suspect unauthorised access.

5. Acceptable use

You must not: (a) issue in the name of, or so as to imply endorsement by, any body that has not authorised you; (b) represent an unaccredited programme as accredited, or otherwise mislead Recipients or Verifiers; (c) upload unlawful, defamatory or infringing content; (d) probe, overload or interfere with the Service or its security; (e) resell the Service; or (f) use it to send unsolicited mail.

6. Customer Content, institutional marks and emblems

6.1 Customer Content remains yours. You grant us a non-exclusive, royalty-free licence to host, process, render and publish it to the extent needed to provide the Service — including displaying your marks on Credentials and verification pages for as long as those Credentials remain verifiable.

6.2 You upload your own marks and warrant that you hold the rights to use them, or any permission required by law. CertLink does not supply national or state emblems, coats of arms, royal or governmental insignia, or stylised imitations of them. You must not upload any name or emblem specified in the Schedule to the Emblems and Names (Prevention of Improper Use) Act 1963 unless you hold the written permission that Act requires.

6.3 You are responsible for the accuracy of Recipient data. The Service refuses to issue where a required attribute is empty rather than printing a blank; it cannot detect a wrong value.

7. The credential record is append-only

Issued Credentials are not edited. A correction is made by revoking the Credential and issuing a replacement. This is a property of the system, not a policy choice: the signed Credential and the printed artefact are already with the Recipient and cannot be recalled. Revocation and suspension are recorded on separate status lists, so lifting a suspension never lifts a revocation.

8. Recipients and verifiers

8.1 Recipients hold their Credentials under their own arrangement with you. Verification through the public verification page and the published Verification Artefacts is free of charge to anyone, without an account, and is not time-limited.

8.2 Recipients and Verifiers do not accept these Terms. Nothing in these Terms limits any right a Recipient has against you as the issuing institution.

9. Fees, SST and invoicing

9.1 Fees are charged per institution, per year, as stated in the Order Form. Prices are quoted in Ringgit Malaysia. Unless the Order Form says otherwise, Fees are exclusive of SST, which is charged at the prevailing rate and shown as a separate line on every quotation and tax invoice.

9.2 Fees are payable annually in advance within thirty (30) days of the invoice date, by bank transfer. We do not offer a free pilot or trial; a paid term begins on the date stated in the Order Form.

9.3 Fees are non-refundable except where these Terms or the law say otherwise. If we terminate for our own convenience or for an uncured breach by us, we refund the unused part of the current year pro rata.

9.4 If an invoice is more than thirty (30) days overdue we may, after seven (7) days' written notice, suspend new issuance. Suspension never affects verification of Credentials already issued (section 11).

10. Term, suspension and termination

10.1 Each Order Form runs for one year from its start date and renews for successive one-year terms unless either party gives written notice of non-renewal at least sixty (60) days before the term ends. We will tell you the renewal Fees at least ninety (90) days before renewal.

10.2 Either party may terminate for a material breach that is not cured within thirty (30) days of written notice, or at once if the other party becomes insolvent. We may suspend the account immediately where continued use would breach the law, endanger Recipients or Verifiers, or compromise the security of the Service, and we will say why.

10.3 There is no termination for convenience within a paid year, by either party, except as stated in 9.3.

11. Verification after termination

When a contract ends, the verification path for credentials already issued keeps working. The retention period and conditions are set in the individual agreement.

On request we export the minimum verification dataset — the credential itself, the public key document and the status lists. That data belongs to the issuing institution.

If an institution's contract is suspended or terminated, we do not block verification of credentials recipients already hold.

In practical terms: your issuer key documents, your status lists and the context and schema URLs referenced inside signed Credentials stay published after termination, because removing any of them would break every Credential that points to it. The /v/{token} verification path is frozen for the same reason — it is printed in QR codes on paper certificates.

12. Data export and deletion

12.1 For sixty (60) days after termination you may export your Customer Content, Credential records and audit logs in machine-readable form, and we will provide the minimum verification dataset described in section 11 on request at any time.

12.2 After that period we delete Customer Content that is not needed to keep issued Credentials verifiable. The Verification Artefacts and the signed Credentials themselves remain, because a Recipient may need to prove a qualification long after. Further retention is governed by your Order Form and our Privacy Notice.

13. Availability, support and changes to the Service

13.1 We use commercially reasonable efforts to keep the Service available 24 hours a day, except for announced maintenance, emergency maintenance and events beyond our control. Service levels are commitments only where an Order Form states them.

13.2 Support is provided by email during business hours, Monday to Friday 09:00–18:00 Malaysia time, excluding Malaysian public holidays.

13.3 We may improve or change the Service. We will not remove a published verification route, an issuer key or a status list, and we will give at least ninety (90) days' notice of any change that removes a feature you rely on.

14. Intellectual property

14.1 The Service — its software, rendering engine, templates, documentation and marks — is owned by Badge Tech, World Vertex and their licensors. You receive a non-exclusive, non-transferable right to use it during the term. Open Badges 3.0 is a specification of 1EdTech Consortium; conformance claims are made only as permitted by 1EdTech.

14.2 If you give us feedback, we may use it without obligation. Nothing in this section transfers Customer Content to us.

15. Confidentiality

Each party keeps the other's non-public information confidential and uses it only for this agreement, for the term and three (3) years after; trade secrets and Recipient personal data are protected for as long as they remain such. This does not apply to information that is public, already known, independently developed, or that must be disclosed by law.

16. Personal data

16.1 For personal data you provide in order to issue Credentials, you are the data controller and Badge Tech is the data processor under the Personal Data Protection Act 2010 as amended in 2024. We process it only on your documented instructions, apply the Security Principle, assist you with data-subject requests and breach notification, and notify you without undue delay of a personal data breach affecting your data. For enquiries made through our website, we are the data controller.

16.2 Processing currently takes place on infrastructure in the Republic of Korea, operated by our subcontractor named in 1.3, and on the sub-processors listed in our Privacy Notice. You authorise those transfers; the basis for them is set out in the Privacy Notice.

16.3 A Recipient's email address never enters the signed Credential — only a salted identity hash — because a signed Credential cannot be edited afterwards.

16.4 Our Privacy Notice at certlink.io/legal/privacy forms part of these Terms. Where the two conflict on personal data, the Privacy Notice prevails.

17. What CertLink is not

17.1 CertLink is not a licensed certification authority under the Digital Signature Act 1997 and does not issue PKI certificates. A Credential is a verifiable credential signed with your issuer key; it is not a certificate within the meaning of that Act, and the statutory presumptions that Act attaches to signatures verified through a licensed authority do not apply to it. Where an institution requires the evidential position that Act provides, CertLink integrates a licensed authority.

17.2 A Credential does not replace a paper certificate, a certified true copy, notarisation, legalisation or an apostille where a law, a regulator or a foreign authority requires one.

17.3 We do not warrant that a Recipient earned what a Credential states, that any programme is accredited, or that any third-party wallet or verifier will read a Credential correctly.

17.4 Nothing on this site or in these Terms is legal advice about the status of an electronic document under Malaysian law. Except as expressly stated here, the Service is provided without other warranties, to the extent the law allows.

18. Limitation of liability

18.1 Neither party is liable for loss of profit, revenue, business, goodwill or data, or for any indirect or consequential loss, however arising.

18.2 Our total liability to you under or in connection with these Terms, in contract, tort (including negligence), statute or otherwise, is limited in aggregate to the Fees you paid to us in the twelve (12) months immediately before the event giving rise to the claim.

18.3 Nothing limits or excludes liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for any liability that cannot be limited or excluded under Malaysian law.

19. Indemnities

19.1 You indemnify us against third-party claims, and the resulting costs, arising from Customer Content, from your marks, from your decision to issue or revoke a Credential, or from your breach of section 5 or 6.

19.2 We indemnify you against third-party claims that the Service, used as permitted, infringes a Malaysian intellectual property right, provided you tell us promptly and let us conduct the defence.

20. Governing law and disputes

20.1 These Terms are governed by the laws of Malaysia.

20.2 Before starting proceedings, a party gives written notice of the dispute and senior representatives meet, in person or online, within fourteen (14) days to try to resolve it in good faith for at least thirty (30) days. The parties may agree to refer the dispute to mediation.

20.3 Subject to 20.2, the parties submit to the exclusive jurisdiction of the courts of Kuala Lumpur, Malaysia. Nothing prevents either party from seeking urgent injunctive relief in any court, and an Order Form may substitute arbitration administered by the Asian International Arbitration Centre, seated in Kuala Lumpur, for this clause.

21. Language

These Terms are written in English and issued together with a Bahasa Melayu version. In the event of any inconsistency between the English version and the Bahasa Melayu version, the English version shall prevail. Notices and support may be given in either language.

22. Notices

Notices to us go by email to info@badgetech.ai and, for termination or a claim, also by registered post to UG16, Tower A, PJ Midtown, Jalan Kemajuan, Seksyen 13, 46200 Petaling Jaya, Selangor, Malaysia. Notices to you go to your account owner's email or the address in the Order Form. Email takes effect on the next Malaysian business day; post, three (3) business days after posting.

23. Changes to these Terms; version history

23.1 We may change these Terms. We give at least thirty (30) days' notice by email and on this page; a change that materially reduces your rights takes effect only from your next renewal unless you accept it earlier. Continuing to use the Service after that date is acceptance.

23.2 Every version is retained and published with its version identifier and effective date. Earlier versions are never overwritten.

24. General

These Terms and the Order Form are the entire agreement. If part is unenforceable, the rest stands. Neither party may assign without the other's written consent, except to a successor of its whole business on notice. Neither party is liable for delay caused by events beyond its reasonable control, other than payment. We may use World Vertex and the sub-processors named in the Privacy Notice as subcontractors and remain responsible for them. Failure to enforce a right is not a waiver. Sections 7, 8, 11, 12 and 14–24 survive termination.

BADGE TECH SDN. BHD. · SSM registration no. 202501028600 (1630012-A) · UG16, Tower A, PJ Midtown, Jalan Kemajuan, Seksyen 13, 46200 Petaling Jaya, Selangor, Malaysia · +60-12-3300576 · info@badgetech.ai · Data Protection Officer: Lee Ai Mun (info@badgetech.ai, +60-12-3300576)