Privacy Policy and Personal Data Protection Notice

1. Information We May Collect

Depending on your relationship with us, we may collect the following information:

Personal and Contact Information

• Full name
• Identification card or passport number, where required
• Nationality
• Date of birth
• Gender, where relevant
• Job title and department
• Company or organisation name
• Mailing or business address
• Email address
• Telephone or WhatsApp number
• Emergency contact information

Training and Registration Information

• Training programme selected
• Training dates, venue and attendance records
• Signature on attendance forms
• Employer and HR department details
• Dietary requirements
• Accessibility or special assistance requirements
• Assessment results, feedback and evaluation responses
• Certificates, qualifications and professional information
• Continuing professional development or accreditation details, where applicable

HRD Corp-Related Information

For HRD Corp claimable programmes, we may collect and process information required to support grant applications, attendance verification, claims, audits and compliance requirements, including:

• Participant and employer details
• HRD Corp registration or reference information
• Grant application information
• Attendance records and supporting documents
• Invoices, receipts, quotations and payment records
• Training schedules, course outlines and trainer information
• Photographs or other evidence required for training verification
• Other information requested by HRD Corp or an authorised regulatory body

Payment and Transaction Information

• Billing information
• Invoice and receipt details
• Payment method
• Transaction reference number
• Bank account information, where required for refunds
• Company tax, SST or e-Invoice information

We generally do not directly store complete payment-card details where payments are processed through an external payment service provider.

Website and Technical Information

When you use our website, we may automatically collect:

• Internet Protocol address
• Browser and device information
• Operating system
• Pages visited
• Date and time of access
• Referring website
• Website usage and interaction information
• Cookie and analytics information

Photographs, Video and Audio

We may collect photographs, video recordings or audio recordings taken during training programmes, webinars, corporate events or promotional activities.

Where appropriate, we will provide a notice, obtain consent or provide participants with a reasonable opportunity to inform us that they do not wish to appear in promotional materials.

Communication and Marketing Information

We may collect:

• Email, telephone and WhatsApp correspondence
• Enquiries and customer-service records
• Marketing preferences
• Course interests
• Responses to surveys, promotions or campaigns
• Social-media interactions with our official accounts

2. How We Collect Personal Data

We may collect personal data:

• Directly from you through our website, registration forms, enquiry forms, surveys, email, telephone, WhatsApp or social media
• Through physical or online training-registration forms
• From your employer, HR department, authorised representative or sponsoring organisation
• From trainers, facilitators, consultants or event partners
• Through HRD Corp systems or related claim documentation
• From payment processors and financial institutions
• From event-management, webinar or online-learning platforms
• Through cookies and website analytics
• From publicly available business or professional sources
• When photographs, videos or recordings are taken during our programmes

Where another person or organisation provides us with your personal data, we rely on that party to confirm that it has the authority or appropriate permission to provide the information to us.

3. Purposes for Processing Personal Data

We may process your personal data for the following purposes:

• To process training enquiries and registrations
• To confirm your registration and participation
• To communicate training dates, venue details, programme changes and reminders
• To arrange training materials, meals, accommodation or special requirements
• To verify and record attendance
• To issue certificates of attendance or completion
• To administer assessments, evaluations and participant feedback
• To prepare quotations, invoices, receipts, credit notes and e-Invoices
• To process payments, refunds and outstanding balances
• To communicate with your employer or sponsoring organisation
• To assist with HRD Corp grant applications and claims
• To comply with HRD Corp documentation, verification and audit requirements
• To manage online training through platforms such as Zoom, Google Workspace or other learning systems
• To provide customer service and respond to complaints
• To maintain internal business, accounting and administrative records
• To evaluate and improve our courses, trainers, services and website
• To manage trainers, speakers, venues, vendors and programme partners
• To conduct internal audits, risk management and fraud prevention
• To comply with legal, tax, regulatory, insurance and contractual requirements
• To protect the safety, rights and property of participants, staff and third parties
• To send information about upcoming courses, promotions and services, where permitted
• To publish event photographs or recordings for reporting and promotional purposes, where appropriate
• For any other purpose directly related to the purposes stated above

4. Marketing Communications

With your consent, or where otherwise permitted by law, we may send you information about:

• Upcoming public and online training programmes
• In-house training opportunities
• Promotions and early-bird offers
• HRD Corp claimable programmes
• Events, webinars and related services

Marketing communications may be sent through email, telephone, SMS, WhatsApp or social-media channels.

You may withdraw your consent or unsubscribe at any time by:

• Using the unsubscribe option provided in the communication
• Replying “STOP” or “UNSUBSCRIBE”
• Contacting us using the details stated in this Privacy Policy

Withdrawal from marketing communications will not affect essential communications relating to an existing registration, payment, certificate, claim or contractual arrangement.

5. Disclosure of Personal Data

We may disclose personal data, where necessary, to:

• HRD Corp and its authorised representatives
• Your employer, sponsoring organisation or authorised representative
• Trainers, facilitators, consultants and programme coordinators
• Hotels, training venues, caterers and event-service providers
• Online meeting, webinar and learning-platform providers
• Website hosting, cloud storage and information-technology providers
• Payment gateways, banks and financial institutions
• Accountants, auditors, insurers, lawyers and professional advisers
• Printing, courier, certificate and document-management providers
• Marketing, analytics and communication-service providers
• Government authorities, regulators, courts or law-enforcement agencies
• Business partners involved in jointly organised programmes
• A purchaser, investor or successor in connection with a corporate transaction
• Other parties where you have provided consent or where disclosure is required or permitted by law

We require service providers handling personal data on our behalf to use the information only for authorised purposes and to maintain appropriate confidentiality and security measures.

We do not sell or rent personal data to third parties.

6. HRD Corp Documentation

As an HRD Corp Registered Training Provider, we may be required to retain and submit participant, employer, attendance, programme and financial information to HRD Corp.

This information may be used for:

• Grant application support
• Claim submission
• Attendance verification
• Course and trainer verification
• Compliance reviews
• Audits and investigations
• Prevention of false or duplicate claims
• Other purposes required under HRD Corp procedures

Certain information may be mandatory for an HRD Corp claim. Failure to provide the required information may affect the employer’s grant application, claim or the participant’s registration.

7. Photographs and Recordings

Photographs, video or audio recordings may be taken during our training programmes and events for:

• Attendance or programme verification
• Internal reports
• HRD Corp supporting documentation
• Training records
• Website and social-media content
• Marketing and promotional materials

Where photographs or recordings are used for promotional purposes, we will take reasonable steps to provide notice or obtain consent where appropriate.

Participants who do not wish to appear in promotional photographs or recordings should inform our representative before the programme begins or contact us using the details below.

We may still retain photographs or recordings where they are reasonably required as evidence of programme delivery, attendance, safety, compliance or legal obligations.

8. Online Training and Third-Party Platforms

Online programmes may be delivered using third-party services such as video-conferencing, cloud-storage, form, email or learning-management platforms.

When you use these platforms, your information may also be processed according to the platform provider’s own privacy terms.

Online sessions may be recorded only where necessary and where participants have been informed. Recordings may be used for:

• Attendance verification
• Internal quality review
• Programme delivery
• Compliance documentation
• Providing access to authorised participants, where applicable

Participants must not independently record, reproduce or distribute an online session without our prior written permission and the permission of other affected individuals.

9. Cookies and Website Analytics

Our website may use cookies and similar technologies to:

• Enable website functions
• Remember user preferences
• Understand website traffic
• Measure marketing performance
• Improve website content and usability
• Detect technical or security issues

You may adjust your browser settings to reject or remove cookies. However, disabling certain cookies may affect how the website functions.

Where required, we will seek your consent before placing non-essential cookies on your device.

10. Security of Personal Data

We implement reasonable administrative, physical and technical safeguards to protect personal data from:

• Loss
• Misuse
• Unauthorised access
• Unauthorised disclosure
• Alteration
• Accidental destruction
• Cybersecurity threats

These safeguards may include access restrictions, password protection, secure cloud services, staff confidentiality requirements, backups and appropriate security procedures.

However, no website, electronic communication or data-storage system can be guaranteed to be completely secure.

11. Personal Data Breaches

We maintain procedures to detect, assess and respond to personal data breaches in accordance with the Personal Data Protection Act 2010 [Act 709], as amended, and the applicable guidelines issued by the Personal Data Protection Commissioner.

Where a personal data breach occurs that causes or is likely to cause significant harm to affected individuals, we will notify the Personal Data Protection Commissioner within the timeframe prescribed by law, and will notify affected individuals without unnecessary delay where required.

Notifications will include, where applicable, the nature of the breach, the personal data affected, the measures taken or to be taken, and steps individuals may take to protect themselves.

12. Retention of Personal Data

We retain personal data only for as long as reasonably necessary to:

• Fulfil the purposes described in this Privacy Policy
• Complete training, certification and HRD Corp processes
• Maintain business, attendance and financial records
• Meet tax, accounting, audit and legal requirements
• Resolve complaints or disputes
• Establish or defend legal claims

Different categories of information may be retained for different periods.

When personal data is no longer required, we will take reasonable steps to securely delete, destroy or anonymise it, subject to any legal, contractual or regulatory retention obligations.

13. Accuracy of Personal Data

We take reasonable steps to ensure that personal data is accurate, complete and up to date.

You are responsible for informing us of any changes to your personal or company information, particularly information relating to:

• Your name
• Identification details
• Contact information
• Employer
• Billing information
• HRD Corp documentation
• Certificate information

14. Your Rights

Subject to applicable law, you may request to:

• Access personal data held about you
• Correct inaccurate or incomplete personal data
• Withdraw consent previously provided
• Object to or limit certain processing activities
• Stop receiving direct-marketing communications
• Request information about how your data has been used or disclosed
• Submit a complaint concerning the handling of your personal data

Right to Data Portability

Where the conditions prescribed under the Personal Data Protection Act 2010 [Act 709], as amended, are met, you have the right to request that your personal data be transmitted to you or to another data controller in a structured, commonly used format. This right applies to personal data processed by automated means and does not apply to all categories of personal data we hold.

Some requests may be subject to legal exceptions, verification requirements, administrative procedures or a reasonable fee permitted by law.

Withdrawing consent may affect our ability to provide certain services, process a registration, issue a certificate or support an HRD Corp claim.

15. Children and Minors

Our services are primarily intended for adults and corporate participants. For the purposes of this Privacy Policy, an individual below 18 years of age is considered a minor.

Where a participant is a minor, personal data should be provided by, or with the permission of, a parent, legal guardian, employer or authorised organisation.

16. Cross-Border Transfer

Some service providers, cloud systems, online meeting platforms or technology providers we use may store or process personal data outside Malaysia.

Where we transfer personal data outside Malaysia, we will only do so where permitted under the Personal Data Protection Act 2010 [Act 709], as amended — including where the recipient jurisdiction has in force a law substantially similar to, or serving the same purposes as, the Act, or where another basis permitted by law applies (such as your consent, or where the transfer is necessary for the performance of a contract with you).

We take reasonable steps to ensure appropriate safeguards are in place before transferring personal data outside Malaysia.

17. Links to Other Websites

Our website or communications may contain links to third-party websites or platforms.

We are not responsible for the privacy practices, security or content of those external services. You should review their privacy policies before providing personal data.

18. Mandatory and Voluntary Information

Some personal data requested by us is mandatory for:

• Course registration
• Attendance verification
• Certificate issuance
• Payment and invoicing
• HRD Corp grant or claim documentation
• Compliance with legal or regulatory requirements

Other information may be voluntary.

Where mandatory information is not provided, we may be unable to process your registration, provide the requested service, issue documentation or support an HRD Corp claim.

19. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in:

• Our services and business practices
• Legal or regulatory requirements
• HRD Corp procedures
• Technology and security practices

The latest version will be published on our website together with its effective or last-updated date.

Your continued use of our website or services after an update constitutes acknowledgement of the revised Privacy Policy, subject to applicable law.

20. Data Protection Officer

In accordance with the Personal Data Protection Act 2010 [Act 709], as amended, we have appointed a Data Protection Officer (“DPO”) who is responsible for overseeing our compliance with applicable personal data protection laws, including advising on our obligations, monitoring our data protection practices, and serving as the point of contact for the Personal Data Protection Commissioner and data subjects.

Our DPO’s appointment has been notified to the Personal Data Protection Commissioner as required by law.

You may contact our DPO using the details in the “Contact Us” section below.

21. Contact Us

For questions, requests, complaints or concerns regarding this Privacy Policy or your personal data, please contact:

To protect your information, we may request proof of identity or authority before processing a personal-data request.

22. Consent and Acknowledgement

By submitting personal data to us, registering for a programme, communicating with us or using our services, you acknowledge that you have read and understood this Privacy Policy.

Where consent is required, you consent to the collection, use, processing, storage and disclosure of your personal data for the purposes described in this Privacy Policy.

Where you provide personal data relating to another person, you confirm that you are authorised to provide that information and have informed the person about this Privacy Policy.