Privacy Policy

We collect personal data that you provide directly to us, including:

• Full name
• Email address
• Phone number (optional, if provided)
• Programme enquiry or message content

We also collect limited technical data automatically when you visit our website: browser type, pages visited, approximate location (country level), and time of visit. This is collected via analytics cookies, subject to your consent.

Legal basis for processing

• Consent — for analytics cookies and optional marketing communications
• Legitimate interests — for responding to programme enquiries and administering enrolments
• Contractual necessity — for delivering programme services to enrolled participants

Retention periods

Enquiry data is retained for 24 months from the date of last contact. Participant data is retained for 36 months following programme completion. Analytics data is retained in aggregated, anonymised form for up to 26 months.

Personal data is used for the following purposes:

• Responding to programme enquiries
• Processing and confirming enrolments
• Communicating programme schedules, materials, and logistical information
• Sending occasional updates about future programmes, where you have consented
• Improving the website and programme content through aggregated analytics

We do not sell personal data to third parties. We do not share personal data with financial institutions, insurance companies, or marketers. We do not use personal data for automated decision-making or profiling.

Third-party processors

We use the following third-party services which may process personal data on our behalf: Google Analytics (website analytics, EU-US Data Privacy Framework compliant), and a hosted email service provider for transactional communications. All processors are contractually bound to handle data in accordance with applicable law.

• Website connections use TLS encryption (HTTPS)
• Access to personal data is restricted to staff who need it to fulfil programme-related functions
• Staff handling personal data are made aware of their obligations under the PDPA
• In the event of a data breach affecting personal data, affected individuals will be notified as soon as reasonably practicable and in accordance with applicable law

Under the Personal Data Protection Act 2010 (Malaysia) and, where applicable, the GDPR, you have the following rights:

• Right of access — to request a copy of the personal data we hold about you
• Right to correction — to request correction of inaccurate personal data
• Right to withdraw consent — at any time, where processing is based on consent
• Right to object — to processing based on legitimate interests
• Right to erasure — subject to legal obligations, to request deletion of your data
• Right to data portability — to receive your data in a machine-readable format where technically feasible

To exercise any of these rights, contact us at [email protected]. We will respond within 21 days. You may also lodge a complaint with the Department of Personal Data Protection Malaysia (JPDP) if you believe your rights under the PDPA have been infringed.