PDPA - ATC College

Personal Data Protection Policy

A. General

In view of the implementation of the Personal Data Protection Act 2010 (“Act”), Macro System Consultancy Sdn. Bhd. (“the Company”) who wholly own Advance Tertiary College, an institution of higher education licensed by the Ministry of Education of Malaysia, recognizes the need to process all personal data obtained in a lawful and appropriate manner. The Company is committed to protecting the personal data supplied by a data subject to ensure compliance with the legal and regulatory requirements in accordance with the Act. This Personal Data Protection Policy (“Policy”) covers the processing of all personal data and sensitive personal data whose use is controlled by the Company. As a principle, collection, use, or disclosure of the personal data is prohibited for any purpose unless otherwise the approval of the head of relevant business units and the compliance officer.

B. Policy Status

1. This Policy is applicable to all employees of the Company. For the purposes of this Policy, the term “employees” herein refers to all members of the Company, including teachers, permanent, fixed term and temporary staff, any third party representatives and agents with the Company both either local or overseas. Compliance with this Policy is mandatory and failure to comply with the same may amount to a gross misconduct.

2. Any query regarding this Policy may be directed to the compliance officer of the Company [Mr.Inderjeet Singh].

3. In the event of any discrepancy, contradiction, and/or differences between any part of this Policy and that of any current policies adopted by the Company, the portion of the relevant policy which imposes a higher standard of data protection shall apply and supersede the other.

C. Roles and Responsibilities

4. The legal responsibility for compliance with the Act lies with the Company who is the “data user” under the Act and is registered as such with the Personal Data Protection Commission. However, the Company states that compliance with this Policy and the provisions contained in the Act are in fact the joint responsibility of all employees of the Company.

D. Data Collected & Purposes

5. During the course of the Company’s business and activities, the Company may be required to process information of a data subject, including but not limited to the name of the individual, gender, age, identification number and/or passport number, date of birth, race and nationality, address, phone number and email address. Information identifying a data subject will include information which can identify such individual in combination with other information even if such information cannot identify such individual on its own. Such information may be collected online or offline.

6. The personal data collected by the Company may be used inter alia for the following purposes*:-

i. Storing and processing of personal data relating to employees; students and their parents in the data storage systems;

ii. Updating and managing the accuracy of the Company’s internal record;

iii. Human resources, employment and recruitment purposes;

iv. Training of staff;

v. Billing, taxation and/or auditing purposes;

vi. Information and security purposes, including but not limited to managing and administrating e-mail, handling and investigating any security related issues, vulnerability, and/or incidents;

vii. Legal purposes (including but not limited to obtaining legal advice and dispute resolution);

viii. Disclosing personal data to the government authorities and/or authorised third party as required by law and/or within the responsibility of the Company; and

ix. As reasonably contemplated by the nature of any transaction.

*This list is not exhaustive and may be extended, varied and amended from time to time.

E. Data Processing

7. As and when the Company is required to collect personal data, the Company and its employees must abide by the requirements of this Policy and the Act. In the context of the Act, “processing” is defined to include collecting, recording, holding or storing personal data which includes inter alia NRIC numbers, home address, contact details etc.

8. The Company will be responsible for ensuring that any personal data processed in relation to the Company’s clients and/or another individual is accurate, complete, not misleading and kept up-to-date. The personal data will be reviewed periodically to warrant that they are up-to-date and to determine whether retention of such personal data is necessary.

F. Consent of Individual

9. The Company may only process personal data with the consent of the data subject whom the personal data concerns and/or if the processing of the personal data is for the performance of the Company’s duty to which the data subject is a party.

G. Disclosure of Information

10. The Company requires all employees to be vigilant and exercise reasonable caution when asked to provide any personal data to a third party. In particular, the Company must ensure that personal data is not disclosed either orally or in writing to any unauthorized employees without express prior consent of the compliance officer stated in Paragraph 2 and/or any authorised individual as the case may not be among the purposes contemplated in Paragraph 6.

11. However, as and when it is reasonably required, the personal data in the possession of the Company may be only disclosed to the following third parties:-

i. External professional advisors and auditors; and

ii. Governmental departments and authorities;

12. Personal data will not be transferred outside the Company and in particular not a country outside of Malaysia unless:-

i. Consent from the data subject is obtained; or

ii. The place outside Malaysia has been specified by the Minister charged with the responsibility for the protection of personal data by notification published in the Gazette.

H. Data Retention

16. Personal data obtained should not be retained longer than it is required for its purposes. The Company has an obligation to ensure that the personal data of the data subject are destroyed and/or permanently deleted after a specified period of time. All employees are required to contact the compliance officer and/or any authorised officer should the need to dispose of any personal data arises.

17. Personal and sensitive data will be disposed of by means as listed in Paragraph 14 above. Appropriate measures will and must be taken by the Company to ensure that the personal data destroyed are not reconstructed or processed by third party.

J. Rights of Data Subject

18. A data subject has the following rights under the Act:-

i. Request for access to personal data held on the individual, the purpose for which the personal data is being used and those to whom it has, or can be disclosed to;

ii. Prevent data processing that is likely to cause distress or damage;

iii. Take reasonable action to stop the use of, rectify, erase, and/or dispose of inaccurate personal data; and

iv. Withdraw their consent given to the Company.

19. Any individual who intends to exercise the abovementioned rights shall make a written request to the Company together with the prescribed fee as applicable. The Company shall, subject to exemptions, comply with the request and/or take reasonable steps not later than twenty one (21) days from the date of receipt of such request.