PART C | INCORPORATED POLICIES

POLICY 4 - DATA HANDLING RULES (PDPA)

4.1  Lawful purpose. The Licensee shall process Personal Data of Students, Parents and Leads only for the Permitted Purpose, shall present or make available the Licensor's privacy notice (in the prescribed languages) at the point of collection, and shall obtain the consents that the notice or the law requires.

4.2  Minimisation and storage. Only the categories of Personal Data specified by the Licensor may be collected, and records must be kept accurate. Sensitive personal data must not be collected unless expressly instructed. Personal Data must be accessed and stored only through the approved Platform, and must not be exported to personal devices, spreadsheets or third-party tools without written approval.

4.3  No unauthorised use. The Licensee shall not use, disclose, sell, share or transfer any Personal Data for its own purposes or to any third party, including for any other business, list-building or marketing unrelated to the Programme, and shall not transfer Personal Data outside Malaysia without the Licensor's prior written consent and compliance with applicable cross-border requirements.

4.4  Security, retention and deletion. The Licensee shall implement practical security measures against loss, misuse, unauthorised access, modification or disclosure, including device security and access controls. Personal Data must not be retained longer than necessary for the Permitted Purpose and must be securely deleted or returned on the Licensor's request or on termination.

4.5  Breach and data subject requests. Any actual or suspected data breach must be notified to the Licensor immediately, and in any event within twenty-four (24) hours, with full cooperation in investigation, mitigation and any notification obligations under the Personal Data Protection Act 2010 (as amended). Any request, complaint or correspondence from a data subject or the Personal Data Protection Commissioner must be referred to the Licensor within three (3) business days.