Privacy Notice

We collect personal data that you provide to us and data generated through your use of the Service:

• Identity data — name, email address, role, organisation details;
• Account data — login credentials (hashed), activity and audit-trail records;
• Business data — organisation profiles, certification application details, audit documents and findings, quotations, invoices, and payment-confirmation records;
• Technical data — IP address, browser type, device identifiers, and usage logs.

We process personal data for the following purposes:

• Providing and operating the certification lifecycle (quotation → payment → audit → certification progress);
• Account administration, authentication, and role-based access control;
• Compliance, audit, and regulatory record-keeping (including the immutable audit trail);
• Customer support and communications about the Service;
• Security, fraud prevention, and safeguarding the integrity of the platform;
• Where you have consented, optional AI-assisted features (advisory only).

We process personal data on the basis of: (i) your consent, where we request it; (ii) performance of a contract to which you are a party; (iii) our legitimate interests in operating and securing the Service; and (iv) compliance with legal and regulatory obligations. Where processing relies on consent, you may withdraw consent at any time by contacting us.

We do not sell your personal data. We may share personal data only with: (i) service providers who process data on our behalf (e.g. hosting and infrastructure, email delivery, payment processing) under appropriate confidentiality obligations; (ii) authorised parties within the certification workflow (coaches, auditors, JAKIM administrators) as required to deliver the Service; and (iii) regulators, courts, or authorities where required by law.

We apply organisational and technical measures to protect personal data, including row-level security (RLS) on all database tables, role-based access control, an immutable audit trail, transport encryption, and least-privilege access for our staff. While no method of transmission or storage is completely secure, we take reasonable steps to protect the data you entrust to us.

We retain personal data only for as long as necessary for the purposes described in this Notice or as required by law. Certification records and audit-trail data are retained to meet regulatory and compliance obligations. When data is no longer needed, we delete or anonymise it.

We take reasonable steps to ensure that personal data is accurate, complete, and up to date. Please inform us of any changes to your personal data so we can keep our records current.

Subject to applicable law, you have the right to: (i) request access to your personal data (PDPA §30); (ii) request correction of inaccurate or incomplete data (PDPA §34); (iii) withdraw consent where processing relies on it; and (iv) where applicable, request deletion of data we no longer have a lawful basis to retain. If you are in the EU/UK, you may also have rights under the GDPR, including data-portability and objection rights. To exercise any of these rights, contact us using the details below.

The Service is hosted on infrastructure that may be located outside Malaysia and outside your country of residence. By using the Service, you acknowledge that your personal data may be transferred to and processed in such locations, and we take reasonable steps to ensure appropriate safeguards are in place.

The Service is not directed at children under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can delete it.

We may update this Privacy Notice from time to time. The latest version will always be published on this page with an updated date. Material changes will be brought to your attention where appropriate.

For questions, access, correction, or deletion requests, contact us at: