DRAFT FOR LEGAL REVIEW. SK Senggara's legal advisers have not approved this notice. Text in [square brackets] is a placeholder to be completed or removed before launch.

Personal Data Protection Notice

Last updated: 6 November 2026 (draft)

This is the written notice that section 7 of the Personal Data Protection Act 2010 (PDPA) requires SK Senggara Sdn. Bhd. to give you when it collects your personal data through the Contractor Management System. It tells you what data we process, why, where it comes from, who it is disclosed to, what you must provide, and your rights.

By ticking the box when you create an account, you confirm that you have read this notice and consent to the processing of your personal data as described here, including its transfer to Singapore. Please read it together with our Privacy Policy, which explains our practices in more detail. If something is unclear, email us at support@sksenggara.com.my.

About this notice

SK Senggara Sdn. Bhd. ("SK Senggara", "we", "us"), company registration number 202601021195 (1683292-A), of No 7, Jalan Iskandar Putri 1/5, Taman Nusantara Prima, 81550, Gelang Patah, Iskandar Puteri, Johor, is the data controller (called the data user before the Personal Data Protection (Amendment) Act 2024) for the personal data processed in the Contractor Management System at econ.sksenggara.com.my [to be confirmed by legal].

This notice is issued in English and Bahasa Malaysia, as section 7(3) of the PDPA requires. If the two versions differ, the English version prevails [to be confirmed by legal].

This notice applies to everyone whose personal data is processed in the system: account holders, the people a company adds to its profile, and visitors who contact us.

The personal data we process

Depending on how you use the system, we process:

Account data: your name, username, email address, phone number, profile photo and language preference, and your password in a protected, one-way form.
Identity data: your identity card (IC) or passport number and your role in the company, when you register a company.
Company data: the company's name, SSM and JCCD registration details, address, and licences and registrations such as CIDB and PKK, with the supporting documents you upload.
Data about people in the company: the names and IC or passport numbers of directors, shareholders and key personnel, and, where provided, the details of employees and skilled workers, including SOCSO numbers.
Correspondence: the emails and requests you send us, and our replies.
Technical data: your IP address, browser type, and the time of your sign-ins and changes, kept in security and audit logs.

We do not ask for sensitive personal data as the PDPA defines it: information about your health, political opinions, religious beliefs, the commission or alleged commission of an offence, or biometric data. Please do not include such information in the documents you upload. If a document you must upload contains it, for example a licence that shows your religion, we process it only because it is part of that document [to be confirmed by legal].

Where the data comes from

Most of the personal data we hold comes from you. We also receive personal data:

From the person who registers or manages your company, when they add you as a director, shareholder, employee, skilled worker or team member, or invite you to an account.
From the documents uploaded with a registration, such as licence certificates and authorisation letters.
From public registers and licensing bodies, such as SSM, CIDB, PKK and JCCD, when our reviewers verify a registration or a licence [which checks are made — to be confirmed by SK Senggara].
From the system itself, which records technical data when you use it.

Why we process it

We process personal data for these purposes:

To create and secure your account and verify your email address.
To assess, approve, suspend or reject contractor registrations, and to verify licences, credentials and the identity of the people behind a company.
To keep company profiles current and to maintain our register of approved contractors.
To contact you about your account, registration, licences, tenders, work packages and announcements from SK Senggara.
To protect the system and its users: detecting misuse, investigating incidents and keeping an audit trail of who changed what.
To comply with the law, respond to lawful requests from authorities, and meet our audit and record-keeping obligations.
To handle your requests, complaints and the exercise of your rights.

We do not use your personal data for direct marketing, we do not profile you and we do not sell your data. If we ever wish to use it for a new purpose, we will tell you first and, where the PDPA requires it, ask for your consent.

Who we disclose it to

We disclose personal data only to these classes of third parties, and only as far as the purposes above require:

SK Senggara's reviewers and administrators, who assess registrations and manage accounts. Their actions are recorded in an audit log.
Other authorised users of your own company, as invited by its owner.
Our service providers, who process data on our behalf and under our instructions: Amazon Web Services (AWS), which hosts the system, its database and uploaded files, and AWS Simple Email Service, which delivers our emails [data processor terms — to be confirmed by legal].
Our professional advisers and auditors, where they need it to advise or audit us [to be confirmed by SK Senggara].
Government and regulatory authorities, courts and law enforcement, where the law requires or permits it.
A successor to our business, if SK Senggara or the system is transferred, sold or merged, on terms that keep this notice in force [to be confirmed by legal].

We do not disclose your personal data to anyone else without your consent.

Transfer outside Malaysia

The system, its database and uploaded files are hosted by AWS in Singapore. Your personal data is therefore transferred to and stored outside Malaysia. The CloudFront network that serves the website and the delivery of email may involve other locations.

We transfer it on the basis of your consent, which you give when you accept this notice, and [other condition under section 129 of the PDPA as amended, such as equivalent protection in the receiving country or contractual safeguards — to be confirmed by legal]. AWS protects data under its own security and privacy commitments. If the hosting location changes, we will update this notice.

What you must give us, and what is optional

Some personal data is obligatory and some is voluntary. The forms mark optional fields.

To create an account, you must give your username, email address and password, and accept the Privacy Policy, the Terms of Use and this notice. Without them we cannot create your account.
To register a company, you must give the company details the registration form requires, your IC or passport number and your role in the company, and the names and IC or passport numbers of its directors and shareholders, with the supporting documents. Without them we cannot assess the registration, and it cannot be approved.
To keep a registration approved, you must keep its licences and documents current. If they lapse, the registration may be suspended or lapse too.
Your name, phone number, profile photo, and the details of employees, skilled workers, plant and suppliers are voluntary, except where a tender or work package asks for them. Leaving them out does not affect your account but may limit what SK Senggara can consider you for.

Personal data about other people

When you add directors, shareholders, employees, skilled workers or team members, or upload documents that name other people, you give us their personal data. Before you do, you must be entitled to give it to us, and you must tell them that SK Senggara will process their data as this notice describes and give them a copy of this notice or a link to it.

A person named in your company's profile may contact us to exercise the rights below. We may ask the company's owner to help us confirm their identity.

Your rights and choices

Under the PDPA you have the right to:

Access your personal data: ask for a copy of what we hold about you (section 30). Account holders can also download their account data in Settings, under "Your data".
Correct it: ask us to correct data that is inaccurate, incomplete, misleading or out of date (section 34). You can change many details yourself in your profile.
Withdraw your consent: tell us in writing at any time (section 38). We will then stop processing your data, except where the PDPA allows us to continue, and we may be unable to keep your account or your company's registration.
Limit processing: ask us to stop processing your data where it is causing, or is likely to cause, substantial and unwarranted damage or distress (section 42).
Refuse direct marketing (section 43). We do not send direct marketing, so there is nothing to opt out of.
Data portability: ask us to send your data to another data controller in a machine-readable form, once the provisions introduced by the 2024 amendment are in force and apply to us [to be confirmed by legal].

To use these rights, email support@sksenggara.com.my or write to the address below. We may ask you to prove your identity. We will respond within 21 days, as the PDPA requires, and we may charge the fee the PDPA permits for an access request [to be confirmed by legal]. If we have to refuse a request, we will tell you why.

If you are not satisfied with our response, you may complain to the Personal Data Protection Commissioner (Jabatan Perlindungan Data Peribadi, pdp.gov.my).

How long we keep it and how we protect it

We keep personal data only as long as the purposes above and the law require: for the length of your registration or contract with SK Senggara (up to 10 years) and for 6 years after it ends [to be confirmed by legal]. After that we delete it or make it anonymous, unless the law requires us to keep it longer.

We protect it with encryption in transit and at rest, role-based access, masked identity numbers in logs and summaries, private file links that expire, and an audit log of sign-ins and changes. The Privacy Policy describes these measures in more detail.

If a personal data breach occurs that is likely to cause you significant harm, we will notify the Personal Data Protection Commissioner and tell you without unnecessary delay, as the PDPA as amended requires [to be confirmed by legal].

Changes to this notice

We may update this notice. The version on this page, with the date at the top, is the one in force. If a change is significant, we will tell account holders by email and by a notice in the system, and ask for your consent again where the PDPA requires it. [to be confirmed by legal]

Contact us

Questions, requests and complaints about personal data: email support@sksenggara.com.my.

SK Senggara Sdn. Bhd., No 7, Jalan Iskandar Putri 1/5, Taman Nusantara Prima, 81550, Gelang Patah, Iskandar Puteri, Johor.

Data Protection Officer [appointment under the 2024 amendment — to be confirmed by SK Senggara]: Nor Azam bin Mohamed, email norazam@sksenggara.com.my, telephone +60 14-320 0071.