Privacy Policy

Who we are

SK Senggara Sdn. Bhd. ("SK Senggara", "we", "us") runs the Contractor Management System at econ.sksenggara.com.my. We use it to register contractors, check their licences and credentials, and keep those records up to date. For the personal data described here, we are the data user under the PDPA [to be confirmed by legal].

Company registration number: 202601021195 (1683292-A). Registered address: No 7, Jalan Iskandar Putri 1/5, Taman Nusantara Prima, 81550, Gelang Patah, Iskandar Puteri, Johor.

This policy is published in English and Bahasa Malaysia. If the two versions differ, the English version prevails [to be confirmed by legal].

What we collect

We collect only what the system needs. This is what we hold:

• Your account: your name, username, email address, language preference, phone number (optional) and profile photo (optional). Your password is kept only in a protected, one-way form.
• Your company profile: the company name, SSM and JCCD registration details, address, and licences or registrations such as CIDB, PKK and others.
• When you register a company: your identity card (IC) or passport number and your role in the company. These are stored with that registration, not on your account.
• People in your company: the names and identity card (IC) or passport numbers of the directors, shareholders and key staff you add, and, where you provide them, details of employees and skilled workers, including SOCSO numbers.
• Files you upload: licence certificates, registration documents, authorisation letters and similar supporting documents.
• Technical records: your IP address, browser type, and the time of sign-ins and changes, kept in security and audit logs.
• Cookies: only the strictly necessary cookies that keep you signed in and protect forms (see Cookies below).

IC and passport numbers are collected for two purposes only: to identify the directors, shareholders and key personnel of a registered company, and to verify that the person registering a company is linked to it. Only you, your company's authorised users and the SK Senggara staff who review registrations can see them.

You give us this data yourself when you register and fill in your profile. If you add information about other people, such as directors or staff, please make sure you are entitled to give it to us and that they know.

Why we use it, and the legal basis

We use personal data only for these purposes:

• Creating and securing your account, and verifying your email address.
• Assessing and approving contractor registrations, and verifying licences and credentials.
• Keeping your company profile current, and contacting you about your account, registration, tenders and work packages.
• Protecting the system: detecting misuse, investigating incidents and keeping an audit trail of who changed what.
• Meeting our legal, audit and record-keeping obligations.

Legal basis: we process your data with your consent, which you give when you create an account and accept this policy, and where the PDPA allows processing without consent, for example where it is necessary to deal with your registration or to comply with a legal obligation. [Consent mechanism and basis for each purpose — to be confirmed by legal.]

We do not use your data for advertising and we do not sell it.

Who can see your data

Your data is seen only by the people and services that need it:

• SK Senggara reviewers and administrators, to assess registrations and manage accounts. Their actions are recorded in an audit log.
• Other authorised users of your own company, as you invite them.
• Amazon Web Services (AWS), which hosts the system and stores files for us as our service provider (data processor [to be confirmed by legal]).
• AWS Simple Email Service (SES), which delivers our emails such as verification codes and invitations, from the AWS Singapore region.
• Government or regulatory authorities, only where the law requires it.

Our service providers may use your data only to provide their service to us. We do not share your data with anyone else.

Where your data is kept

The system, its database and your files are hosted with Amazon Web Services (AWS) in the Singapore region. This means your personal data is transferred to, and stored in, Singapore. The CloudFront network that serves this website, and email delivery, may involve other locations. [basis for cross-border transfer under PDPA 2010 — to be confirmed by legal]. If this changes, we will update this policy.

How long we keep it

We keep personal data only as long as it is needed for the purposes above and as the law requires.

We keep account, company, audit-log and document data for the length of your registration or contract with SK Senggara (up to 10 years) and for 6 years after it ends. [Retention periods — to be confirmed by legal.]

When the retention period ends, we will delete the data or make it anonymous, unless the law requires us to keep it longer. [Deletion or anonymisation process — to be confirmed by SK Senggara.]

How we protect it

We use these measures to keep personal data safe:

• Data is encrypted in transit (HTTPS) and at rest.
• Passwords are stored in a one-way protected form and cannot be read by staff.
• Access is limited by role: contractors see their own company, and reviewers and administrators see only what their role needs.
• Identity numbers are masked in the audit log and in registration summaries. [Other screens — to be confirmed by SK Senggara.]
• Uploaded files are private and are opened only through short-lived links.
• Sign-ins and changes are recorded in an audit log.

No system is completely secure. If a personal data breach happens, we will tell the people affected by email, at the address on their account, and notify the Personal Data Protection Commissioner, as the law requires.

Your rights

Under the PDPA you have the right to:

• Access: ask to see the personal data we hold about you. You can also download a copy of your account data in Settings, under "Your data".
• Correction: ask us to correct data that is inaccurate, incomplete or out of date. You can change many details yourself in your profile.
• Withdraw your consent: tell us in writing [to be confirmed by legal]. We may then be unable to provide the service or keep your registration.
• Complain: if you are not satisfied with how we handle your data, you may complain to the Personal Data Protection Commissioner of Malaysia (Jabatan Perlindungan Data Peribadi, pdp.gov.my).

To use these rights, email support@sksenggara.com.my. We may ask you to prove who you are. We will reply within 21 days, as the PDPA requires. We may charge a reasonable fee for an access request where the PDPA permits it. [to be confirmed by legal]

Cookies

We use only strictly necessary cookies: one keeps you signed in (session) and one protects forms against cross-site request forgery (CSRF). We do not use advertising, analytics or tracking cookies, so there is no cookie banner.

Your language choice is saved in your browser's local storage. If you are signed in, it is also saved to your account, so it follows you to other devices.

If we add other cookies in future, we will update this policy first and ask for your consent where it is needed.

Children

The system is for businesses and their representatives. It is not meant for anyone under 18 [to be confirmed by legal] and we do not knowingly collect data from children. If you believe a child has given us data, email support@sksenggara.com.my and we will review your request.

Changes to this policy

We may update this policy. The version on this page, with its date at the top, is the one in force. If a change is significant, we will tell registered users by email and by a notice on this page.

Contact us

Questions or requests about your personal data: email support@sksenggara.com.my.

SK Senggara Sdn. Bhd., No 7, Jalan Iskandar Putri 1/5, Taman Nusantara Prima, 81550, Gelang Patah, Iskandar Puteri, Johor.

Data protection contact: Nor Azam bin Mohamed, email norazam@sksenggara.com.my, telephone +60 14-320 0071.