Privacy Notice

This Privacy Notice (“Notice”) describes how Steam Pro Competency Sdn. Bhd. (“Steam Pro”, “we”, “us” or “our”) collect, record, hold, store, use, disclose, transfer and otherwise process your Personal Data in accordance with the Personal Data Protection Act 2010 [Act 709], as amended from time to time, including the Personal Data Protection (Amendment) Act 2024 [Act A1727] (“PDPA”).

This Notice applies when you use our websites, registration forms, competency training programmes, CEP courses, examinations and related communications (collectively, the “Services”).

This Notice applies to participants, candidates, Persons in Charge (“PIC”), company representatives, employees of client organisations, vendors, partners, contractors and other individuals whose Personal Data we process in connection with the Services (collectively “you”, “your” or “yours”).

Steam Pro Competency Sdn. Bhd. is the data controller responsible for the Services, unless another role is stated on the applicable registration form, quotation, invoice, agreement or other document.

1. Definition and examples of Personal Data

“Personal Data” means any information in respect of commercial transactions that relates directly or indirectly to a data subject who is identified or identifiable from that information, or from that information and other information in our possession, including any Sensitive Personal Data and any expression of opinion about the data subject.

Examples of Personal Data we may collect

• Full name (as in IC / passport)
• MyKad / NRIC or passport number
• Contact information: telephone number and email address
• Company or organisation name and address
• Person in Charge (PIC) name, phone, email, department and position
• Employment and professional information (for example, job title, qualification and batch number)
• Examination demographics where requested on the form (gender, race, new or repeat candidate, paper selection)
• Payment method (bank transfer, cash, HRD Corp claimable, company or personal) and, where uploaded, a payment slip or receipt
• Passport-format photograph or other identification photograph
• Copies of identity, academic, professional or employment documents (including DOSH / JKKP, MQA or BEM documents where the form requires them)

A normal passport-format or identification photograph is ordinary Personal Data, not biometric data: we do not use facial recognition, fingerprinting or voice recognition. We do not collect credit or debit card numbers, or your bank account number, through our registration forms. Where a payment slip is uploaded, it may incidentally show transaction details printed on that slip.

2. Collection of Personal Data

We collect Personal Data about you in the ways listed below. We may combine it with other Personal Data already in our possession, including previous course or examination records.

(a) When you provide Personal Data to us

We collect your Personal Data when you voluntarily provide it, including when you:

• complete a competency training, CEP, in-house or examination registration form;
• upload supporting documents or a passport-format or identification photograph;
• upload a payment slip (where the form asks for one);
• correspond with us by email, telephone, WhatsApp or other channels; or
• ask for a quotation, invoice or HRD Corp claim support.

(b) When our Services are used

Personal Data may also be collected through the normal operation of our websites and forms, for example:

• session and batch selection, remaining seats and registration timestamps;
• security tokens (such as CSRF tokens) and reCAPTCHA verification;
• device and usage information such as IP address, browser type, pages viewed (including Training, CEP, Exam, Contact and other website pages) and referring website, recorded only for website visit tracking (to see which pages are visited and to improve the website); and
• records of confirmation emails and administrative correspondence.

(c) From other sources

Where we collect Personal Data from other sources, we take steps so that the collection and transfer comply with applicable law. Such sources may include:

• your employer, PIC or client organisation, if they register you for a course or examination;
• HRD Corp, DOSH / JKKP, MQA, BEM or other regulators or certification bodies, where relevant to eligibility, claims or certification;
• payment providers or banks, to match a transfer to a registration; and
• publicly available or governmental sources where permitted by law.

(d) Personal Data of minors

Our training and examination Services are primarily intended for adults. Where Personal Data relating to a minor is required, it should be provided by or with the appropriate authorisation of the minor’s parent or legal guardian. Where required by applicable law, we will obtain appropriate consent before processing such Personal Data.

(e) When you provide Personal Data of other individuals

A PIC or company representative may submit Personal Data of participants or candidates (name, IC/passport, phone, email, photograph and supporting documents). If you provide us with another person’s Personal Data, you represent and warrant that you have obtained their consent, or that you are otherwise lawfully entitled, for that data to be collected, used and disclosed as set out in this Notice, and that you will inform them of this Notice.

3. Provision of Personal Data

Where Personal Data is marked as mandatory on a registration, examination, enquiry or other form, the information is required for us to process the relevant service.

If you do not provide the required Personal Data, we may be unable to process your registration, verify your eligibility, issue a quotation or invoice, process an HRD Corp claim, register you for an examination, issue a certificate, or otherwise provide the requested Service.

Information identified as optional may be provided voluntarily. Failure to provide optional information will generally not prevent us from providing the Service unless that information later becomes necessary for a particular purpose.

4. Use of Personal Data

We may use, combine and process your Personal Data only for the following purposes (“Purposes”).

(a) Providing services

• process competency training, CEP, in-house and examination registrations;
• administer sessions, batches, venues and remaining seats;
• verify identity and eligibility (including DOSH / JKKP, MQA, BEM and academic requirements);
• issue quotations, invoices and confirmation emails;
• support HRD Corp claimable registrations and related grant documentation;
• deliver training or examinations and issue certificates or attendance records;
• match bank transfers to registrations using payment method and, where provided, payment slips; and
• perform internal operations such as troubleshooting, data analysis, testing and improving our forms and Services.

(b) Safety and security

• protect the security and integrity of our websites, forms and stored files;
• prevent, detect and address fraud, spam or unauthorised access (including through reCAPTCHA); and
• monitor compliance with our Terms and Conditions.

(c) Customer support

• respond to questions, comments and feedback;
• investigate and address registration, payment, attendance or examination issues; and
• inform you of steps taken to resolve a request.

(d) Research, administration and legal purposes

We may use Personal Data for testing, analysis, record-keeping, tax and audit, and to investigate or resolve claims or disputes, or as allowed or required by law. We may also use Personal Data when required, advised or requested by our legal advisors or any legal, regulatory or governmental authority — for example to comply with a court order, enforce our terms, or protect our rights or property.

We may use Personal Data in connection with a merger, acquisition, joint venture, sale of assets, restructuring or similar business transaction.

(e) Marketing and communications

We may use your contact details to send course updates, quotations, invoices, reminders and, where relevant, information about related training or examinations.

If you do not wish to receive promotional messages from us, you may request that we cease processing your Personal Data for direct marketing using the contact details in section 11 or by replying to the relevant email. Transactional messages about a registration or engagement you submitted (such as confirmations and payment instructions) may still be sent.

5. Disclosure of Personal Data

We share Personal Data with parties who need it for the Purposes. We do not sell your Personal Data. These parties may include:

(a) Regulators, certification and grant bodies

Where required for eligibility, examination, certification or funding, we may share relevant Personal Data with DOSH / JKKP, MQA, BEM, HRD Corp and similar authorities or scheme administrators.

(b) Service providers

We may provide Personal Data to vendors who support our Services, including website hosting, email delivery, cloud storage, IT support, payment matching and professional advisors. They may process Personal Data only as needed to perform their services for us, and we require appropriate confidentiality, security and data-protection measures.

(c) Your organisation

If you are registered by an employer or PIC, we may share confirmation, quotation, invoice, attendance or examination information with that organisation.

(d) Legal advisors and government authorities

We may share Personal Data with our legal advisors, law enforcement and government authorities where required or permitted by law.

6. Retention, deletion and disposal of Personal Data

We retain Personal Data for as long as necessary to fulfil the Purposes, including training and examination records, certification, HRD Corp and DOSH / JKKP compliance, tax and accounting, unless a longer period is required or permitted by law. Personal Data that is no longer required will be securely deleted, disposed of or anonymised in accordance with our procedures.

7. Security of Personal Data

We take reasonable and practicable administrative, organisational and technical measures to protect Personal Data against loss, misuse, modification, unauthorised or accidental access or disclosure, alteration or destruction.

Access to Personal Data is restricted to authorised personnel and service providers who require access for legitimate business purposes. Where third-party service providers process Personal Data on our behalf, we require appropriate confidentiality, security and data-protection measures to be implemented.

8. Transfer of Personal Data outside Malaysia

Your Personal Data is primarily processed in Malaysia. However, certain service providers, including cloud hosting, email, information technology, communications or other technology providers, may process or store Personal Data outside Malaysia.

Where Personal Data is transferred outside Malaysia, we will take reasonable steps to ensure that the transfer is made in accordance with section 129 of the PDPA and applicable guidelines issued by the Personal Data Protection Commissioner, including by ensuring that the applicable legal requirements or permitted conditions for the transfer are satisfied.

Where required by law, appropriate safeguards and/or consent will be obtained before such transfer.

9. Personal Data breach

In the event of a Personal Data breach, we will assess, investigate and manage the incident in accordance with the PDPA and applicable guidelines. Where required by law, we will notify the Personal Data Protection Commissioner and/or affected data subjects within the applicable timeframe.

10. Cookies and website usage

This section applies to all pages of our websites, including the Training, CEP, Exam and Contact pages, registration forms and related pages.

When you visit our websites, we record limited technical information such as your IP address, browser type, pages viewed, date and time of visit, and referring website. Your IP address in our own visit log is collected only for website visit tracking — so we can see which pages are visited and improve the website. That log is not used by us to serve targeted advertising.

We, and third parties we work with, may also use cookies, similar storage and related technology (“Cookies”). Cookies may reside on your computer or device. We use Cookies and similar technology for the following purposes:

• Strictly necessary: to operate the website and registration forms, including security tokens (such as CSRF protection) and session integrity;
• Security: Google reCAPTCHA on registration and enquiry forms, which may set its own Cookies subject to Google’s policies;
• Functionality: to load website fonts and display pages correctly (for example Google Fonts); and
• Usage: to understand how our websites are used, as described above.

Third-party services (such as Google reCAPTCHA and Google Fonts) may set Cookies that we do not necessarily access or control. You may disable, block or delete Cookies in your internet browser settings. Strictly necessary Cookies and security checks on our forms may not work correctly if Cookies are blocked.

11. Rights of data subjects

Subject to the PDPA and applicable exceptions, you may:

• request access to Personal Data held about you;
• request correction of Personal Data that is inaccurate, incomplete, misleading or not up to date;
• withdraw consent previously given for the processing of Personal Data, subject to applicable legal and contractual requirements and consequences;
• request that we cease or not commence processing your Personal Data for direct marketing purposes;
• request the transmission of your Personal Data to another data controller in accordance with the data portability provisions of the PDPA, subject to technical feasibility, compatibility of the data format and other applicable requirements; and
• make enquiries or complaints concerning our processing of your Personal Data.

To exercise these rights, or if you have any queries about this Notice, please contact our Data Protection Officer:

We may need to verify your identity before we can act on a request. We will use reasonable efforts to respond to a request for access or correction within twenty-one (21) days of receiving a complete request, or such other period as the PDPA may allow. We may withhold access or correction in limited situations permitted by law (for example where we cannot confirm your identity, or where the information is of a confidential commercial nature). Where continued retention is required by law or for the Purposes, we may not be able to delete Personal Data even if you withdraw consent for other processing.

12. Language

This Privacy Notice is available in both Bahasa Malaysia and English in accordance with the Personal Data Protection Act 2010. Both versions are intended to convey the same meaning. In the event of any inconsistency, this Privacy Notice shall be interpreted in accordance with the applicable laws of Malaysia.

13. Amendments

We may amend this Privacy Notice from time to time to reflect changes to our practices, Services or applicable legal requirements. The updated version will be published on our website together with the revised “Last modified” date.

Where a material change affects the manner in which we process your Personal Data, we will provide additional notice and/or obtain consent where required by applicable law.

Registration and use of our Services are also subject to our Terms and Conditions.

Bahasa Malaysia Terms and Conditions Contact us