Personal Data Protection Act (PDPA) Notice
Effective Date : 31 January 2024

KHSB, including its authorised representatives, related companies, employees, agents and service providers where applicable, is committed to protecting your personal data in accordance with the Personal Data Protection Act 2010 (Act 709), its subsidiary legislation, codes of practice, guidelines, and any applicable amendments (“PDPA”).This Personal Data Protection Notice explains how KHSB collects, records, holds, stores, uses, discloses, transfers, retains and otherwise processes your personal data in connection with our business, website, services, transactions, communications and other dealings with you.For the purpose of this Notice, “personal data” means information that relates directly and/or indirectly to you and that identifies or can identify you, whether from that information alone or when combined with other information in KHSB’s possession.

Collection of Personal Data
Depending on your relationship and dealings with KHSB, we may collect and process the following categories of personal data :

1. identity details, including name, NRIC/passport number, date of birth, nationality, gender and signature;
2. contact details, including address, telephone number, mobile number, email address and emergency contact details;
3. transaction and account details, including customer, supplier, billing, payment, invoice, delivery, order and service records;
4. employment, professional and/or business details, if you deal with KHSB as a representative, contractor, vendor, applicant, employee, director or officer;
5. technical and website data, including IP address, device identifiers, browser type, browsing behaviour, cookies and similar technologies;
6. communications with KHSB, including enquiries, complaints, feedback, recordings, emails, forms and customer service interactions;
7. security and access records, including CCTV footage, visitor logs, building access records and incident reports, where applicable; and
8. any other personal data voluntarily provided by you and/or lawfully obtained by KHSB for the purposes stated in this Notice.

Sensitive personal data: KHSB will only collect sensitive personal data, such as health information, biometric data, religious belief and/or other information classified as sensitive personal data under the PDPA, where it is necessary for a lawful purpose and where your explicit consent has been obtained, UNLESS otherwise permitted by law.

Sources of Personal Data
KHSB may collect personal data directly from you or from lawful sources, including :

1. forms, applications, agreements, website submissions, emails, telephone calls, messages and face-to-face interactions;
2. your employer, company, authorised representatives, agents, referees, next-of-kin and/or emergency contacts;
3. publicly available sources, regulators, government agencies, credit reporting agencies, background screening providers and other lawful third-party sources where permitted; and
4. automated technologies used on our website, systems, premises or digital platforms.

Purposes of Processing
KHSB may process your personal data for one or more of the following purposes, where relevant :

1. to provide, perform, administer, maintain and improve our products, services, contracts, transactions and business relationship with you;
2. to verify your identity, process applications, registrations, purchases, payments, refunds, invoices, deliveries and service requests;
3. to respond to enquiries, complaints, feedback, requests and customer service matters;
4. to manage vendors, suppliers, contractors, consultants, business partners and professional advisers;
5. to manage employment, recruitment, human resource, payroll, benefits, training, safety and workplace administration matters, where applicable;
6. to conduct internal administration, record keeping, audit, accounting, finance, tax, insurance, risk management, compliance and reporting functions;
7. to protect the safety, security, rights, property and interests of KHSB, its personnel, customers, visitors and the public;
8. to comply with legal, regulatory, statutory, licensing, governmental, court, enforcement, audit and reporting obligations;
9. to prevent, detect, investigate or respond to fraud, misconduct, security incidents, data breaches, unlawful activities, disputes, claims or legal proceedings;
10. to communicate updates, notices, service information, administrative messages and other non-marketing communications;
11. to send marketing, promotional, event, product or service updates, only where consent is obtained or where permitted by law, and subject to your right to unsubscribe or opt out; and
12. for any other purpose that is directly related to the above purposes or notified to you at or before the time of collection.

Mandatory and Voluntary Personal Data
Where personal data is marked as MANDATORY or is required to enable KHSB to provide services, enter into or perform a contract, comply with legal obligations, verify your identity, process transactions, or maintain business records, you MUST provide such personal data.

If you do not provide mandatory personal data, KHSB may be unable to process your application, provide services, complete transactions, respond to your requests, or continue the relevant relationship with you.

Personal data requested for marketing or other optional purposes is VOLUNTARY. Refusing or withdrawing consent for optional processing will not affect your core dealings with KHSB, UNLESS the data is necessary for the relevant service or transaction.

Disclosure of Personal Data
KHSB will not sell your personal data. KHSB may disclose your personal data (where necessary and lawful) to the following :

1. related companies, affiliates, directors, officers, employees and authorised personnel of KHSB;
2. service providers, vendors, contractors, agents, consultants, IT/cloud providers, website hosts, payment processors, logistics providers, call centres and data processors acting on behalf of KHSB;
3. banks, payment providers, insurers, credit reporting agencies, auditors, accountants, tax advisers, lawyers and other professional advisers;
4. business partners, event organisers, marketing service providers and communication platform providers, where relevant and subject to applicable consent requirements;
5. regulators, government authorities, enforcement agencies, courts, tribunals, statutory bodies and any person to whom KHSB is required or permitted by law to disclose personal data;
6. any actual or proposed assignee, transferee, purchaser, successor, investor, financier or party involved in a corporate exercise, restructuring, merger, acquisition, financing, transfer or sale of business or assets; and
7. any other party notified to you or authorised by you.

KHSB will take reasonable steps to ensure that third parties receiving personal data are subject to appropriate confidentiality, security and data protection obligations, where applicable.

Cross-Border Transfer
Your personal data may be transferred to, stored in, accessed from or processed in locations outside Malaysia where KHSB, its related companies, service providers, cloud providers, business partners or other authorised recipients operate.Where KHSB transfers personal data outside Malaysia, KHSB will take reasonable steps to ensure that the transfer is carried out in accordance with the PDPA and that appropriate safeguards are applied, where required.

Security of Personal Data
KHSB will take practical and reasonable security measures to protect personal data from loss, misuse, modification, unauthorised or accidental access or disclosure, alteration or destruction. However, no method of transmission over the internet or electronic storage is completely secure. KHSB will continue to review and improve its security measures as appropriate.

Accuracy and Updating of Personal Data
You are responsible for ensuring that the personal data you provide to KHSB is accurate, complete, not misleading and kept up to date. You MUST promptly inform KHSB of any changes to your personal data.Where you provide personal data relating to another individual, you confirm that you have obtained that individual’s consent or have another lawful basis to provide the personal data to KHSB for the purposes stated in this Notice.

Retention of Personal Data
KHSB will retain personal data only for as long as necessary to fulfil the purposes stated in this Notice, to comply with legal, accounting, tax, audit, regulatory, contractual or operational requirements, to resolve disputes, or to enforce rights and obligations. When personal data is no longer required, KHSB will take reasonable steps to securely destroy, delete and/or or permanently de-identify the personal data, UNLESS retention is required or permitted by law.

Your Rights
Subject to the PDPA and applicable legal exceptions, you request to :

1. access your personal data held by KHSB;
2. correct and/or update personal data that is inaccurate, incomplete or misleading;
3. withdraw consent previously given, subject to legal, contractual and operational consequences;
4. limit or object to the processing of your personal data for direct marketing or other purposes, where applicable;
5. request information about KHSB’s processing of your personal data; and
6. exercise any other right available under the PDPA or applicable law, including any right introduced by applicable amendments once in force.

KHSB may require proof of identity and sufficient information to process your request. KHSB may refuse or limit a request where permitted by law, including where compliance would disclose another person’s personal data, breach confidentiality, affect legal privilege, prejudice investigations, or conflict with legal or regulatory obligations.