Privacy & Data Protection Notice

1. Who we are

TAPiO Management Advisory Sdn. Bhd. (TAPiO, we, us or our) is a Malaysia-based management advisory business serving Malaysian and international organisations. For relevant processing activities, TAPiO acts as the organisation responsible for determining why and how personal data is processed.

2. Scope of this Notice

This Privacy & Data Protection Notice explains how we collect, use, disclose, store, protect and otherwise process personal data in connection with our Website, enquiries, client and prospective-client relationships, projects, events, delegations, professional networks, recruitment, internships, suppliers and business administration.

It is intended to meet applicable Malaysian personal-data requirements and to provide additional transparency for international stakeholders. Where another data-protection law applies to a particular activity, including the EU General Data Protection Regulation or another relevant regime, TAPiO will apply the requirements applicable to that activity.

3. Personal data we may collect

Depending on your relationship with us, we may process:

• identity and contact data, such as name, title, organisation, business address, telephone number and email address;
• professional and business data, such as role, employer, professional profile, sector, responsibilities, business interests, public professional information and information contained on a business card;
• client, project and engagement data, including communications, meeting notes, project requirements, introductions, transaction or market-entry context and documents provided to us;
• event and delegation data, such as attendance, dietary or accessibility information where necessary, photographs, recordings, meeting preferences and business-matching information;
• recruitment and internship data, including CVs, cover letters, education, employment history, references, interview information and work-authorisation information;
• supplier and administrative data, including contact, invoicing, payment, tax, contractual and due-diligence information;
• compliance data, where reasonably necessary for conflict checks, anti-bribery controls, sanctions or other lawful due diligence;
• website and technical data, such as IP address, browser, device information, pages viewed, approximate location derived from IP, security logs and cookie or analytics identifiers, subject to applicable consent requirements; and
• other information you choose to provide or that is reasonably necessary for a lawful business purpose.

We seek to avoid collecting sensitive personal data unless it is necessary, lawful and proportionate. Where sensitive data is required, we apply appropriate additional safeguards and obtain consent where required by law.

4. Sources of personal data

We may obtain personal data:

• directly from you;
• from your employer, organisation, representative or another person authorised to introduce or involve you;
• from clients, prospective clients, event partners, professional advisers or counterparties where relevant to an engagement;
• from public and professional sources, including company websites, public registers, government publications, professional directories, conference materials, press reports and publicly available professional profiles;
• from service providers supporting our website, communications, events, recruitment, security or business operations; and
• automatically when you use our Website, where applicable.

5. Why we process personal data

We may process personal data to:

• respond to enquiries and communicate with you;
• assess, establish, manage and deliver client engagements and professional services;
• conduct market research, partner identification, business matching, stakeholder mapping, due diligence and other advisory work requested by clients;
• organise meetings, delegations, events and introductions;
• manage relationships with clients, prospective clients, partners, suppliers, public authorities and professional contacts;
• administer contracts, invoices, payments, records and internal business operations;
• recruit employees, interns, consultants and other personnel;
• protect our systems, Website, personnel, clients and information from misuse, fraud or security threats;
• manage conflicts of interest, anti-bribery controls, complaints and other compliance requirements;
• send relevant business updates, invitations or information where permitted by law and subject to your marketing choices;
• establish, exercise or defend legal rights and comply with applicable laws, court orders and regulatory obligations; and
• improve our services, Website and business processes using aggregated, statistical or otherwise appropriate information.

6. Basis for processing

We process personal data only where there is an appropriate basis under applicable law. Depending on the circumstances, this may include your consent, steps taken at your request before entering into an agreement, performance of an agreement, compliance with a legal obligation, protection of legal rights or another basis permitted by law.

Where the GDPR applies to a particular processing activity, TAPiO may rely, as appropriate, on consent, contractual necessity, legal obligations or legitimate interests, provided those interests are not overridden by applicable rights and freedoms.

7. Disclosure and service providers

We do not sell or rent personal data. We may disclose personal data, where necessary and lawful, to:

• service providers supporting hosting, IT, security, email, cloud storage, analytics, accounting, professional services, recruitment, events or communications;
• clients, counterparties, professional contacts or event participants where disclosure is part of an authorised engagement, introduction or activity;
• professional advisers, auditors, insurers and financial institutions;
• government bodies, regulators, courts, enforcement agencies or other authorities where required or permitted by law;
• potential parties to a corporate restructuring, financing, acquisition or transfer, subject to appropriate confidentiality safeguards; and
• other recipients with your direction or consent, where required.

Service providers are expected to process personal data only for authorised purposes and to apply appropriate confidentiality and security measures.

8. International transfers

TAPiO operates internationally. Personal data may therefore be accessed, hosted, transferred to or processed in countries outside Malaysia, including where our clients, service providers, professional contacts or counterparties are located.

We take reasonable steps to ensure that cross-border transfers comply with applicable Malaysian requirements and, where another data-protection regime applies, any additional transfer safeguards required by that regime. Depending on the circumstances, safeguards may include contractual protections, recognised transfer clauses, consent where legally appropriate, due diligence on recipients and security measures.

Where personal data subject to the GDPR is transferred from the European Economic Area to a recipient in a country without an applicable adequacy decision, recognised safeguards such as the European Commission’s Standard Contractual Clauses may be used where appropriate.

9. Security

We use administrative, organisational and technical measures designed to protect personal data against accidental loss, misuse, unauthorised access, alteration or disclosure. Measures are selected according to the nature of the information, the processing activity and reasonably foreseeable risks.

Access to personal data is limited according to business need. Personnel and service providers with access are expected to maintain confidentiality and comply with applicable security requirements.

10. Retention

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including to satisfy contractual, legal, accounting, tax, regulatory, dispute-resolution and record-keeping requirements. Retention periods vary depending on the type of information, the relationship and applicable law.

When personal data is no longer required, we take reasonable steps to delete, destroy, anonymise or securely archive it as appropriate.

11. Your choices and rights

Depending on the law applicable to the processing, you may have rights to:

• request access to personal data held about you;
• request correction of inaccurate, incomplete or outdated data;
• withdraw consent where processing is based on consent, subject to lawful consequences of withdrawal;
• object to or limit certain processing, including direct marketing, where the law provides that right;
• request deletion or restriction of processing where applicable;
• request data portability where applicable;
• raise a complaint with TAPiO or a competent data-protection authority; and
• exercise other rights available under applicable law.

We may need to verify identity and authority before acting on a request. Some rights are subject to legal exceptions, retention duties or the rights of others.

12. Direct marketing

We may send business information, event invitations or service updates where permitted by applicable law. Where consent is required, we will seek it. You may opt out of direct marketing at any time by using an unsubscribe mechanism where provided or by contacting us. We may retain minimal suppression information so that we can respect an opt-out request.

13. Children and young persons

Our Website and professional services are primarily intended for business and professional audiences. We do not knowingly seek personal data from children for consumer marketing purposes. Where a legitimate TAPiO activity, internship, educational programme or event involves a person below the age at which independent consent is legally valid, we will apply appropriate safeguards and obtain parent or guardian involvement where required.

14. Personal-data incidents

TAPiO maintains procedures for assessing and responding to suspected personal-data breaches. Where an incident triggers a notification duty under applicable law, we will notify the competent authority and affected individuals within the required legal framework.

15. Third-party websites and services

Our Website may contain links to external websites and embedded services. Those parties operate independently and their privacy practices are governed by their own notices. We encourage you to review them before providing personal information.

16. Changes to this Notice

We may update this Notice when our processing, technology, services or legal obligations change. The effective date at the top identifies the current version. Material changes may be highlighted through the Website or another appropriate channel.

17. Contact and complaints

Questions, requests or complaints about personal data may be directed to our Privacy Contact:

If your concern is not resolved, you may also have the right to complain to the Personal Data Protection Commissioner of Malaysia or another competent supervisory authority where applicable.

1. Siapa kami

TAPiO Management Advisory Sdn. Bhd. (TAPiO, kami) ialah sebuah firma khidmat nasihat pengurusan yang berpangkalan di Malaysia dan berkhidmat kepada organisasi di Malaysia serta di peringkat antarabangsa. Bagi aktiviti pemprosesan yang berkaitan, TAPiO ialah organisasi yang menentukan tujuan dan cara data peribadi diproses.

2. Skop Notis ini

Notis ini menerangkan cara kami mengumpul, menggunakan, mendedahkan, menyimpan, melindungi dan memproses data peribadi berkaitan laman sesawang kami, pertanyaan, hubungan dengan pelanggan dan bakal pelanggan, projek, acara, delegasi, rangkaian profesional, pengambilan pekerja, latihan industri, pembekal serta pentadbiran perniagaan.

Notis ini bertujuan memenuhi keperluan perlindungan data peribadi yang terpakai di Malaysia dan memberikan ketelusan tambahan kepada pihak berkepentingan antarabangsa. Jika undang-undang perlindungan data lain terpakai kepada sesuatu aktiviti tertentu, TAPiO akan mematuhi keperluan yang terpakai kepada aktiviti tersebut.

3. Data peribadi yang mungkin kami kumpul

Bergantung pada hubungan anda dengan kami, kami mungkin memproses:

• data identiti dan perhubungan, termasuk nama, jawatan, organisasi, alamat perniagaan, nombor telefon dan e-mel;
• data profesional dan perniagaan, seperti peranan, majikan, profil profesional, sektor, tanggungjawab, kepentingan perniagaan, maklumat profesional yang tersedia kepada umum dan maklumat pada kad perniagaan;
• data pelanggan, projek dan tugasan, termasuk komunikasi, nota mesyuarat, keperluan projek, pengenalan, konteks transaksi atau kemasukan pasaran dan dokumen yang diberikan kepada kami;
• data acara dan delegasi, seperti kehadiran, maklumat pemakanan atau kebolehcapaian apabila perlu, gambar, rakaman, pilihan mesyuarat dan maklumat padanan perniagaan;
• data pengambilan pekerja dan latihan industri, termasuk CV, surat permohonan, pendidikan, sejarah pekerjaan, rujukan, maklumat temu duga dan maklumat kebenaran bekerja;
• data pembekal dan pentadbiran, termasuk maklumat invois, pembayaran, cukai, kontrak dan usaha wajar;
• data pematuhan yang diperlukan secara munasabah untuk semakan konflik kepentingan, kawalan anti-rasuah, sekatan atau usaha wajar lain yang sah;
• data laman sesawang dan teknikal, seperti alamat IP, pelayar, maklumat peranti, halaman yang dilihat, lokasi anggaran berdasarkan IP, log keselamatan serta pengecam kuki atau analitik, tertakluk pada keperluan persetujuan yang terpakai; dan
• maklumat lain yang anda pilih untuk berikan atau yang munasabah diperlukan bagi tujuan perniagaan yang sah.

Kami berusaha untuk tidak mengumpul data peribadi sensitif melainkan ia perlu, sah dan berkadar. Jika data sensitif diperlukan, kami akan menggunakan perlindungan tambahan yang sesuai dan mendapatkan persetujuan apabila dikehendaki oleh undang-undang.

4. Sumber data peribadi

Kami mungkin memperoleh data peribadi terus daripada anda; daripada majikan, organisasi, wakil atau pihak yang diberi kuasa untuk memperkenalkan anda; daripada pelanggan, bakal pelanggan, rakan acara, penasihat profesional atau pihak lawan urus niaga; daripada sumber awam dan profesional; daripada penyedia perkhidmatan yang menyokong operasi kami; dan secara automatik apabila anda menggunakan laman sesawang kami, jika berkenaan.

5. Tujuan pemprosesan

Kami mungkin memproses data peribadi untuk menjawab pertanyaan, mengurus dan melaksanakan tugasan pelanggan, menjalankan penyelidikan pasaran dan padanan perniagaan, mengatur mesyuarat dan delegasi, mengurus hubungan profesional, mentadbir kontrak dan pembayaran, merekrut kakitangan atau pelatih, melindungi sistem dan maklumat, mengurus konflik dan keperluan pematuhan, menghantar maklumat perniagaan yang relevan apabila dibenarkan, mematuhi undang-undang serta menegakkan atau mempertahankan hak undang-undang.

6. Asas pemprosesan

Kami memproses data peribadi hanya apabila terdapat asas yang sesuai di bawah undang-undang yang terpakai. Bergantung pada keadaan, asas tersebut boleh termasuk persetujuan, langkah yang diambil atas permintaan anda sebelum sesuatu perjanjian, pelaksanaan perjanjian, pematuhan terhadap kewajipan undang-undang, perlindungan hak undang-undang atau asas lain yang dibenarkan oleh undang-undang.

7. Pendedahan dan penyedia perkhidmatan

Kami tidak menjual atau menyewakan data peribadi. Jika perlu dan sah, kami mungkin mendedahkan data kepada penyedia perkhidmatan, pelanggan atau pihak berkaitan dengan tugasan yang diberi kuasa, penasihat profesional, juruaudit, penanggung insurans, institusi kewangan, badan kerajaan, pengawal selia, mahkamah atau agensi penguatkuasaan, serta pihak lain dengan arahan atau persetujuan anda jika diperlukan.

8. Pemindahan antarabangsa

TAPiO beroperasi di peringkat antarabangsa. Data peribadi mungkin diakses, dihoskan, dipindahkan atau diproses di luar Malaysia. Kami mengambil langkah munasabah untuk memastikan pemindahan rentas sempadan mematuhi keperluan Malaysia yang terpakai dan, jika rejim perlindungan data lain terpakai, perlindungan tambahan yang dikehendaki oleh rejim tersebut.

9. Keselamatan

Kami menggunakan langkah pentadbiran, organisasi dan teknikal yang direka untuk melindungi data peribadi daripada kehilangan, penyalahgunaan, akses tanpa kebenaran, perubahan atau pendedahan. Akses diberikan berdasarkan keperluan perniagaan dan pihak yang mempunyai akses dikehendaki menjaga kerahsiaan.

10. Penyimpanan

Kami menyimpan data peribadi hanya selama yang munasabah diperlukan bagi tujuan ia dikumpul, termasuk untuk memenuhi keperluan kontrak, undang-undang, perakaunan, cukai, pengawalseliaan, penyelesaian pertikaian dan penyimpanan rekod. Apabila tidak lagi diperlukan, kami mengambil langkah munasabah untuk memadam, memusnah, menganonimkan atau mengarkibkannya secara selamat mengikut kesesuaian.

11. Pilihan dan hak anda

Bergantung pada undang-undang yang terpakai, anda mungkin mempunyai hak untuk meminta akses, membetulkan data yang tidak tepat, menarik balik persetujuan apabila pemprosesan berdasarkan persetujuan, membantah atau mengehadkan pemprosesan tertentu termasuk pemasaran langsung, meminta pemadaman atau sekatan jika berkenaan, meminta pemindahan data jika berkenaan dan membuat aduan kepada TAPiO atau pihak berkuasa perlindungan data yang berwibawa.

Kami mungkin perlu mengesahkan identiti dan kuasa anda sebelum memenuhi permintaan. Sesetengah hak tertakluk pada pengecualian undang-undang dan kewajipan penyimpanan.

12. Pemasaran langsung

Kami mungkin menghantar maklumat perniagaan, jemputan acara atau kemas kini perkhidmatan apabila dibenarkan oleh undang-undang. Jika persetujuan diperlukan, kami akan mendapatkannya. Anda boleh berhenti menerima pemasaran langsung pada bila-bila masa melalui mekanisme berhenti melanggan atau dengan menghubungi kami.

13. Kanak-kanak dan orang muda

Laman sesawang dan perkhidmatan profesional kami terutama ditujukan kepada khalayak perniagaan dan profesional. Kami tidak secara sengaja mendapatkan data kanak-kanak untuk pemasaran pengguna. Jika aktiviti, latihan industri, program pendidikan atau acara yang sah melibatkan seseorang yang belum mencapai umur persetujuan bebas yang sah, kami akan menggunakan perlindungan yang sesuai dan melibatkan ibu bapa atau penjaga apabila dikehendaki.

14. Insiden data peribadi

TAPiO mempunyai proses untuk menilai dan menangani pelanggaran data peribadi yang disyaki. Jika sesuatu insiden mencetuskan kewajipan pemberitahuan di bawah undang-undang yang terpakai, kami akan membuat pemberitahuan yang diperlukan dalam rangka kerja undang-undang tersebut.

15. Laman sesawang dan perkhidmatan pihak ketiga

Laman sesawang kami mungkin mempunyai pautan kepada laman luar atau perkhidmatan terbenam. Pihak tersebut beroperasi secara bebas dan amalan privasi mereka tertakluk pada notis masing-masing.

16. Perubahan kepada Notis ini

Kami mungkin mengemas kini Notis ini apabila pemprosesan, teknologi, perkhidmatan atau kewajipan undang-undang kami berubah. Tarikh kuat kuasa di bahagian atas menunjukkan versi semasa.

17. Hubungi dan aduan

Jika kebimbangan anda tidak diselesaikan, anda juga mungkin mempunyai hak untuk membuat aduan kepada Pesuruhjaya Perlindungan Data Peribadi Malaysia atau pihak berkuasa penyeliaan lain yang berwibawa jika berkenaan.