Data Protection Policy

1.1 What is Personal Data?

1.2 Key Definitions

2.1 Jobseekers

• Identification details: Full name, NRIC or passport number, date of birth, gender, nationality, and photograph
• Contact information: Residential or mailing address, telephone number, and email address
• Professional information: Resume or CV, academic qualifications, certifications, employment history, salary expectations, references, and preferred job classifications
• Interview data: Responses submitted through the AI-assisted interview tool, including recordings where applicable
• Platform activity: Login credentials, search history, application status, and usage data

2.2 Employers

• Company details: Company name, registration number, and business address
• Contact person details: Name, job title, email address, and telephone number of authorised representatives
• Billing and payment information: Required for subscription and platform fee processing
• Job posting content: Role descriptions, hiring criteria, and screening questions
• Platform activity: Account credentials, login records, and candidate interaction data

2.3 Employees, Contractors & Business Partners

• Identification details: Full name, NRIC or passport number, date of birth, gender, and nationality
• Contact information: Address, telephone number, and email address
• Employment-related information: Job title, employment history, qualifications, and certifications
• Financial information: Bank account details, EPF, SOCSO, and income tax numbers
• Emergency contact information: Names and contact details of nominated individuals

2.4 General Website Visitors

• Technical data: IP address, browser type, device type, and operating system
• Usage data: Pages visited, time spent on the Platform, referral sources, and search queries
• Cookie data: Session identifiers and preference data

3.1 Platform Operations

• To operate the hiring platform: Including facilitating job postings, enabling Jobseekers to apply for roles, and allowing Employers to search and evaluate candidate profiles.
• To enable AI-assisted interview processing: The AI tool processes Jobseeker interview responses and CV data to generate holistic candidate profiles and best-fit recommendations for Employers. No hiring decision is made solely on the basis of automated processing.
• To match candidates to opportunities: Using profile and preference data to surface relevant job recommendations to Jobseekers and suitable candidates to Employers.
• To facilitate group company access: During the initial deployment phase, Jobseeker profiles and CV data may be made accessible to a defined group of participating companies.

3.2 Employment & Business Relationships

• To manage employment relationships: Including onboarding, contract administration, performance management, payroll, benefits administration, and offboarding.
• To manage business relationships: Including engagement with clients, service providers, vendors, and suppliers.
• To facilitate communication: Including responding to enquiries, sending account-related updates, and sharing relevant information about platform services.

3.3 Legal, Compliance & Security

• To comply with legal and regulatory obligations: Including audits, statutory reporting, EPF and SOCSO contributions, and anti-money laundering requirements.
• To detect and prevent fraud and security incidents: Including monitoring for unauthorised access, misuse, or other prohibited activities.
• To respond to legal claims: Including establishing, exercising, or defending the Company's legal rights.

3.4 Marketing & Service Improvement

• For marketing and promotional purposes: To inform data subjects about Platform services, job opportunities, and events, where consent has been obtained.
• To improve and develop the Platform: Including conducting internal analytics, user research, and system enhancements.

5.1 Consent & Processing

• Determine whether consent is required for the processing of personal data before collection
• Explain to data subjects the purpose for which their personal data is being collected and how it will be processed
• Obtain appropriate consent for the processing of sensitive personal data
• Provide a copy of the relevant Notice and Consent Form to the data subject upon request
• Ensure personal data is processed only through authorised software and hardware systems

5.2 Data Handling & Access Controls

• Retain personal data only for as long as is necessary for the specified purpose
• Ensure personal data is accurate and up to date
• Keep personal data confidential and protect the rights of the data subject at all times
• Disclose personal data only to authorised persons or third parties, and only where permitted by law
• Prior to disclosing personal data to any third party, ensure a confidentiality and non-disclosure agreement is in place
• Ensure that only authorised employees have access to personal data, strictly on a need-to-know basis
• Do not reveal passwords or user credentials to any unauthorised person
• Use only anonymised or unidentifiable data for analytical or research purposes
• Do not transfer personal data outside Malaysia unless the data subject's consent has been obtained

5.3 Destruction of Personal Data

• Permanently destroy personal data — both in soft copy and physical form — that is no longer required
• Maintain a record of all destroyed personal data
• Use secure destruction methods: shredding or incineration for physical records; reformatting or overwriting for electronic data

6.1 Authorised Disclosures

• Employers — When a Jobseeker submits an application or their profile is accessed through the Platform in the course of the hiring process.
• Group Companies — Subsidiaries and affiliated entities, including participating companies during the initial deployment phase.
• Authorised Service Providers — Third-party vendors, technology providers, and subcontractors engaged to support the Company's platform operations.
• Professional Advisors — Auditors, legal counsel, accountants, and consultants engaged by the Company.
• Regulatory & Government Authorities — Government agencies, law enforcement bodies, and statutory authorities, as required by law.
• Business Transferees — In the event of a merger, acquisition, or sale of assets, subject to equivalent data protection obligations being imposed on the transferee.

6.2 Joint Data Controller Arrangement

Where a Jobseeker submits a job application or their profile is accessed by an Employer through the Platform, Premier Talent and the relevant Employer act as joint data controllers in respect of the personal data processed in connection with that application or profile review. Premier Talent is responsible for the lawful collection and initial processing of personal data. Each Employer is independently responsible for their own subsequent use of such personal data.

6.3 Cross-Border Data Transfers

Personal data may be transferred to and processed in countries outside Malaysia, including Singapore and the United States of America, where the Company's technology infrastructure and third-party service providers are located. Appropriate contractual safeguards are implemented to ensure personal data remains protected in accordance with the PDPA.

6.4 Consent Requirements

9.1 Technical Security Measures

• Access to IT servers and systems is restricted to authorised personnel in secure, controlled environments
• All computer systems are password-protected with appropriate authentication mechanisms
• Anti-virus and anti-malware software, and backup and recovery procedures, are maintained
• All data transmitted between the Platform and users is encrypted using industry-standard protocols (TLS/HTTPS)
• Personal data held on cloud infrastructure is secured in accordance with the service provider's data protection standards

9.2 Physical Security Measures

• Physical records containing personal data are stored in securely locked cabinets or rooms with restricted access
• Storage keys are kept in a secure location with movement recorded
• CCTV surveillance is maintained at premises where personal data is stored
• Door access systems are in place at entry and exit points of areas where personal data is held

9.3 Portable Devices & Remote Working

• Personal data must not be stored on portable devices except in essential and approved circumstances
• Information stored on portable devices must be fully deleted immediately after use
• The transport of personal data in any format outside Company premises should be avoided wherever possible

11.1 What Constitutes a Data Breach

• Loss or theft of equipment on which personal data is stored
• Inappropriate access controls allowing unauthorised access
• Equipment failure leading to data loss or exposure
• Human error, such as misdirected emails or incorrect data entry
• Unforeseen circumstances such as flood, fire, or natural disaster
• Cyber attacks, hacking, or malicious software

11.2 Incident Recording

All incidents must be accurately recorded by the Line Manager, capturing:

• Description of the incident
• Date and time the incident occurred and was detected
• Who reported the incident and to whom
• Type of data involved and its sensitivity classification
• Number of individuals whose personal data may have been affected
• Any IT systems involved in the incident

11.3 Post-Incident Review

Following any data breach, the Company will conduct a thorough review to assess the appropriateness of steps taken, record measures implemented to prevent recurrence, identify areas requiring improvement, and document and implement any recommended changes as soon as practicable.