PRIVACY NOTICE
1. DATA USER
CTCS Worldwide Sdn. Bhd. (Company No.: [201901002773(1312099-M)]), a private limited by shares incorporated in Malaysia and having its registered address at Level 8, PGRM Tower 2, No.8, Jalan Pudu Ulu, 56100 Cheras, Wilayah Persekutuan Kuala Lumpur, Malaysia (“CTCS” and references to “we”, “us” or “our” are to CTCS). For the purposes of this Privacy Notice, “you” shall refer to yourself and such other persons or entities represented by you which you are providing the Personal Data.
CTCS is a data user for the purposes of the Personal Data Protection Act 2010 (“PDPA”) and is committed to ensuring that all Personal Data processed by us is handled in lawful, responsible and secure manner.
2. PURPOSE AND APPLICATION OF THIS NOTICE
1.This Privacy Notice (“Notice”) sets out how CTCS collects, uses, discloses, stores and protects Personal Data in the course of carrying out its business activities, including but not limited to:
· export and import of goods;
· export of logs, sawn timber, plywood, veneer and related wood products; and
· sawmilling and planning of wood and related operational activities.
2. This Notice applies to all individuals whose Personal Data is processed by CTCS, including customers, clients, business counterparts, suppliers, contractors, agents, visitors, employees and job applicants.
3. For the purposes of this Notice, “Personal Data” shall have the meaning assigned
to it under the PDPA.
3. SOURCES OF PERSONAL DATA
1. CTCS may collect Personal Data through various lawful means, including:
· directly from you during business dealings or communications;
· from documents, forms or correspondence submitted to us;
· through contractual, commercial or operational engagements;
· when you visit or access our premises or facilities;
· from third parties authorised by you or permitted by law; and
· from publicly available or lawful sources.
2. Where Personal Data is required for a particular purpose and is not provided, CTCS may be unable to proceed with the relevant transaction or engagement.
4. CATEGORIES OF PERSONAL DATA PROCESSED
1. Depending on the nature of your relationship with CTCS, the Personal Data processed may include:
a. Identification and personal particulars
· name;
· nationality;
· identification card or passport number (where necessary).
b. Contact and business information
· residential or business address;
· email address;
· telephone or mobile number;
· employer or company name;
· designation or position.
c. Commercial and financial information
· order, transaction and delivery records;
· invoicing and payment information;
· banking or billing details (where applicable).
d. Operational and security information
· visitor registration records;
· closed-circuit television (CCTV) recordings at our premises (where
applicable).
e. Technical data (where applicable)
· IP address or system-generated data arising from electronic
communications.
2. CTCS does not intentionally collect Sensitive Personal Data unless it is strictly necessary and only where explicit consent has been obtained or where otherwise permitted under the PDPA.
5. PURPOSES OF PROCESSING
1. Personal Data is processed by. CTCS strictly for purposes that are reasonably necessary to support, administer and facilitate its business operations. These purposes include, without limitation, including:
i. managing commercial, contractual and operational relationships;
ii. processing orders, transactions, deliveries and payments;
iii. facilitating export, import, logistics and transportation arrangements;
iv. communicating with stakeholders and responding to enquiries or instructions;
v. administering suppliers, contractors, agents and service providers;
vi. maintaining internal records, accounts, audits and reporting;
vii. ensuring compliance with applicable laws, regulations and regulatory requirements;
viii. managing risk, disputes, claims and enforcement of legal rights;
ix. maintaining the safety and security of our premises, personnel and business operations; and
x. any other purpose directly related to the foregoing.
For the purposes of this Notice, the above purposes shall collectively be referred to as the “Permitted Purposes”
6. DISCLOSURE OF PERSONAL DATA
1. CTCS does not trade or sell Personal Data
2. Personal Data may be disclosed strictly on a need-to-know basis and only for the Permitted Purposes to selected third parties, including but not limited to the following categories of recipients:
· employees and authorised representatives of CTCS;
· suppliers, contractors and service providers (including logistics and warehousing partners);
· financial institutions, insurers and payment service providers;
· professional advisers such as auditors, lawyers and consultants;
· information technology and system support providers; and
· regulatory authorities, governmental bodies or law enforcement agencies where disclosure is required or permitted by law.
3. All recipients of Personal Data are required to process such data in accordance with applicable data protection obligations.
7. TRANSFER OF PERSONAL DATA OUTSIDE MALAYSIA
1. In connection with CTCS’s export, import or related operational activities, Personal Data may be transferred to recipients located outside Malaysia where such transfer is reasonably necessary for the Permitted Purposes.
2. Any such transfer will be undertaken in compliance with the PDPA and subject to
appropriate safeguards.
8. RETENTION OF PERSONAL DATA
1. CTCS will retain Personal Data only for as long as is reasonably necessary to fulfil the Permitted Purposes or to comply with applicable legal, regulatory or accounting requirements.
2. Upon expiry of the retention period, Personal Data will be securely destroyed, anonymized or permanently deleted in accordance with reasonable data protection practices.
9. SECURITY MEASURES
1. CTCS implements reasonable administrative, technical and physical safeguards to protect Personal Data against loss, misuse, unauthorized access, disclosure, alteration or destruction.
2. Access to Personal Data is restricted to authorised personnel who require such access for legitimate business purposes.
10. ACCURACY OF PERSONAL DATA
1. You are responsible for ensuring that the Personal Data you had provided to CTCS is accurate, complete and kept up to date and shall notify CTCS any changes where reasonably applicable.
11. PERSONAL DATA OF THIRD PARTIES
1. In the event that the Personal Data relating to another individual is provided by you, you represent and warrant that you have obtained the necessary consent or otherwise have the lawful authority to provide such Personal Data to CTCS for processing in accordance with this Notice.
12. RIGHTS AND CHOICES OF DATA SUBJECTS
1. Subject to the PDPA, you have the right to:
· request access to Personal Data held by CTCS;
· request correction of inaccurate, incomplete or outdated Personal Data; and
· withdraw consent for the processing of Personal Data, subject to legal and contractual restriction.
2. You may request to exercise these rights by contacting CTCS’s Data Protection Officer using the contact details set out below. CTCS reserves the right to refuse such requests where permitted under the PDPA and may impose a reasonable administrative fee for processing such request.
13. ACKNOWLEDGEMENT AND CONSENT
1. By providing your Personal Data to CTCS, you acknowledge that you have read and understood this Notice and consent to the processing of your Personal Data in accordance with the Permitted Purposes, subject always to your rights under the PDPA.
14. AMENDMENTS TO THIS NOTICE
1. CTCS reserves the right to amend or update this Notice from time to time. Any amendments will take effect upon publication or notification.
15. CONTACT INFORMATION
Any requests, enquiries or complaints relating to this Notice or the processing of Personal Data may be directed to:
Data Protection Officer
CTCS Worldwide Sdn. Bhd.
Address: Level 8, PGRM Tower 2,
No.8, Jalan Pudu Ulu,
56100 Cheras, Wilayah Persekutuan Kuala Lumpur
Telephone: 60173134460
Email: Danial@ctcs.com.my
