Privacy Policy

1. Introduction

Sentosa ("we", "us", "our") is committed to handling personal data with care. This policy explains what information we collect through our website and in the course of our advisory services, how we use it, and what rights you have in relation to it.

Sentosa operates under the Personal Data Protection Act 2010 (PDPA) of Malaysia. Our registered address is Level 8, Wisma UOA II, Jalan Pinang, 50450 Kuala Lumpur, Malaysia. For questions about this policy, contact us at [email protected].

2. Data We Collect

We collect personal data in two main contexts:

• Website enquiry forms: name, email address, phone number (optional), and message content.
• Service engagements: contact details of HR personnel, details of HR processes shared for review purposes, and — where applicable under a signed data flow agreement — anonymised or pseudonymised employee data provided by client organisations for fairness signal analysis.
• Cookies and analytics: browser type, pages visited, time on site. See our Cookie Policy for details.

We do not collect sensitive personal data (as defined under PDPA Schedule) without explicit consent and a documented purpose.

3. Legal Basis and Purpose

Under PDPA 2010, we process personal data on the following bases:

• Consent: For marketing communications, cookie analytics, and any processing of employee data shared by client organisations.
• Contractual necessity: For processing contact details to respond to enquiries and deliver advisory services.
• Legitimate interest: For basic website analytics used to improve the usefulness of our site.

We use personal data to respond to enquiries, deliver contracted services, send relevant updates where you have consented, and comply with our legal obligations.

4. Retention Periods

We retain personal data for as long as necessary for the stated purpose:

• Enquiry form submissions: up to 24 months from date of submission, or until the enquiry is resolved.
• Client engagement records: up to 7 years from engagement end, in line with standard business record-keeping practice.
• Employee data shared for fairness analysis: deleted within 30 days of the delivery of the relevant report, unless a longer period is agreed in writing.
• Website analytics data: up to 26 months, subject to your cookie consent.

5. Data Sharing

We do not sell personal data. We share data only in the following circumstances:

• Service providers: We use secure third-party tools for email, document storage, and analytics. These providers are bound by data processing agreements and do not use your data for their own purposes.
• Legal requirements: We may disclose data if required by Malaysian law or by a court order.
• With your consent: In no other case.

Where service providers are located outside Malaysia, we take steps to ensure equivalent data protection standards apply, consistent with PDPA transfer requirements.

6. Data Protection Measures

We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, and misuse. These include:

• Encrypted storage for all client documents and personal records.
• Access controls limiting data access to personnel who require it for their role.
• Regular review of third-party tools against our data handling standards.
• Data breach notification procedures: affected individuals and the relevant authority are notified without undue delay if a breach is likely to result in risk to their rights.

7. Cookies

We use essential cookies for site functionality and optional analytics cookies to understand how visitors use the site. You can manage your preferences via our Cookie Policy page, or through the consent banner displayed on your first visit.

8. Your Rights Under PDPA 2010

Under the Personal Data Protection Act 2010 (Malaysia), you have the right to:

• Access personal data we hold about you.
• Correct inaccurate or incomplete data.
• Withdraw consent at any time, where processing is based on consent.
• Request deletion of your data where retention is no longer necessary.
• Object to processing for direct marketing purposes.
• Complain to the Personal Data Protection Commissioner of Malaysia if you believe your rights have been infringed.

To exercise any of these rights, email [email protected] with your name, contact details, and a description of your request. We will respond within 21 days.

9. Third-Party Links

Our website may contain links to external sites. We are not responsible for the privacy practices of those sites and recommend you review their policies independently.

10. Children's Privacy

Our services are directed at organisations and HR professionals. We do not knowingly collect personal data from individuals under the age of 18. If you believe we have inadvertently collected such data, please contact us at [email protected].

11. Policy Updates

We review this policy periodically. Changes will be posted on this page with an updated "Last updated" date. Where changes are material, we will notify clients directly by email. Continued use of our website or services after changes are posted constitutes acceptance.

12. Contact

Data controller: Sentosa, Level 8, Wisma UOA II, Jalan Pinang, 50450 Kuala Lumpur, Malaysia.

Privacy enquiries: [email protected]

Supervisory authority: Personal Data Protection Commissioner of Malaysia, Department of Personal Data Protection, Ministry of Digital. Website: pdp.gov.my