Personal Data Protection Notice

1. Introduction

2. Your Personal Data

3. What Personal Data do we collect?

We collect Personal Data from you in the following ways:

4. What are the purposes for which Personal Data is collected and Processed?

Personal Data shall be collected, used, transferred or otherwise Processed for one or more of the following purposes:

5. Automated decision-making

6. Sharing your Personal Data with others

7. Cross-border transfer of Personal Data

8. When do we retain your Personal Data?

9. How do we protect your Personal Data?

10. How can you contact us for choices available to you?

11. Updates to Notice

APPENDIX 1: PERSONAL DATA WHICH MAY BE COLLECTED

Categories of Personal Data	Examples of types of Personal Data we collect
Personal identification, demographic, and contact information	Name, surname, title, gender, country, date and place of birth, nationality, marital status, domestic partners, dependents, email address, phone number, mobile number, home address, emergency contact information.
Network traffic and other related data	Identification numbers, location data, online identifiers, IP address, cookies, web beacons, device identification details, language settings.
Account creation and login information	Login details (including password), existing and/or previous employee or contractor or supplier identification details, other information used to access and/or secure our systems and applications.
Images and/or videos from which you may be identified, images captured on security systems, including CCTV and key card entry systems.	Pictures uploaded into our accounts, social media or services otherwise provided to us by you, CCTV images, log files.
Compensation and payroll	Bank account information, salary, bonus, payroll deductions including direct insurance.
Job, position, and organisation data	Department, supervisor, office address, work location, permit details, hire date, job title, designation, business unit, part-time or full time position, work history, termination date and reason, retirement eligibility, promotions and disciplinary records, date of transfers, reporting manager(s), other details of employment contract.
Performance and benefits data	Performance reviews and ratings, incentives, awards, retirement, benefits data of family members/dependents such as names and date of birth.
Data resulting from internal or external communications	Contents of email, records of communication through bots, messaging tools, mobile communications.
Tax Data	Tax number, contribution rates, tax preferences, social security number.
Information that you decide to voluntarily share with us	Feedback, opinions, reviews, comments, any information you may share with us on our social media platform, internal communication platforms and websites.
Special categories of Personal Data	This may include: Religious or philosophical beliefs; Medical history and information about disabilities to the extent relevant to provide services, benefits and/or perform a contract; Racial or ethnic data: for instance, where this would show from pictures, photographs and other visual images, but also where such data is processed for diversity related purposes; Criminal data such as data relating to criminal behavior, criminal records or proceedings regarding criminal or unlawful behavior.

APPENDIX 2: PURPOSES FOR WHICH PERSONAL DATA IS PROCESSED

Purposes for Processing Personal Data	Examples
Administration and management	Management of relationship, management and administration of outplacement, eligibility for employment, initial hiring or rehiring, , leave and other absences, management of compensation and benefits (including pensions and/or shares),management of tax issues, performance evaluations, providing and verifying employment references, loans, performing workforce analysis and planning, performing background checks, managing disciplinary matters, grievances and terminations, making business travel arrangements, managing business expenses and reimbursements, creating and maintaining one or more internal employee directories.
Business process execution and internal operations management	Internal communications, scheduling work, recording time, managing and allocating company and employee assets and human resources, managing career and talent development, performing internal surveys, ensuring business continuity and crisis management, improving employees’ and teams’ performance, managing courses and/or trainings, managing projects and costs, managing mergers, acquisitions, divestitures, re-organisations or disposals and integration with purchaser, compilation of audit trails and other reporting tools, maintaining records relating to business activities, budgeting, financial management and reporting.
Employee/Customer support	Providing support via internal tools and communication channels,
Commercial communications	Communications about discounts for services
Security and protection of assets and employees	Deploying and maintaining technical and organisational security measures, conducting internal audits and investigations, conducting assessments to verify conflict of interests, identifying and authenticating employees, managing network security and preventing data loss using automated technologies to identify malicious data on equipment or networks and to detect confidential information from leaving our perimeters or from unauthorised access to that information. Recording of your Personal Data through video or other digital, electronic, or wireless surveillance system or device to secure and maintain IT infrastructure, office equipment, facilities and other property.
Compliance with legal and regulatory obligations	Disclosing Personal Data to government institutions or supervisory authorities as required by law or judicial authorisation for complying with tax and national insurance deductions, record-keeping and reporting obligations, conducting audits and investigations to prevent or detect fraud or corruption, compliance with government inspections and other requests from government or other public authorities, responding to legal process conducting investigations including employee reporting of allegations of wrongdoing, policy violations, fraud, or financial reporting concerns, complying with internal policies and procedures. Please also keep in mind that we may also use your data for security reasons and/or to protect our legitimate business interests or to prevent or investigate suspected or actual violations of law, breaches of the terms of employment or non-compliance with our policies.
Defence of legal claims	Establishment, exercise or defence of legal claims to which we are subject, such as responding to legal processes such as subpoenas, pursuing legal rights and remedies, defending litigation and managing any internal complaints or claims (including any whistle-blower/ethics hotlines).
Health and safety	Protecting your and others’ health and safety, facilitating communication with you and your designated contacts in an emergency or during your business travel.
Enhanced security and further processing for improved services	Creation of de-identified and/or anonymised data from your Personal Data (by removal of identifiable components, obfuscation, anonymisation, or any other means) to enhance security and for further processing, aggregation, analysis for optimisation of patient care and improvement of healthcare services, products, research and development which may include transferring anonymised data to our affiliates and business partners in foreign countries.

References

IHH MALAYSIA PERSONAL DATA PROTECTION NOTICE