Privacy Notice — KursusTopPro

Definitions

The terms below explain concepts used throughout this privacy policy so readers understand the scope of data processing and their interactions with KursusTopPro.

Purposes of Processing

We process personal data for specific operational, administrative and legal purposes necessary to deliver our services to learners and partners.

• To register and manage learner accounts and course enrolments, including identity verification and eligibility checks.
• To deliver course content, assessments and learning resources and to record assessment outcomes for certification.
• To process payments, issue invoices and manage refunds or business reconciliations.
• To provide customer support, respond to enquiries and manage communications related to courses and assessments.
• To meet regulatory and statutory reporting obligations relevant to professional qualifications and training providers.
• To maintain platform security, detect fraud, misuse or unauthorized access and to contribute incidents.
• To carry out internal quality assurance, research and improvement activities that enhance course design and delivery.
• To send marketing communications where you have provided consent, and to manage your communication preferences efficiently.

Legal Basis for Processing

We rely on appropriate legal bases to process personal data depending on the purpose, including contract performance, compliance with law, consent and legitimate interests.

• Performance of a contract: processing necessary to provide courses and fulfil enrolment agreements.
• Legal obligation: processing required to comply with statutory reporting, accreditation or tax obligations.
• Consent: where you have explicitly agreed to marketing communications or optional processing such as promotional profiling.
• Legitimate interests: processing for platform security, fraud prevention, operational improvement and internal analytics where such interests are balanced with individual rights.

Data Subject Rights

Subject to applicable law, individuals have a range of rights relating to their personal data. We provide straightforward mechanisms to exercise these rights.

• Right of access: request a copy of personal data we hold about you and details of processing activities.
• Right to rectification: request correction of inaccurate or incomplete personal data.
• Right to erasure: request deletion of personal data where processing is no longer necessary or lawful, subject to retention obligations.
• Right to restrict processing and data portability where applicable to receive data in a structured, commonly used format.
• Right to object to processing based on legitimate interests or for direct marketing purposes.
• Right to withdraw consent at any time for processing activities that rely on consent, without affecting prior lawful processing.

Cookies and Tracking

We use cookies and similar technologies to operate the site, remember preferences and collect analytics. Cookie use supports core functionality and continuous improvement of learning resources.

Types of cookies include necessary cookies for session management, preference cookies for language and display, analytics cookies for usage aggregation and third-party cookies for embedded services.

Cookie categories: essential (required for platform operation), performance (analytics), functionality (preferences) and advertising (third-party marketing where applicable).

You may manage cookie preferences via our cookie banner on first visit or adjust browser settings to block or delete cookies. Disabling certain cookies may affect site features and course platform functionality.

View our full Cookie Policy

How We Share Data

We share personal data with selected partners and service providers strictly for purposes aligned with course delivery and administrative operations, under contractual safeguards.

• Accreditation and verification bodies for validation of awarded qualifications and compliance checks.
• Payment processors and business institutions to handle course fees and refunds.
• Cloud hosting and infrastructure providers that support our learning management systems and data storage.
• Third-party assessment agents and external moderators where independent assessment is required.
• Professional advisors, auditors or legal representatives when necessary for compliance or dispute resolution.
• Analytics and communication service providers to enable reporting and learner engagement tools.

International Transfers

Personal data may be processed by service providers located in jurisdictions outside Malaysia. Where transfers occur, we ensure appropriate safeguards are in place such as standard contractual clauses, data processing agreements and technical protections to maintain an adequate level of data protection.

When transferring data internationally, KursusTopPro evaluates provider security, enters into contractual safeguards, and implements encryption and access restrictions to protect personal information during transit and storage.

Data Retention

We retain personal data only for as long as necessary for the purposes outlined, or to satisfy legal, regulatory or accreditation requirements. Retention periods vary by data type and purpose.

Account records and core learner files are typically retained for a period consistent with accreditation and regulatory requirements, which may extend beyond course completion to support certifications and verifications.

Communications and support correspondence are retained for a reasonable period to manage enquiries, disputes and service improvement, after which they are archived or deleted according to retention schedules.

System logs and technical records used for security and diagnostics are retained for a limited period necessary for incident response and platform maintenance, after which they are purged or anonymised.

When personal data is no longer required and no legal obligation prevents deletion, KursusTopPro will securely delete or anonymise records in accordance with documented procedures.

Security Measures

KursusTopPro applies administrative, technical and physical measures to protect personal data from unauthorised access, loss or misuse. Security practices are regularly reviewed and updated as part of our risk management framework.

• Encryption of data in transit and at rest for sensitive information and secure access controls for platforms.
• Role-based access restrictions, multi-factor authentication for administrative accounts and regular access reviews.
• Regular security assessments, staff training on data protection best practices and an incident response plan to manage data events.

Exercising Your Rights and Contacting Us

As an individual interacting with KursusTopPro, you hold a set of data protection rights. These rights enable you to access, correct, restrict or object to processing of your personal data, request portability of certain information and request deletion where applicable. We handle every request with documented procedures and a view to professional compliance with applicable data protection practices in Malaysia.

• Right to access: You may request a copy of personal data we hold about you and details of processing activities involving your data.
• Right to rectification: If personal data we maintain is inaccurate or incomplete, you may request correction or completion of that data.
• Right to erasure: Where applicable by law, you may request deletion of personal data we no longer need for the purposes for which it was collected, subject to legal retention obligations.
• Right to restriction of processing: You may request temporary limitation of processing where you contest accuracy or where processing is unlawful and you oppose erasure.
• Right to data portability: For data you have provided in a structured, commonly used format, you may request export to yourself or another controller when technically feasible.
• Right to object: You may object to processing for direct marketing purposes or on grounds relating to your particular situation where processing is based on legitimate interests.
• Right to withdraw consent: Where processing is based on consent, you may withdraw consent at any time. Withdrawal will not affect processing undertaken prior to withdrawal.
• Right to lodge a complaint: If you are dissatisfied with our response to a data request, you may contact relevant supervisory authorities in Malaysia for review.

How to exercise your rights

To make a request relating to your personal data, please contact KursusTopPro using the contact details provided below. Include sufficient information to enable us to locate the relevant records, such as your full name, email address used with KursusTopPro, and a clear description of the request. We may ask for additional verification to protect your data.

[email protected]

We endeavor to acknowledge receipt of rights requests within 7 business days and to substantively respond within 30 calendar days. Complex requests or those requiring third-party coordination may take longer; we will inform you if additional time is needed and the reason for any extension.