PRIVACY POLICY/ PERSONAL DATA PROTECTION NOTICE

2. Personal Data We May Collect

Depending on your interaction with us, we may collect the following categories of personal data:

• identity information, such as name, title, organisation, designation and identification details where necessary;

• contact information, such as email address, telephone number, mailing address and social media contact details;

• transaction information, such as payment records, contribution details, receipts, invoices and sponsorship history;

• account information, such as username, password, login details and user preferences if account functions are available;

• communication information, such as enquiries, feedback, correspondence, forms, survey responses and support requests;

• event and participation information, such as attendance records, photographs, videos, consent forms, emergency contact details and activity preferences;

• technical information, such as IP address, browser type, device information, cookies, analytics data, log data and Website usage information;

• marketing preferences, such as subscription status and communication preferences; and

• any other information you voluntarily provide to us.

3. Sources of Personal Data

We may collect personal data directly from you, from your organisation, from authorised representatives, from public sources, from event registration forms, from payment or service providers, from social media interactions, from project partners, from cookies and Website technologies, or from any other lawful source connected with our activities.

4. Purposes of Processing

We may process personal data for the following purposes:

• to operate, manage and improve the Website;

• to respond to enquiries, requests, feedback and support matters;

• to process sponsorships, donations, purchases, payments, receipts, invoices and records;

• to manage projects, campaigns, events, site visits, community activities and stakeholder engagement;

• to communicate project updates, newsletters, marketing materials, impact reports and announcements where permitted by law;

• to manage user accounts, authentication, security and fraud prevention;

• to maintain internal records, accounting records, audit trails and compliance documents;

• to comply with legal, regulatory, tax, audit, reporting and governance obligations;

• to protect the safety, rights, property and legitimate interests of the Company, users, communities, partners and the public;

• to conduct analytics, research, monitoring, evaluation and improvement of our projects and communications; and

• for any other purpose that is related to the above or for which you have provided consent.

5. Legal Basis and Consent

5.1 Where required by law, we will obtain your consent for the processing of your personal data.

5.2 We may also process personal data where necessary for contractual performance, legal compliance, legitimate business purposes, administration, security, record-keeping, dispute management, or other purposes permitted under applicable law.

5.3 If you provide personal data relating to another person, you confirm that you have obtained that person's consent or have lawful authority to provide the data to us.

6. Disclosure of Personal Data

We may disclose personal data, where necessary and appropriate, to:

• our directors, officers, employees, consultants, advisers and authorised representatives;

• project partners, community partners, sponsors, collaborators, contractors and service providers;

• payment processors, banks, accounting service providers and transaction facilitators;

• IT, hosting, cloud, cybersecurity, analytics, communication and website service providers;

• professional advisers, auditors, lawyers, insurers and compliance consultants;

• government authorities, regulators, enforcement agencies, courts, tribunals or other parties where required or permitted by law;

• successors or counterparties in connection with restructuring, merger, acquisition, transfer of business or similar corporate exercise; and

• any other person or organisation with your consent or as reasonably required for the purposes stated in this Privacy Notice.

7. International Transfers

7.1 Some of our service providers, cloud systems, communication platforms or partners may be located outside Malaysia or may process data outside Malaysia.

7.2 Where personal data is transferred outside Malaysia, we will take reasonable steps to ensure that the transfer is carried out in accordance with applicable Malaysian personal data protection requirements and that appropriate safeguards are in place where required.

8. Security of Personal Data

8.1 We will take reasonable practical steps to protect personal data against loss, misuse, unauthorised access, disclosure, alteration or destruction.

8.2 However, no website, internet transmission, email, cloud system or electronic storage method is completely secure. You acknowledge that transmission of information through the internet is at your own risk.

9. Retention

9.1 We will retain personal data for as long as necessary to fulfil the purposes for which it was collected, to comply with legal, accounting, tax, audit, regulatory and reporting requirements, to resolve disputes, to enforce agreements, and to maintain proper business records.

9.2 When personal data is no longer required, we will take reasonable steps to delete, anonymise or securely dispose of it in accordance with applicable requirements.

10. Cookies and Analytics

10.1 The Website may use cookies, pixels, analytics tools, log files and similar technologies to operate the Website, remember preferences, understand visitor behaviour, measure performance, improve services and support marketing or communications.

10.2 You may disable cookies through your browser settings, but some Website functions may not operate properly if cookies are disabled.

11. Direct Marketing and Communications

11.1 We may send you newsletters, project updates, event invitations, campaign communications, educational materials or promotional information where permitted by law.

11.2 You may opt out of marketing communications by using the unsubscribe method provided in the communication or by contacting us. We may still send non-marketing communications, such as transaction, legal, security or service-related notices.

12. Photographs, Videos and Publicity

12.1 If you attend our events, site visits, community activities or project-related activities, photographs, videos or recordings may be taken for documentation, reporting, educational, publicity, media or stakeholder communication purposes.

12.2 Where appropriate, we will obtain consent for identifiable use of images, testimonials or profiles, especially where they are used for website publication, marketing or promotional materials.

13. Your Rights

Subject to applicable law, you may have the right to:

• request access to personal data we hold about you;

• request correction of inaccurate, incomplete or outdated personal data;

• withdraw consent where processing is based on consent;

• request that we stop using your personal data for direct marketing;

• raise concerns or complaints about how your personal data is handled; and

• exercise any other right available under applicable Malaysian personal data protection law.

We may require verification of your identity before processing a request. We may also refuse or limit a request where permitted by law.

14. Personal Data of Minors

The Website is not intended for use by minors without appropriate parental or guardian consent. If you provide personal data of a minor, you confirm that you are the parent, guardian or authorised person and consent to the processing of such data for the relevant purpose.

15. Accuracy of Personal Data

You are responsible for ensuring that personal data provided to us is accurate, complete and up to date. Please notify us if your personal data changes or if you believe the personal data we hold is inaccurate.

16. Data Breach Management

Where a personal data breach occurs, we will assess the breach and take reasonable steps to contain, investigate and remediate it. Where notification to the relevant authority or affected individuals is required under applicable Malaysian personal data protection law, we will make such notification in accordance with legal requirements.

17. Updates to this Privacy Notice

We may update this Privacy Notice from time to time. The updated version will be posted on the Website and will take effect from the date stated in the updated version or, if no date is stated, from the date of posting.

18. Contact for Personal Data Matters

For access, correction, withdrawal of consent, privacy enquiries or complaints, please contact:

Carbon Xchange (Sarawak) Sdn. Bhd.
Company No. 1201716-H
Website: www.carbonxchange.my
Email: admin@carbonxchange.my