Privacy Policy

1. Overview

MICLOH Consulting Group Sdn Bhd ("MICLOH", "we", "us", or "our") is committed to protecting your personal data and respecting your privacy. This Policy explains how we handle personal data collected through our website (micloh.com), our programmes and services, and our communications with you.

By using our website or engaging with our services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree to this Policy, please do not use our services.

2. Data Controller

The data controller responsible for your personal data is:

• Company: MICLOH Consulting Group Sdn Bhd
• Registration No.: 1177083-K
• Address: 09-09 Austin 18 Versatile Business Suites, Jalan Austin Perdana 3, Taman Austin Perdana, 81100 Johor Bahru, Johor, Malaysia
• Phone: 07-364 7199
• Email: info@micloh.com
• Person responsible for personal data: Tey Wei Ying, Corporate Planning & Strategy Manager, +60 7-364 7199, weiying.tey@micloh.com

3. Personal Data We Collect

We collect personal data that you voluntarily provide to us, as well as data collected automatically when you use our website. This may include:

Data you provide directly:

• Full name, email address, phone number
• Company name, job title, industry
• NRIC number (where required for programme registration or HRDC claims)
• Educational qualifications and work experience (for programme applications)
• Payment and billing information (processed via secure third-party providers)
• Enquiry content submitted via contact or registration forms
• Correspondence with us via email, phone, or WhatsApp

Data collected automatically:

• IP address, browser type, device type
• Pages visited, time spent on pages, referring URL
• Cookie identifiers and session data
• Location data (country/city level, derived from IP)

4. How We Use Your Personal Data

We use your personal data for the following purposes:

• To process programme registrations, enrolments, and applications
• To communicate with you about your enquiry, booking, or enrolment
• To process payments and issue receipts or invoices
• To process HRD Corp (HRDC) grant claims on your behalf
• To send programme updates, schedule changes, and administrative notices
• To send marketing communications about MICLOH programmes and services (with your consent, and you may opt out at any time)
• To conduct post-programme feedback surveys and assessments
• To issue certificates and maintain training records
• To improve our website, services, and user experience
• To comply with legal and regulatory obligations under Malaysian law
• To detect and prevent fraud or misuse of our services

5. Legal Basis for Processing

Under the Personal Data Protection Act 2010, we process your personal data on the following grounds:

• Consent: Where you have given explicit consent, such as subscribing to our newsletter or submitting an enquiry form.
• Contract: Where processing is necessary to fulfil a contract with you, such as delivering a programme you have enrolled in.
• Legal Obligation: Where processing is required to comply with applicable Malaysian law, including HRDC reporting obligations and financial record-keeping.
• Legitimate Interests: Where we have a legitimate business interest, such as improving our services, responding to enquiries, or maintaining records of training delivered.

6. Disclosure to Third Parties

We do not sell, rent, or trade your personal data. We may share your data with trusted third parties only as necessary:

• HRD Corp (Human Resources Development Corporation): For the purpose of processing HRDC training grants and compliance reporting, as required by law.
• Payment processors: To securely process payments (e.g., Stripe, bank transfer services). These providers are bound by their own privacy and security obligations.
• Email service providers: To send transactional and marketing emails (e.g., Resend, Mailchimp). Data shared is limited to what is necessary to deliver communications.
• CRM and analytics platforms: Such as HubSpot, Google Analytics, or similar tools used to manage customer relationships and website performance.
• Accreditation partners: Such as CMI UK (Chartered Management Institute), where your data is required for certification issuance or verification.
• Legal and regulatory authorities: Where required by Malaysian law, court order, or regulatory authority.

All third-party service providers are contractually required to handle your data securely and only for the purposes we specify.

7. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law:

• Programme and training records: Up to 7 years, as required for HRDC compliance and certification records.
• Financial records: Up to 7 years, as required under the Companies Act 2016 and income tax legislation.
• Marketing and enquiry data: Up to 2 years from last interaction, or until you withdraw consent.
• Website usage data (cookies, analytics): As configured by third-party tools (typically 1–2 years).

After the applicable retention period, personal data is securely deleted or anonymised.

8. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. These include:

• HTTPS encryption for all data transmitted via our website
• Access controls limiting data access to authorised personnel only
• Secure third-party payment processing (we do not store full card details)
• Regular review of our data handling practices

While we take all reasonable steps to protect your data, no method of transmission over the internet or electronic storage is 100% secure. If you suspect a data breach, please contact us immediately at info@micloh.com.

9. Cookies

Our website uses cookies and similar tracking technologies to improve your experience and analyse site usage. Cookies are small text files stored on your device.

Types of cookies we use:

• Essential cookies: Required for the website to function correctly (e.g., session management). These cannot be disabled.
• Analytics cookies: Help us understand how visitors interact with our site (e.g., Google Analytics). These are anonymised and aggregated.
• Marketing cookies: Used to deliver relevant advertisements and track campaign effectiveness (e.g., Meta Pixel). Only set with your consent.

You may control cookies through your browser settings. Disabling certain cookies may affect the functionality of parts of our website. Where required by law, we will seek your consent before setting non-essential cookies.

10. Your Rights Under the PDPA

Under the Personal Data Protection Act 2010, you have the following rights regarding your personal data:

• Right of Access: You may request a copy of the personal data we hold about you.
• Right of Correction: You may request that inaccurate or incomplete data be corrected.
• Right to Withdraw Consent: You may withdraw consent for processing at any time (this does not affect lawfulness of prior processing).
• Right to Limit Processing: You may request that we limit how we process your data in certain circumstances.
• Right to Object: You may object to processing based on legitimate interests, including direct marketing.

To exercise any of these rights, please contact our Data Protection Officer at info@micloh.com. We will respond to your request within 21 days. We may require you to verify your identity before processing your request.

If you are not satisfied with our response, you have the right to lodge a complaint with the Department of Personal Data Protection Malaysia (Jabatan Perlindungan Data Peribadi) at www.pdp.gov.my.

11. Cross-Border Data Transfers

Some of our service providers are located outside Malaysia (e.g., cloud infrastructure, email services, analytics platforms). Where we transfer your personal data outside Malaysia, we ensure that adequate safeguards are in place as required under the PDPA and applicable regulations, including contractual obligations on the receiving party to protect your data to a standard equivalent to that applicable in Malaysia.

12. Messaging Platforms & AI Assistant

When you contact MICLOH through Facebook Messenger, Instagram Direct Messages, WhatsApp, or our website live chat, your messages are processed to provide responses, answer questions about our programmes, and capture your enquiry details for follow-up by our team.

AI assistant disclosure. Our customer service assistant "Mavis" is powered by artificial intelligence. Mavis replies to enquiries on our behalf and may capture details you voluntarily share (such as your name, phone, WhatsApp number, email, company, and the programme you are interested in) so a human MICLOH team member can follow up. You will always be informed when you are interacting with an AI assistant. You can ask to speak to a human staff member at any time.

Data we receive from messaging platforms:

• Your public profile information provided by the platform (display name, profile picture)
• The content of messages you send to us
• Conversation metadata (timestamps, conversation thread identifiers)
• Referral information when you reach us via an advertisement (ad ID, referrer link)

How we use messaging data: respond to your enquiries, recommend relevant programmes, route your enquiry to the appropriate human team member, improve the quality of Mavis's responses through aggregate review, and (where you have opted in) send programme reminders or follow-ups.

Messaging platform data is governed by our agreements with Meta Platforms (Facebook, Instagram, WhatsApp) and is handled in accordance with the platforms' own data policies in addition to this Policy.

13. Data Deletion Requests

You have the right to request deletion of personal data we hold about you, including data collected through Facebook Messenger, Instagram, WhatsApp, our website forms, or live chat. To request deletion:

• Email info@micloh.com with the subject line "Data Deletion Request"
• Include the channel through which you contacted us (Messenger / Instagram / WhatsApp / website / phone) and any reference details (your name, phone number, or email used)
• We will acknowledge your request within 7 working days and complete deletion within 30 days, except where we are required to retain data for legal, tax, or regulatory purposes (in which case we will explain the basis)

For data shared via Facebook Messenger or Instagram specifically, you can also delete the conversation from your end within the Messenger / Instagram app, which removes our copy of subsequent messages from those threads.

14. Children's Privacy

Our programmes and services are intended for adults aged 18 and above. We do not knowingly collect personal data from individuals under the age of 18. If you believe we have inadvertently collected such data, please contact us and we will promptly delete it.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or services. When we make material changes, we will update the "Last Updated" date at the top of this page and, where appropriate, notify you by email or a notice on our website.

We encourage you to review this Policy periodically to stay informed of how we protect your data.

16. Contact Us

For any questions, requests, or concerns regarding this Privacy Policy or how we handle your personal data, please contact us: