Personal Data Protection Act 2010 (“PDPA 2010”)
This notice (“Notice”) is issued by VENOVOX SDN BHD and its group of companies operating in Malaysia, Singapore, and the UK (collectively referred to herein as “we”, “us”, “our”, “Venovox” or “Data Processor”). Venovox provides comprehensive screening and background reports for our clients (collectively referred to herein as “client” or “Data Controller”). For the purpose of this Notice, words and expressions used herein shall, unless otherwise defined, have the meanings ascribed to them under the PDPA 2010.
By signing the corporate background screening consent form, submitting information to us or interacting with us in any way, you agree and consent to us collecting, using, processing and disclosing your personal data in the manner set forth in this Notice.
(a) For the purpose of the processing of personal data, we will be collecting your data comprising of your name, National Identity Registration Card number, Passport Number, all information within your CV, degree/qualification certificate, and other personal data which forms the search scope on a case-to-case basis.
(b) Our search scope encapsulates both personal data and sensitive personal data. Sensitive personal data is defined as any personal data consisting of information as to the physical or mental health or condition (e.g. health assessments) of a data subject, his political opinions, his religious beliefs or other beliefs of a similar nature, the commission or alleged commission by him of any offence (e.g. Reputational Risk Report, Civil & Criminal Prosecution searches, etc.) biometric data or any other personal data as the Minister may determine by order published in the Gazette.
(c) By signing the corporate background screening consent form, undergoing health assessment checks with us, or voluntarily submitting sensitive personal data to us, you consent to us collecting, using, disclosing and sharing your sensitive personal data to our authorised service providers and/or relevant third parties as set out in this Notice.
(d) If you provide us with any personal data relating to a third party (e.g., information of your spouse, children, parents, and/or employees), you represent to us that you have obtained the consent of such third party to provide their personal data to us for the purposes set out herein.
(e) We will not knowingly collect or process personal data of individuals under the age of 18 without the prior consent of their parent or legal guardian. By submitting such data, you confirm that parental or guardian consent has been obtained.
(a) The personal data compiled is solely for the purpose of generating a Venovox Report for our clients as the Data Controller. The use of Venovox Report is predominantly to assist the Data Controller with making employment decisions.
(b) Your personal data will be retained by us until a Venovox Report is generated. Our turnover time ranges from 2 days to 7 days.
(c) Upon the 180th day the Venovox Report is generated (calculated from and including the day Venovox Report is delivered to our client via the “hi – by Venovox” portal), your personal data will be permanently deleted from our system, and we will not retain any copy of the Venovox Report, unless agreed otherwise through written agreement.
(d) We will take reasonable measures to ensure that the personal data that we have in our possession is secured. Measures taken include the following:
Personal data is encrypted at rest and access is governed by role-based controls within our systems. Administrative access to servers and management systems is restricted to authorised personnel only, protected by multi-factor authentication and access credential policies. Access rights are reviewed periodically and revoked promptly when no longer required.
All personal data transmitted through our web applications and services is secured using HTTPS (SSL/TLS encryption) to prevent unauthorised interception or tampering during transit.
Our systems are hosted on cloud infrastructure with industry-standard physical and logical security controls. Firewall configurations, regular security patching, and software updates are applied on an ongoing basis to reduce exposure to known vulnerabilities.
We conduct routine system monitoring, including log review and activity auditing, to detect and respond to suspicious or anomalous behavior. Systems are regularly maintained to ensure they remain secure and up to date.
To ensure our response capabilities remain effective, we conduct annual breach simulation exercises and perform recovery testing on our Disaster Recovery (DR) environment to validate our preparedness and minimise potential disruption to operations and data integrity.
(a) Personal data is collected from internal sources (e.g., application forms, internal systems) and external sources (e.g., third-party providers, employers (past, current and future), institutions, person you have authorised to provide us with your personal data, and public/regulatory databases), via both manual and digital means.
(a) You should ensure that all personal data submitted to us is complete, accurate, true and correct. Failure on your part to do so may result in inaccuracy or incomplete Venovox Report, which may affect our client's decision to make an employment offer to you or to maintain your employment with them. It is mandatory for you to provide the requested personal data in order for us to deliver our services which our client had ordered. Failure to provide any personal data requested will limit, delay, or otherwise affect our ability to provide our services or to respond effectively to your requests, enquiries, or applications.
(b) At all times, you have the right to access and request a copy of your personal data. Please do not hesitate to reach out to Venovox in accordance with paragraph 4 (f) below should you wish to exercise this right. However, we will only be able to furnish a copy of the requested document in digital form, in compliance with our ESG policy.
(c) At all times, you have the right to correct or update your personal data. Please do not hesitate to reach out to Venovox in accordance with paragraph 4 (f) below should you wish to exercise this right.
(d) At all times, you have the right to give consent to, or to withdraw your consent to all or parts of the collection and/or disclosure of your personal data. Please do not hesitate to reach out to Venovox in accordance with paragraph 4 (f) below should you wish to exercise this right. However, do take notice of the repercussion of your withdrawal as elaborated under paragraph 4 (a) above.
(e) In order to process any of your requests under this paragraph 4, we may request for additional information in order to verify your identity. We reserve the right to reject any of your request if we are unable to verify your identity or where it is allowed by the law.
For the purpose of paragraphs 4 (b) to 4 (d), kindly reach out to us through our:
Designation: Legal Counsel cum Data Protection Officer (See Tian Xin)
Global WhatsApp:+6012 800 8888
Email:dpo@venovox.com
Online Support: Our research analysts are readily available via the communication log in the “Hi” Portal.
(a) Personal data may be disclosed to authorised third parties which may be located within or outside of Malaysia strictly for the purpose of fulfilling verification, screening, and compliance requirements. These include:
All disclosures are limited to data necessary for the intended purpose and are carried out with appropriate authorisation and/or consent from the data subject, in line with the PDPA 2010.
By signing the corporate background screening consent form or continuing to engage with us, you are deemed to have consented to the disclosure and cross-border transfer (where applicable) of your personal data to the third parties listed above, whether within or outside of Malaysia, where such disclosure or transfer is necessary to fulfil the purposes listed in this Notice.
(b) Appropriate technical and organisational security measures are implemented to ensure that all disclosures of personal data are conducted in a secure manner, including:
This Notice is issued in both English and Bahasa Malaysia languages. In the event of any inconsistency, the English language version of this Notice shall prevail.