Privacy Notice

This Privacy Notice applies to personal data collected and processed by us in connection with the Website and the Foundation's charitable activities, including personal data submitted through any application form, enquiry form, contact facility or electronic communication.

This Privacy Notice applies to individuals who access or use the Website, submit applications or requests for charitable assistance, receive or may receive assistance from the Foundation, or otherwise communicate or deal with us. It also applies to parents, legal guardians, authorised representatives and individuals whose personal data is provided to us by Applicants or third parties in connection with the Foundation's activities.

This Privacy Notice does not apply to any third-party website, application or service to which the Website may link. We are not responsible for the privacy practices of any third party.

Where any application, grant, scholarship, financial assistance or other charitable programme is subject to separate terms, conditions, declarations or consent requirements (“Programme Terms”), this Privacy Notice applies in addition to, and does not vary, any data protection or confidentiality provisions of those Programme Terms. In the event of any inconsistency, the Programme Terms prevail in respect of that particular subject matter.

This Privacy Notice should be read together with our Terms of Use and Cookie Notice.

In this Privacy Notice, unless the context otherwise requires:

• a.

  “Applicable Law” means the laws of Malaysia, including the PDPA, and all subsidiary legislation, regulations, standards, guidelines and directions issued under them, in each case as amended from time to time;

• b.

  “Applicant” means any individual, institution, organisation or other entity that submits an application or request for charitable assistance, donations, grants, scholarships, funding or other forms of support from the Foundation, whether for itself or on behalf of another person or entity;

• c.

  “Beneficiary” means any individual or other person who receives or is intended to receive charitable assistance, financial support, educational assistance, medical aid or other benefits provided or facilitated by the Foundation;

• d.

  “personal data” has the meaning given to it in the PDPA and means any information in respect of commercial transactions which relates directly or indirectly to a data subject who is identified or identifiable from that information or from that and other information in our possession;

• e.

  “sensitive personal data” has the meaning given to it in the PDPA and includes personal data consisting of information as to your physical or mental health or condition, political opinions, religious beliefs or other beliefs of a similar nature, biometric data, and the commission or alleged commission of any offence;

• f.

  “processing” means collecting, recording, holding, storing, organising, adapting, altering, retrieving, consulting, using, disclosing, transferring, erasing or destroying personal data, and “process” and “processed” are construed accordingly;

• g.

  “Commissioner” means the Personal Data Protection Commissioner appointed under the PDPA; and

• h.

  “you” or “your” means the individual to whom the personal data relates, including any individual who accesses or uses the Website, submits an application or enquiry, acts on behalf of an Applicant or Beneficiary, or whose personal data is otherwise provided to or processed by the Foundation.

Headings are inserted for convenience only and do not affect the interpretation of this Privacy Notice.

Words importing the singular include the plural and vice versa, and words importing any gender include every gender.

A reference to a statute or statutory provision includes any subsidiary legislation made under it and any re-enactment or amendment of it.

Depending on how you interact with us, we may collect and process the following categories of personal data:

• a.

  Identity and contact data: your full name, nationality, date of birth, age, gender, National Registration Identity Card (NRIC) number, passport number or other identification details, copies of identification documents, residential or correspondence address, email address, telephone or mobile number, and other relevant contact information;

• b.

  Personal and household information: your marital status, family background, household composition, number of dependants, employment status, occupation, living arrangements and other information concerning your personal, family or household circumstances relevant to an application for assistance;

• c.

  Financial information: your employment and income details, household income, financial commitments, bank account details, bank statements, financial statements, salary slips, income declarations and other supporting financial documents reasonably required to assess eligibility for financial assistance or to administer approved assistance;

• d.

  Educational information: your academic qualifications, examination results, school or educational institution details, student identification information, enrolment status, academic transcripts, admission or offer letters, tuition fees, educational expenses and other information relating to applications for scholarships, educational grants or educational assistance;

• e.

  Medical and health information: your medical history, health condition, diagnosis, medical reports, medical certificates, treatment plans, estimated medical expenses, hospital or healthcare provider details and other health-related information reasonably required for applications involving medical or healthcare assistance;

• f.

  Charitable assistance information: details of any application, request or proposal submitted to the Foundation, the nature and purpose of the assistance requested, supporting documents, eligibility information, records of previous assistance, and information relating to the assessment, approval, administration or monitoring of assistance;

• g.

  Enquiry data: the subject matter and content of any enquiry, message, request or feedback you submit through the Website or by electronic mail, and any documents or attachments you provide;

• h.

  Correspondence and communication data: records of communications between you and us, including emails, call notes, meeting records, messages, and telephone conversations;

• i.

  Technical and usage data: your internet protocol (IP) address, browser type and version, operating system and platform, device identifiers, time zone setting, referring website, pages visited, date and time of access, and other diagnostic data collected automatically when you access the Website;

• j.

  Cookie data: information collected through cookies and similar technologies, as described in our Cookie Notice;

• k.

  Marketing data: your preferences in receiving marketing communications from us and your communication preferences; and

• l.

  Other relevant information: any additional information, photographs, declarations, documents or supporting materials voluntarily provided by you, or reasonably required by us, in connection with an application, request, enquiry or the Foundation's charitable activities.

In carrying out our charitable activities, particularly those involving medical aid, healthcare support and assistance to underprivileged individuals, we may collect and process sensitive personal data, including information relating to an individual's physical or mental health or medical condition. We will process such sensitive personal data only with the explicit consent of the relevant individual or their parent, legal guardian or other person lawfully authorised to provide such consent, where applicable, or where otherwise permitted or required under Applicable Law.

We will endeavour to collect only such personal data as is reasonably necessary and relevant for the purposes set out in this Privacy Notice, having regard to the nature of the application, request or assistance concerned.

Where necessary for the purpose of assessing applications or providing or disbursing financial assistance, we may request relevant bank account or payment details. However, we will not request your online banking passwords, personal identification numbers (PINs), one-time passwords (OTPs) or other confidential banking security credentials through the Website.

Where you provide us with personal data relating to another individual, including your family members, dependants, children, students, patients, employees or other persons, you represent and warrant that you have obtained the necessary consent or authorisation to provide such personal data to us and to permit its processing in accordance with this Privacy Notice, or that you are otherwise legally entitled to do so.

We collect personal data:

• a.

  directly from you, when you complete and submit an application form, enquiry form, declaration or other document through the Website, correspond with us by electronic mail, telephone or post, meet with us, or otherwise provide information to us;

• b.

  automatically, through cookies, server logs and similar technologies, when you access and navigate the Website;

• c.

  from your parent, legal guardian, or other person lawfully authorised to provide your personal data or act on your behalf;

• d.

  from schools, educational institutions, hospitals, healthcare providers, charitable institutions, animal welfare organisations, community organisations and other relevant third parties in connection with an application for assistance, subject to the necessary consent or authorisation or as otherwise permitted under Applicable Law;

• e.

  from supporting documents, certificates, records, statements or other information submitted in connection with an application or request for assistance;

• f.

  from third parties, publicly available sources or other lawful sources, including analytics and hosting providers, and public registers and directories; and

• g.

  from any other source where you have consented to the disclosure of your personal data to us, or where such disclosure is otherwise permitted under Applicable Law.

We may, where reasonably necessary, verify the accuracy, authenticity and completeness of personal data provided to us by contacting relevant persons, institutions, organisations or authorities, including schools, educational institutions, hospitals, healthcare providers, welfare organisations, employers, government agencies or other relevant parties.

You are not obliged to provide any personal data to us. However, certain information may be necessary for us to process, verify or assess an application or request for assistance. The consequences of failing to provide such information are described in Clause 7.

We process your personal data for the following purposes:

• a.

  to receive, register, review, process, evaluate and assess applications, enquiries, proposals and requests for donations, grants, scholarships, funding, financial assistance, medical aid, welfare assistance and other forms of charitable support;

• b.

  to determine the eligibility, suitability and needs of Applicants and Beneficiaries for assistance provided by the Foundation;

• c.

  to verify the accuracy, authenticity and completeness of information and supporting documents submitted to us, including conducting such checks and enquiries as may be reasonably necessary for the assessment of an application;

• d.

  to communicate with Applicants, Beneficiaries, their parents, legal guardians, authorised representatives and other relevant persons in connection with their applications, requests, enquiries and assistance provided by the Foundation;

• e.

  to consider, approve, reject, administer, coordinate, arrange, facilitate and disburse donations, grants, scholarships, funding, financial assistance, medical aid, educational assistance and other charitable support;

• f.

  to liaise, coordinate and cooperate with relevant schools, educational institutions, hospitals, healthcare providers, charitable institutions, welfare organisations, animal shelters, animal welfare organisations, government agencies and other relevant parties for the purpose of assessing, administering or providing charitable assistance;

• g.

  to monitor, review, verify and evaluate the use, utilisation, progress, outcome and effectiveness of any assistance, grant, scholarship, donation or funding provided or facilitated by the Foundation;

• h.

  to maintain accurate records of applications, assessments, decisions, assistance provided, financial transactions, disbursements, communications and other matters relating to the Foundation's charitable activities;

• i.

  to conduct internal reviews, due diligence, audits, investigations and other assessments for accountability, transparency, proper administration and the responsible use of the Foundation's funds and resources;

• j.

  to detect, investigate and prevent fraud, misrepresentation, false applications, misuse of funds, security incidents, unauthorised access, misuse of the Website and other unlawful or improper activities;

• k.

  to prepare internal reports, statistical analyses and records relating to the Foundation's charitable activities, programmes and their outcomes, including reports to relevant funders, donors, auditors, regulators and other stakeholders, using anonymised or aggregated information where reasonably practicable;

• l.

  to verify, administer, manage and report on donations, funding or assistance involving donors, sponsors, funding partners or other supporting organisations, including providing relevant information concerning Applicants, Beneficiaries and the assistance provided, where reasonably necessary and permitted under Applicable Law;

• m.

  to operate, administer, maintain, secure, monitor and improve the Website, its functions and our systems, and to analyse Website usage patterns and traffic;

• n.

  to maintain our internal records, accounts, financial management, governance and administration;

• o.

  to comply with our legal, regulatory, statutory and reporting obligations, including responding to requests from any court, regulator, law enforcement agency, governmental authority or other competent authority;

• p.

  to establish, exercise or defend legal claims, resolve disputes and obtain legal, financial or other professional advice;

• q.

  for any other purpose reasonably necessary or directly related to the purposes specified above, or any other purpose for which we have notified you and obtained your consent where required under Applicable Law;

• r.

  to send you newsletters, updates and other communications about the Foundation's programmes, activities, events, appeals and fundraising initiatives, where you have consented or where we are otherwise permitted to do so under Applicable Law; and

• s.

  to publicise and promote the Foundation's charitable activities, including by featuring photographs, images, stories or testimonials of Applicants, Beneficiaries or other participants in reports, publications, presentations, the Website and social media, with consent where required under Applicable Law.

We will not process your personal data for any purpose that is materially different from those set out above without first notifying you and, where required by the PDPA, obtaining your consent.

We process your personal data on the basis of your consent, which you give by submitting your personal data to us or by continuing to use the Website after being notified of this Privacy Notice.

Where we collect or process sensitive personal data, including medical or health information, we will obtain your explicit consent or the explicit consent of your parent, legal guardian or other person lawfully authorised to provide such consent, where applicable, unless such processing is otherwise permitted or required under Applicable Law.

Where an application is submitted on behalf of another individual, including a child below the age of eighteen (18) years, the person submitting the application must have the necessary legal authority to provide the relevant personal data and to give any consent required for its processing.

We may also process your personal data without your consent where such processing is permitted or required under Applicable Law, including where it is necessary:

• a.

  for the performance of a contract to which you are a party, or in order to take steps at your request with a view to entering into a contract;

• b.

  for compliance with any legal obligation to which we are subject, other than a contractual obligation;

• c.

  in order to protect your vital interests;

• d.

  for the administration of justice, or for the exercise of any function conferred on any person by or under any written law; or

• e.

  in any other circumstance permitted under the PDPA or other Applicable Law.

Where processing is based on your consent, you may withdraw that consent at any time by providing written notice to us in accordance with Clause 19. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

Where you withdraw your consent, we may be unable to continue processing your application, assessing your eligibility, providing or administering assistance, or communicating with you in relation to the relevant application or assistance. Notwithstanding such withdrawal, we may continue to retain or process your personal data where permitted or required under Applicable Law.

The provision of personal data identified as mandatory in any application form, enquiry form, supporting documentation requirement or other request from us is necessary where you wish to submit an application, request or enquiry to the Foundation and have it considered or processed.

If you fail or refuse to provide such personal data, or provide incomplete or insufficient information, we may be unable to:

• a.

  receive, process, assess or verify your application or request;

• b.

  determine your eligibility or suitability for any charitable assistance, donation, grant, scholarship, funding or other support;

• c.

  communicate with you or obtain further information or clarification concerning your application;

• d.

  approve, arrange, disburse, administer or monitor any assistance which may otherwise be provided to you; or

• e.

  fulfil any other purpose for which the relevant personal data is reasonably required.

Where certain personal data is identified as optional, failure to provide such information will not, by itself, prevent you from submitting an application, although it may limit our ability to assess or respond to matters for which that information is relevant.

We may disclose your personal data, including where necessary personal data that identifies an Applicant or Beneficiary, to the following classes of third parties where reasonably necessary for the purposes set out in this Privacy Notice and subject to Applicable Law:

• a.

  our related or affiliated organisations, including any company or group that founded, sponsors or provides administrative support to the Foundation;

• b.

  our directors, officers, employees, agents and contractors, on a need-to-know basis;

• c.

  persons or committees appointed or authorised by the Foundation to assess, review, evaluate, verify, approve, administer or monitor applications, grants, scholarships, donations, funding or other charitable assistance;

• d.

  schools, educational institutions, universities, scholarship administrators and other relevant educational bodies in connection with applications for scholarships, educational grants or other educational assistance;

• e.

  hospitals, clinics, medical practitioners, healthcare providers and other relevant healthcare institutions in connection with applications for medical aid, healthcare support or financial assistance for medical treatment;

• f.

  charitable institutions, welfare organisations, orphanages, children's homes, animal shelters, animal welfare organisations, community organisations and other relevant parties involved in verifying, coordinating, administering or providing charitable assistance;

• g.

  banks, financial institutions, payment service providers and other relevant parties involved in arranging, facilitating or disbursing approved donations, grants, scholarships, financial assistance or other payments;

• h.

  our data processors and service providers, including website hosting, cloud storage, information technology support, email, application management systems, electronic communications, data storage and other services necessary for the operation of the Website and the Foundation's activities;

• i.

  our professional advisers, including legal advisers, auditors, accountants, insurers and consultants;

• j.

  donors, sponsors, funding partners and supporting organisations who provide or facilitate funds, donations, grants or other forms of assistance through or in cooperation with the Foundation, for purposes including eligibility verification, administration, allocation, disbursement, monitoring, reporting and accountability in relation to such assistance;

• k.

  any court, tribunal, regulator, government agency, statutory body or law enforcement authority, where disclosure is required or permitted under Applicable Law or by order of a competent authority;

• l.

  any party to whom we are required or permitted to disclose under Applicable Law or pursuant to any professional obligation; and

• m.

  any other person or organisation to whom disclosure is reasonably necessary for the purposes specified in this Privacy Notice and is permitted under Applicable Law.

Where we engage a data processor to process personal data on our behalf, we will take reasonable steps to ensure that the processor is subject to appropriate contractual, confidentiality and security obligations consistent with Applicable Law.

Your personal data is primarily stored and processed in Malaysia. However, some of our service providers may store or process personal data on servers located outside Malaysia.

We will transfer personal data outside Malaysia only where the transfer is permitted under Section 129 of the PDPA, including where the place to which the data is transferred has in force laws substantially similar to the PDPA or which serve the same purposes, or where you have given your consent to the transfer.

Where required, we will conduct an assessment of the transfer and put in place appropriate contractual safeguards to ensure that your personal data continues to be afforded a level of protection consistent with the PDPA.

By providing your personal data to us, you consent to the transfer, storage and processing of your personal data outside Malaysia on the terms set out in this Clause 9.

We take practical steps to protect personal data in our possession or under our control from any loss, misuse, modification, unauthorised or accidental access or disclosure, alteration or destruction, having regard to the nature of the personal data and the harm that would result from such an occurrence.

Our security measures may include, as appropriate, access controls and user authentication, encryption of data in transit, firewalls and network security, restriction of access on a need-to-know basis, confidentiality obligations imposed on our personnel and contractors, and periodic review of our security practices.

Notwithstanding the security measures adopted by us, no method of electronic storage is completely secure. While we endeavour to protect your personal data, we cannot guarantee its absolute security, and any transmission of personal data to us is at your own risk.

You are responsible for keeping confidential any credentials or access details issued to you and for the security of the device and internet connection you use to access the Website.

We will not keep your personal data for longer than is necessary for the fulfilment of the purposes for which it was collected, or as required under Applicable Law.

In determining the appropriate retention period, we consider the nature and sensitivity of the personal data, the purposes for which we process it, the applicable limitation periods for legal claims, and any statutory, regulatory or professional retention requirements.

We will take reasonable steps to ensure that personal data is destroyed or permanently deleted when it is no longer required for the purpose for which it was to be processed.

We may retain anonymised or aggregated data, which cannot be used to identify you, for statistical, analytical, research, reporting and programme development purposes without limitation of time.

We take reasonable steps to ensure that the personal data we hold is accurate, complete, not misleading and kept up to date, having regard to the purposes for which it was collected and further processed.

You are responsible for informing us of any change to your personal data. Please notify us promptly, in accordance with Clause 19, of any change so that we can update our records.

We are not responsible for any loss arising from your failure to notify us of any change to, or inaccuracy in, your personal data.

Subject to the PDPA, you have the following rights in respect of your personal data:

• a.

  Right of access: to request access to the personal data we hold about you and to be provided with a copy of it;

• b.

  Right of correction: to request the correction of any personal data that is inaccurate, incomplete, misleading or out of date;

• c.

  Right to withdraw consent: to withdraw, by written notice, your consent to our processing of your personal data;

• d.

  Right to prevent processing likely to cause damage or distress: to require us, by written notice, to cease or not to begin processing your personal data where the processing is likely to cause substantial damage or substantial distress to you or another person;

• e.

  Right to prevent processing for direct marketing: to require us, by written notice, to cease or not to begin processing your personal data for the purposes of direct marketing; and

• f.

  Right to data portability: to request that your personal data be transmitted directly to another data controller, where technically feasible and in the format and manner prescribed under the PDPA.

To exercise any of these rights, please submit a written request to us using the contact details in Clause 19. We may require you to provide proof of identity and sufficient particulars to enable us to locate the relevant personal data.

We will respond to your request within the period prescribed under the PDPA. A prescribed fee may be payable in respect of a data access request.

We may refuse a request for access or correction in the circumstances set out in the PDPA, in which case we will notify you in writing of our refusal and the reasons for it.

If you are dissatisfied with our handling of your personal data, you may contact us in the first instance under Clause 19. You also have the right to lodge a complaint with the Commissioner.

We maintain internal procedures for the detection, escalation, containment and investigation of any personal data breach affecting personal data in our possession or under our control.

Where we have reason to believe that a personal data breach has occurred, we will notify the Commissioner in the form and manner prescribed under the PDPA.

Where the personal data breach causes or is likely to cause significant harm to you, we will notify you without undue delay in the manner and form as determined by the Commissioner.

We will maintain a record of all personal data breaches, including the facts of the breach, its effects and the remedial action taken.

The Website may contain links to third-party websites, applications, plug-ins or resources. Clicking on such a link may allow that third party to collect or share data about you.

We do not control, and are not responsible for, the privacy practices, content or security of any third-party website or service. We encourage you to read the privacy notice of every website or service you visit.

In carrying out our charitable, educational, medical and welfare activities, the Foundation may collect and process personal data relating to children and individuals below the age of eighteen (18) years, including students, children residing in orphanages or children's homes, and children who are Applicants or Beneficiaries of charitable assistance.

Any application, request or personal data relating to a child must be submitted by the child's parent, legal guardian or other person lawfully authorised to act on the child's behalf, who must also give any consent required for the processing of the child's personal data, including sensitive personal data, unless otherwise permitted or required under Applicable Law. Children may not submit applications or requests for assistance independently through the Website.

We process the personal data of children only where it is provided by such a person or is otherwise lawfully obtained, only to the extent reasonably necessary for the assessment, verification, administration, provision or monitoring of assistance provided or facilitated by the Foundation, and subject to safeguards appropriate to the sensitivity of that data.

If you believe that personal data relating to a child has been provided to us without the necessary consent or authorisation, please notify us using the contact details in Clause 19. We will review the matter and take appropriate action in accordance with Applicable Law.

We may amend, vary or replace this Privacy Notice at any time in order to reflect changes in our practices, our services or Applicable Law.

The revised Privacy Notice takes effect from the date it is published on the Website unless stated otherwise. Where the change is material, we will use reasonable efforts to notify you by posting a prominent notice on the Website or, where appropriate, by electronic mail.

It is your responsibility to review this Privacy Notice periodically. Your continued use of the Website, or your continued provision of personal data to us, after the effective date of any amendment constitutes your acceptance of the amended Privacy Notice.

This Privacy Notice is prepared in English and Bahasa Malaysia. The English version shall prevail in the event of any inconsistency.

If you have any question, request or complaint concerning this Privacy Notice or our processing of your personal data, or if you wish to exercise any of your rights under Clause 13, please contact us at:

Yayasan GET Bhd. (Registration No. 202601038281 (1700376-U))

Attention: Data Protection Officer

Address: B2-5-11, Publika Solaris Dutamas, No. 1, Jalan Dutamas 1, 50480 Kuala Lumpur, Malaysia

Email: info@yayasanget.com

Telephone: +603-62117122