Matrix HSE

Privacy Notice

Personal Data Protection Notice

Last modified on 1 September 2026

This Privacy Notice (“Notice”) describes how Matrix HSE Resources Sdn. Bhd., Matrix Quantum Sdn. Bhd. and Matrix Synergy Engineering Sdn. Bhd. (collectively, “Matrix”, “we”, “us” or “our”) collect, record, hold, store, use, disclose, transfer and otherwise process your Personal Data in accordance with the Personal Data Protection Act 2010 [Act 709], as amended from time to time, including the Personal Data Protection (Amendment) Act 2024 [Act A1727] (“PDPA”).

This Notice applies when you use our websites, registration forms, training programmes, examinations, occupational safety and health consultancy services, workplace assessments, inspections, monitoring activities, occupational hygiene services, surveys, interviews and related communications (collectively, the “Services”).

This Notice applies to participants, candidates, Persons in Charge (“PIC”), company representatives, employees of client organisations, vendors, partners, contractors and other individuals whose Personal Data we process in connection with the Services (collectively “you”, “your” or “yours”).

The data controller responsible for a particular Service will ordinarily be the Matrix entity identified on the applicable registration form, quotation, invoice, agreement or other document. In certain circumstances, more than one Matrix entity may process Personal Data where reasonably necessary to provide the relevant Service. Where one Matrix entity processes Personal Data solely on behalf of another, that entity may act as a data processor rather than a data controller, as distinguished under the PDPA.

1. Definition and examples of Personal Data

“Personal Data” means any information in respect of commercial transactions that relates directly or indirectly to a data subject who is identified or identifiable from that information, or from that information and other information in our possession, including any Sensitive Personal Data and any expression of opinion about the data subject.

Examples of Personal Data we may collect

• Full name (as in IC / passport)
• MyKad / NRIC or passport number
• Contact information: telephone number and email address
• Company or organisation name and address
• Person in Charge (PIC) name, phone, email, department and position
• Employment and professional information (for example, job title, Matrix ex-student or member status, qualification, batch number)
• Examination demographics where requested on the form (gender, race, new or repeat candidate, paper selection)
• Payment method (online transfer, HRD Corp claimable, company or personal) and, where uploaded, a payment slip or receipt
• How you heard about us
• Passport-format photograph or other identification photograph
• Copies of identity, academic, professional or employment documents
• For occupational safety and health consultancy and workplace assessments (including Noise Risk Assessment, Ergonomic Risk Assessment, Local Exhaust Ventilation inspection, Chemical Health Risk Assessment and occupational hygiene work): employee names, job titles, workstation photographs or videos, descriptions of work activities, personal noise-monitoring data, ergonomic assessment observations, exposure information, survey or interview responses, and similar workplace information

A normal passport-format or identification photograph is ordinary Personal Data, not biometric data: we do not use facial recognition, fingerprinting or voice recognition. We do not collect credit or debit card numbers, or your bank account number, through our registration forms. Where a payment slip is uploaded, it may incidentally show transaction details printed on that slip.

2. Collection of Personal Data

We collect Personal Data about you in the ways listed below. We may combine it with other Personal Data already in our possession, including previous course, examination or consultancy records.

(a) When you provide Personal Data to us

We collect your Personal Data when you voluntarily provide it, including when you:

• complete a training, CEP, in-house or examination registration form;
• submit an in-house training enquiry;
• upload supporting documents or a passport-format or identification photograph;
• upload a payment slip (where the form asks for one);
• participate in a workplace assessment, inspection, survey, interview or occupational hygiene monitoring;
• correspond with us by email, telephone, WhatsApp or other channels; or
• ask for a quotation, invoice or HRD Corp claim support.

(b) When our Services are used

Personal Data may also be collected through the normal operation of our websites and forms, for example:

• session and batch selection, remaining seats and registration timestamps;
• security tokens (such as CSRF tokens) and reCAPTCHA verification;
• device and usage information such as IP address, browser type, pages viewed (including Services, Contact, training and other website pages) and referring website, recorded only for website visit tracking (to see which pages are visited and to improve the website). That visit log is not used by us to serve Facebook or Instagram ads; and
• records of confirmation emails and administrative correspondence.

(c) From other sources

Where we collect Personal Data from other sources, we take steps so that the collection and transfer comply with applicable law. Such sources may include:

• your employer, PIC or client organisation, if they register you for a course or examination or engage us for a workplace assessment;
• HRD Corp, DOSH / JKKP, MQA, BEM or other regulators or certification bodies, where relevant to eligibility, claims or statutory assessments;
• payment providers or banks, to match a transfer to a registration;
• advertising platforms we use to promote our training, including Facebook and Instagram (Meta); and
• publicly available or governmental sources where permitted by law.

(d) Personal Data of minors

Our training and examination Services are primarily intended for adults. Where Personal Data relating to a minor is required, it should be provided by or with the appropriate authorisation of the minor’s parent or legal guardian. Where required by applicable law, we will obtain appropriate consent before processing such Personal Data.

(e) When you provide Personal Data of other individuals

A PIC, company representative or client may submit Personal Data of participants or employees (name, IC/passport, phone, email, photograph, supporting documents, or workplace assessment information). If you provide us with another person’s Personal Data, you represent and warrant that you have obtained their consent, or that you are otherwise lawfully entitled, for that data to be collected, used and disclosed as set out in this Notice, and that you will inform them of this Notice.

3. Provision of Personal Data

Where Personal Data is marked as mandatory on a registration, examination, enquiry or other form, the information is required for us to process the relevant service.

If you do not provide the required Personal Data, we may be unable to process your registration, verify your eligibility, issue a quotation or invoice, process an HRD Corp claim, register you for an examination, issue a certificate, carry out an occupational safety and health assessment, or otherwise provide the requested Service.

Information identified as optional may be provided voluntarily. Failure to provide optional information will generally not prevent us from providing the Service unless that information later becomes necessary for a particular purpose.

4. Use of Personal Data

We may use, combine and process your Personal Data only for the following purposes (“Purposes”).

(a) Providing services

• process course, CEP, in-house and examination registrations;
• administer sessions, batches, venues and remaining seats;
• verify identity and eligibility (including DOSH / JKKP, MQA, BEM and academic requirements);
• issue quotations, invoices and confirmation emails;
• support HRD Corp claimable registrations and related grant documentation;
• deliver training or examinations and issue certificates or attendance records;
• match online transfers to registrations using payment method and, where provided, payment slips;
• perform occupational safety and health consultancy, workplace assessments, inspections, monitoring, occupational hygiene services, surveys and interviews (including NRA, ERA, LEV, CHRA and related work); and
• perform internal operations such as troubleshooting, data analysis, testing and improving our forms and Services.

(b) Safety and security

• protect the security and integrity of our websites, forms and stored files;
• prevent, detect and address fraud, spam or unauthorised access (including through reCAPTCHA); and
• monitor compliance with our Terms and Conditions.

(c) Customer support

• respond to questions, comments and feedback;
• investigate and address registration, payment, attendance or assessment issues; and
• inform you of steps taken to resolve a request.

(d) Research, administration and legal purposes

We may use Personal Data for testing, analysis, record-keeping, tax and audit, and to investigate or resolve claims or disputes, or as allowed or required by law. We may also use Personal Data when required, advised or requested by our legal advisors or any legal, regulatory or governmental authority — for example to comply with a court order, enforce our terms, or protect our rights or property.

We may use Personal Data in connection with a merger, acquisition, joint venture, sale of assets, restructuring or similar business transaction.

(e) Marketing and communications

We may use your contact details to send course updates, quotations, invoices, reminders and, where relevant, information about related training, examinations or consultancy services. We may also record how you heard about us (including Facebook or Instagram).

We promote our training and related Services using Facebook Ads and Instagram Ads (Meta). If you view, click or interact with those advertisements, or with Facebook or Instagram content on our websites, Meta may collect and process information about you in accordance with Meta’s privacy policy. We may use Meta’s advertising tools to show relevant training ads, measure campaign performance and, where permitted, reach people who may be interested in our courses. Our own website visit log (including IP address) is not used to serve those ads.

If you do not wish to receive promotional messages from us, you may request that we cease processing your Personal Data for direct marketing using the contact details in section 11 or by replying to the relevant email. You may also manage Facebook and Instagram ad preferences in your Meta account settings. Transactional messages about a registration or engagement you submitted (such as confirmations and payment instructions) may still be sent.

5. Disclosure of Personal Data

We share Personal Data with parties who need it for the Purposes. We do not sell your Personal Data. These parties may include:

(a) Matrix entities

We may share Personal Data among Matrix HSE Resources Sdn. Bhd., Matrix Quantum Sdn. Bhd. and Matrix Synergy Engineering Sdn. Bhd. so that the correct entity can provide the Service, issue invoices, or hold the relevant bank account. One entity may act as a data processor for another where it processes Personal Data solely on that other’s behalf.

(b) Regulators, certification and grant bodies

Where required for eligibility, examination, certification, funding or statutory assessment, we may share relevant Personal Data with DOSH / JKKP, MQA, BEM, HRD Corp and similar authorities or scheme administrators.

(c) Service providers

We may provide Personal Data to vendors who support our Services, including website hosting, email delivery, cloud storage, IT support, payment matching, professional advisors, and advertising platforms. They may process Personal Data only as needed to perform their services for us, and we require appropriate confidentiality, security and data-protection measures.

This includes Meta Platforms, Inc. and its affiliates (Facebook and Instagram) for training promotion, advertisement delivery and campaign measurement, subject to Meta’s terms and privacy policy. Meta may process such information outside Malaysia.

(d) Your organisation

If you are registered by an employer or PIC, or if your employer engages us for a workplace assessment, we may share confirmation, quotation, invoice, attendance or assessment information with that organisation.

(e) Legal advisors and government authorities

We may share Personal Data with our legal advisors, law enforcement and government authorities where required or permitted by law.

6. Retention, deletion and disposal of Personal Data

We retain Personal Data for as long as necessary to fulfil the Purposes, including training and examination records, certification, consultancy and assessment records, HRD Corp and DOSH / JKKP compliance, tax and accounting, unless a longer period is required or permitted by law. Personal Data that is no longer required will be securely deleted, disposed of or anonymised in accordance with our procedures.

7. Security of Personal Data

We take reasonable and practicable administrative, organisational and technical measures to protect Personal Data against loss, misuse, modification, unauthorised or accidental access or disclosure, alteration or destruction.

Access to Personal Data is restricted to authorised personnel and service providers who require access for legitimate business purposes. Where third-party service providers process Personal Data on our behalf, we require appropriate confidentiality, security and data-protection measures to be implemented.

8. Transfer of Personal Data outside Malaysia

Your Personal Data is primarily processed in Malaysia. However, certain service providers, including cloud hosting, email, information technology, communications or other technology providers, may process or store Personal Data outside Malaysia.

Where Personal Data is transferred outside Malaysia, we will take reasonable steps to ensure that the transfer is made in accordance with section 129 of the PDPA and applicable guidelines issued by the Personal Data Protection Commissioner, including by ensuring that the applicable legal requirements or permitted conditions for the transfer are satisfied.

Where required by law, appropriate safeguards and/or consent will be obtained before such transfer.

9. Personal Data breach

In the event of a Personal Data breach, we will assess, investigate and manage the incident in accordance with the PDPA and applicable guidelines. Where required by law, we will notify the Personal Data Protection Commissioner and/or affected data subjects within the applicable timeframe.

10. Cookies and website usage

This section applies to all pages of our websites, including the Services page, Contact page, training and examination pages, registration forms and related pages.

When you visit our websites, we record limited technical information such as your IP address, browser type, pages viewed, date and time of visit, and referring website. Your IP address in our own visit log is collected only for website visit tracking — so we can see which pages are visited (including Services pages such as NRA, CHRA, LEV, ERA, CIMAH and related consultancy pages) and improve the website. That log is not used by us to serve targeted advertising.

Separately, we use Facebook Ads and Instagram Ads (Meta) to promote our training. Meta, and not our visit log, may use cookies, pixels, advertising identifiers and similar technology when you see or click our ads on Facebook or Instagram, or when Facebook content is shown on our websites. That processing is subject to Meta’s privacy policy.

We, and third parties we work with, may also use cookies, similar storage and related technology (“Cookies”). Cookies may reside on your computer or device. We use Cookies and similar technology for the following purposes:

• Strictly necessary: to operate the website and registration forms, including security tokens (such as CSRF protection) and session integrity;
• Security: Google reCAPTCHA on registration and enquiry forms, which may set its own Cookies subject to Google’s policies;
• Functionality: to load website fonts and display pages correctly (for example Google Fonts);
• Usage: to understand how our websites are used, as described above; and
• Advertising: Facebook and Instagram (Meta) cookies or similar tools in connection with our training advertisements and any Facebook content embedded on our websites.

Third-party services (such as Google reCAPTCHA, Google Fonts and Meta) may set Cookies that we do not necessarily access or control. You can manage Facebook and Instagram ad settings in your Meta account, and you may disable, block or delete Cookies in your internet browser settings. Strictly necessary Cookies and security checks on our forms may not work correctly if Cookies are blocked.

11. Rights of data subjects

Subject to the PDPA and applicable exceptions, you may:

• request access to Personal Data held about you;
• request correction of Personal Data that is inaccurate, incomplete, misleading or not up to date;
• withdraw consent previously given for the processing of Personal Data, subject to applicable legal and contractual requirements and consequences;
• request that we cease or not commence processing your Personal Data for direct marketing purposes;
• request the transmission of your Personal Data to another data controller in accordance with the data portability provisions of the PDPA, subject to technical feasibility, compatibility of the data format and other applicable requirements; and
• make enquiries or complaints concerning our processing of your Personal Data.

To exercise these rights, or if you have any queries about this Notice, please contact our Data Protection Officer:

We may need to verify your identity before we can act on a request. We will use reasonable efforts to respond to a request for access or correction within twenty-one (21) days of receiving a complete request, or such other period as the PDPA may allow. We may withhold access or correction in limited situations permitted by law (for example where we cannot confirm your identity, or where the information is of a confidential commercial nature). Where continued retention is required by law or for the Purposes, we may not be able to delete Personal Data even if you withdraw consent for other processing.

12. Language

This Privacy Notice is available in both Bahasa Malaysia and English in accordance with the Personal Data Protection Act 2010. Both versions are intended to convey the same meaning. In the event of any inconsistency, this Privacy Notice shall be interpreted in accordance with the applicable laws of Malaysia.

13. Amendments

We may amend this Privacy Notice from time to time to reflect changes to our practices, Services or applicable legal requirements. The updated version will be published on our website together with the revised “Last modified” date.

Where a material change affects the manner in which we process your Personal Data, we will provide additional notice and/or obtain consent where required by applicable law.

Registration and use of our Services are also subject to our Terms and Conditions.

Bahasa Malaysia Terms and Conditions Contact us