Data protection officer
Cillian Conor
Trust Centre
Security & Trust Contact
Upstream BPO operates a single trust inbox at dpo@upstreambpo.com, reaching our data protection officer Cillian Conor. We acknowledge security and trust enquiries within 3 business days.
Key information
At-a-glance governance context
These points summarise the public scope of this page and the main contact or review context around it.
Trust inbox
dpo@upstreambpo.com
Acknowledgement
Within 3 business days
Registered correspondence
Q Sentral, Kuala Lumpur Sentral, Malaysia
Section 1
One inbox for security and trust requests
Upstream BPO routes security and trust requests to a single address, dpo@upstreambpo.com, rather than splitting them across several. A reviewer needs one address that reaches an accountable owner, and our data protection officer Cillian Conor owns that inbox.
The inbox covers the following request types. Use a subject line that names the request so that it reaches the right reviewer on the first pass.
- Data Processing Agreement (DPA) requests
- Subprocessor list requests under NDA
- ISO/IEC 27001:2022 certificate and Statement of Applicability requests
- Security incident reports
- Vulnerability disclosures under our disclosure programme
- Whistleblowing reports
Section 2
Response commitment
We acknowledge security and trust enquiries within 3 business days of receipt. The acknowledgement confirms receipt, names the person handling the request and states what happens next.
Vulnerability reports carry their own acknowledgement window of 5 business days under the disclosure programme. Confirmed security incidents reach 24/7 on-call coverage and are not held to an acknowledgement window.
Section 3
Formal correspondence
Formal correspondence, including legal and regulatory notices, is sent to our registered address:
Upstream BPO Sdn. Bhd., Q Sentral, Level 16-8 & 9, Jalan Stesen Sentral 2, Kuala Lumpur Sentral, 50470 Kuala Lumpur, Malaysia.
This is also the certified location named on our ISO/IEC 27001:2022 certificate.
Section 4
Whistleblowing
Upstream BPO accepts whistleblowing reports at dpo@upstreambpo.com. We are building a dedicated whistleblowing form that accepts reports without requiring the reporter to send email from an identifiable address. Until that form is live, dpo@upstreambpo.com is the reporting channel.
We treat whistleblowing reports as confidential and route them to management review.
Related resources
Related governance and service pages
Use the connected pages below for deeper privacy, governance, service or contact context.
Contact & Escalation
dpo@upstreambpo.com reaches our data protection officer Cillian Conor. We acknowledge security and trust enquiries within 3 business days.
Next Step
Need a deeper governance review?
Send certificate requests, subprocessor list requests, incident reports and vulnerability disclosures to dpo@upstreambpo.com. We acknowledge security and trust enquiries within 3 business days.