PDPA / Malaysia Data Protection

The data user under this notice is Upstream BPO (MSC) Sdn Bhd (Company No 597426-H) and its subsidiaries (collectively, “Upstream BPO” or “the Company”).

Registered address: Q Sentral, Level 16-8 & 9, Jalan Stesen Sentral 2, Kuala Lumpur Sentral, 50470 Kuala Lumpur, Malaysia.

Data Protection Officer: Cillian Conor. Contact: dpo@upstreambpo.com.

Upstream BPO collects personal data in three distinct contexts. The categories collected, and the purposes for which they are processed, differ by context.

A. Website visitors. Information voluntarily provided through forms, contact requests and subscriptions. Information collected automatically, including IP address, browser type, operating system, referring pages and cookies. This data is processed to respond to enquiries, to maintain and improve the website, and for security monitoring.

B. Employment applications. Information provided by applicants, including name, contact details, education, employment history, identification or passport details where required, medical information where relevant to the role, and immigration information where relevant to the role. This data is processed to assess and progress employment applications, to conduct background verification, and to communicate with the applicant throughout the recruitment process.

C. Service delivery to enterprise customers. Personal data processed on behalf of customer entities, in which Upstream BPO acts as data processor under an executed Data Processing Agreement. The scope, purposes, retention periods and safeguards applicable to such personal data are governed by the applicable Data Processing Agreement, which is the authoritative document. This section acknowledges the processing role only.

Sensitive personal data is defined under the Personal Data Protection Act 2010 as any personal data consisting of information as to the physical or mental health or condition of a data subject, his political opinions, his religious beliefs or other beliefs of a similar nature, the commission or alleged commission by him of any offence.

Where Upstream BPO processes sensitive personal data, including medical information supplied in connection with an employment application, that processing is carried out in accordance with the requirements of the Act.

Website visitor data is processed to respond to enquiries, to maintain, secure and improve the website, and to monitor for misuse.

Employment application data is processed to assess and progress applications, to conduct background verification where applicable, and to communicate with applicants during recruitment.

Customer personal data is processed solely to deliver the contracted services, on the documented instructions of the customer, and in accordance with the applicable Data Processing Agreement.

Upstream BPO discloses personal data to third-party service providers engaged under written agreements. The categories of such providers are published on the Subprocessors page, and the vendor-level list is provided under non-disclosure agreement.

Upstream BPO will cooperate with lawful requests from regulatory, law enforcement or governmental authorities where the requesting party demonstrates a legal requirement for disclosure.

Upstream BPO does not sell personal data.

Under the Personal Data Protection Act 2010, a data subject holds the right of access to personal data held about them, the right to correct inaccurate personal data, the right to withdraw consent to processing, and the right to prevent processing for the purposes of direct marketing.

Upstream BPO responds to a written request within 30 days of receipt.

To exercise these rights, submit a written request to the Data Protection Officer at dpo@upstreambpo.com, or by post to Q Sentral, Level 16-8 & 9, Jalan Stesen Sentral 2, Kuala Lumpur Sentral, 50470 Kuala Lumpur, Malaysia.

Personal data is retained only for as long as necessary to fulfil the purposes for which it was collected.

Employment application data is retained in accordance with Malaysian employment law requirements. Customer personal data is retained in accordance with the applicable Data Processing Agreement. Website analytics data is retained for the periods stated in the Cookie Policy.

Personal data is securely destroyed at the end of the applicable retention period.

Upstream BPO operates an information security management system certified to ISO/IEC 27001:2022.

The control environment supporting this notice, including access control, multi-factor authentication, monitoring and personnel screening, is described on the Information Security page.

Personal data may be processed at operational locations outside Malaysia, including Uzbekistan, the Philippines and other jurisdictions in which Upstream BPO operates.

Cross-border transfers are governed by written safeguards in accordance with the Personal Data Protection Act 2010 and, where applicable, the EU Standard Contractual Clauses or the UK International Data Transfer Agreement. These instruments are described on the Data Processing Agreement page.

This website uses cookies. The categories in use, their purposes and the applicable retention periods are set out in the cookie consent banner presented on first visit and in the Cookie Policy.

This notice may be revised from time to time. Revisions take effect on publication to this page.

Where a revision is material, Upstream BPO will give notice by prominent notice on this website.

Data Protection Officer: Cillian Conor. Email: dpo@upstreambpo.com. Address: Q Sentral, Level 16-8 & 9, Jalan Stesen Sentral 2, Kuala Lumpur Sentral, 50470 Kuala Lumpur, Malaysia.

A data subject who is not satisfied with Upstream BPO’s response may refer the matter to the Personal Data Protection Commissioner of Malaysia.