Privacy Policy

The data controller under this notice is Upstream BPO (MSC) Sdn Bhd (Company No 597426-H) and its subsidiaries (collectively, “Upstream BPO” or “the Company”).

Registered address: Q Sentral, Level 16-8 & 9, Jalan Stesen Sentral 2, Kuala Lumpur Sentral, 50470 Kuala Lumpur, Malaysia.

Data Protection Officer: Cillian Conor. Contact: dpo@upstreambpo.com.

Upstream BPO operates through subsidiaries and operating entities in multiple jurisdictions, including Malaysia, Uzbekistan and the Philippines. This notice governs processing carried out through the upstreambpo.com website globally, for all visitors, irrespective of the jurisdiction in which the visitor resides.

Upstream BPO collects personal data in three distinct contexts. The categories collected, and the purposes for which they are processed, differ by context.

A. Website visitors. Personal data provided voluntarily through forms, contact requests and subscriptions, together with data collected automatically on visiting the site, including IP address, browser and device characteristics, and data recorded through cookies.

B. Employment applications. Personal data provided by applicants in connection with a role, processed for the purposes of recruitment.

C. Service delivery to enterprise customers. Personal data processed on behalf of customer entities, in which Upstream BPO acts as processor under an executed Data Processing Agreement. The scope, purposes, retention periods and safeguards applicable to that personal data are governed by the Data Processing Agreement, which is the authoritative document for such processing.

The categories of personal data processed under this notice are as follows.

1. Contact information, including name, business email address, company name, job title, telephone number and country.

2. Employment application information, including education, employment history, and identification or passport details where required for a role.

3. Technical information, including IP address, device and browser characteristics, and session data.

4. Cookies and tracking data, as described in section 10.

5. Correspondence content, being the contents of messages sent to Upstream BPO through the website or through published contact addresses.

Sensitive personal data, including data concerning health, religious or political beliefs, or the commission or alleged commission of an offence, is collected only where a specific context expressly requires it, such as certain employment application contexts, and is collected on the basis of explicit consent.

Upstream BPO processes personal data on the following legal bases. Where more than one basis applies to a purpose, the applicable basis is determined by the circumstances of the processing.

1. Consent. Applies where a visitor actively provides consent, including subscription to marketing communications and the acceptance of non-essential cookies. Consent is withdrawable at any time.

2. Performance of a contract, or steps taken at the request of the data subject prior to entering a contract. Applies to responding to enterprise service enquiries and to the administration of a customer relationship.

3. Legitimate interests. Applies to website security monitoring, the prevention and investigation of misuse, and analytics carried out to maintain and improve the website. Processing on this basis is carried out only where the interests of the data subject do not override those legitimate interests.

4. Compliance with a legal obligation. Applies to the retention of records where required by law and to cooperation with lawful requests from competent authorities.

5. Recruitment. Employment application data is processed to assess and progress applications, to conduct background verification where applicable, and to communicate with applicants during the recruitment process.

Upstream BPO discloses personal data to third-party service providers engaged under written agreements. The categories of such providers are published on the Subprocessors page, and the vendor-level list is provided under non-disclosure agreement.

Upstream BPO will cooperate with lawful requests from regulatory, law enforcement or governmental authorities where the requesting party demonstrates a legal requirement for disclosure.

Upstream BPO does not sell personal data.

The website contains links to third-party websites. A visitor who follows such a link leaves upstreambpo.com, and the processing of personal data on the destination site is governed by that third party’s privacy notice rather than by this notice.

Subject to the law applicable to the visitor, the following rights are available. Visitors in the European Union and the United Kingdom hold the full set of rights below under the General Data Protection Regulation and the UK General Data Protection Regulation respectively.

1. The right of access to personal data held about the data subject.

2. The right to rectification of inaccurate or incomplete personal data.

3. The right to erasure of personal data where the grounds for erasure are met.

4. The right to restriction of processing.

5. The right to data portability, being receipt of personal data in a structured, commonly used and machine-readable format.

6. The right to object to processing carried out on the basis of legitimate interests.

7. The right to withdraw consent at any time, where processing is carried out on the basis of consent.

8. The right not to be subject to a decision based solely on automated processing which produces legal effects concerning the data subject or similarly significantly affects them.

9. The right to lodge a complaint with a supervisory authority, as set out in section 12.

Upstream BPO responds to a written request within 30 days of receipt. To exercise a right, submit a written request to the Data Protection Officer at dpo@upstreambpo.com, or by post to Q Sentral, Level 16-8 & 9, Jalan Stesen Sentral 2, Kuala Lumpur Sentral, 50470 Kuala Lumpur, Malaysia.

Personal data is retained only for as long as necessary to fulfil the purposes for which it was collected.

Employment application data is retained in accordance with the employment law requirements of the relevant jurisdiction. Customer personal data is retained in accordance with the applicable Data Processing Agreement. Website analytics data is retained for the periods stated in the Cookie Policy.

Personal data is securely deleted at the end of the applicable retention period.

Upstream BPO operates an information security management system certified to ISO/IEC 27001:2022.

Data in transit is protected by TLS 1.2 or later using the AES-256 cipher suite. Data at rest is encrypted with AES-256.

Access to systems processing personal data is governed by role-based access control with least-privilege enforcement, multi-factor authentication is mandatory for staff accessing production systems, and security events are monitored continuously. Confirmed security incidents are handled under a documented severity classification and notification process.

Upstream BPO operates across Malaysia, Uzbekistan, the Philippines and other jurisdictions. Personal data collected through the website may be processed at operational locations outside the jurisdiction in which the visitor resides.

Transfers of personal data out of the European Economic Area or the United Kingdom are governed by the EU Standard Contractual Clauses, 2021 module set, or by the UK International Data Transfer Agreement, as applicable to the transfer.

Transfers to which the Malaysian Personal Data Protection Act 2010 applies are governed by written safeguards in accordance with that Act.

All transfers are supported by technical and organisational measures appropriate to the personal data transferred.

A data subject may obtain details of the specific safeguards applicable to a transfer by written request to dpo@upstreambpo.com.

The website uses cookies for functionality, performance, analytics and, where consent is given, marketing. Consent is managed through the cookie consent banner presented on first visit.

Cookies fall into the following categories.

1. Strictly necessary cookies, which are required for the website to operate.

2. Functional cookies, which record preferences and settings.

3. Performance cookies, which measure how the website performs.

4. Analytics cookies, which record how visitors use the website.

5. Advertising cookies, which are set only where consent is given.

Retention periods for each category are stated in the cookie consent banner and in the Cookie Policy. A visitor may refuse or delete cookies through browser settings. Refusing cookies may affect the functionality of the website.

This notice may be revised from time to time. Revisions take effect on publication to this page.

Where a revision is material, Upstream BPO will give notice by prominent notice on this website. The effective date and the date of last revision are stated at the top of this page.

Data Protection Officer: Cillian Conor. Email: dpo@upstreambpo.com. Address: Q Sentral, Level 16-8 & 9, Jalan Stesen Sentral 2, Kuala Lumpur Sentral, 50470 Kuala Lumpur, Malaysia.

A data subject who is not satisfied with Upstream BPO’s response may lodge a complaint with the applicable supervisory authority.

1. Malaysia: the Personal Data Protection Commissioner.

2. United Kingdom: the Information Commissioner’s Office.

3. European Union: the national supervisory authority of the member state in which the data subject resides.

4. Other jurisdictions: the applicable local data protection authority.