PDPA Notice

Personal Data Protection Act 2010 (Malaysia)

1. Data Controller

Company	SkillTrainer AI Sdn Bhd
Registration No.	202601008220 (1670318-M)
Address	No. 17A Jalan Daya 6, Taman Daya, 52100 Kepong, W.P. Kuala Lumpur
Contact	hello@skilltrainer.ai

2. What Personal Data We Collect

We may collect and process the following categories of Personal Data:

• Identity data: full name, username, and profile information;
• Contact data: email address and telephone number;
• Account data: login credentials and account preferences;
• Payment data: billing details (processed via authorised payment processors — we do not store card numbers);
• User inputs: prompts, queries, and content submitted through the Platform;
• Device data: IP address, browser type, operating system, and device identifiers;
• Usage data: pages visited, features accessed, session duration, and interaction logs.

3. Purpose of Processing

Your Personal Data is processed for the following purposes:

• Operating and maintaining your account and the Platform;
• Sending service updates, security alerts, and support messages;
• Improving AI models using anonymised, aggregated data only;
• Meeting legal, regulatory, audit, and enforcement obligations;
• Analysing usage patterns to improve the Platform (anonymised);
• Sending promotional content where you have opted in.

4. Consent

By registering for and using the Platform, you consent to the collection, use, and processing of your Personal Data as described in this notice and our Privacy Policy.

You may withdraw your consent at any time by contacting us at hello@skilltrainer.ai. Please note that withdrawal of consent may affect your ability to use certain features of the Platform. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

5. Your Rights Under the PDPA

You have the following rights under the PDPA:

Right of Access	Request a copy of the Personal Data we hold about you (s.30 PDPA).
Right of Correction	Request correction of any inaccurate or incomplete Personal Data (s.34 PDPA).
Right to Withdraw Consent	Withdraw consent to processing at any time.
Right to Limit Processing	Request that we cease processing your data for direct marketing purposes (s.43 PDPA).
Right to Complain	Lodge a complaint with the Department of Personal Data Protection (JPDP) Malaysia.

To exercise any of these rights, submit a written request to hello@skilltrainer.ai. We will respond within 21 working days. Proof of identity may be required.

6. Disclosure and Cross-Border Transfers

We may share your Personal Data with trusted third-party service providers (cloud hosting, analytics, payment processors) who are contractually bound to protect your data. We do not sell, rent, or trade your Personal Data.

Where data is transferred outside Malaysia, we ensure compliance with Section 129 of the PDPA through contractual safeguards or your informed consent.

7. Data Security and Retention

We implement appropriate technical and organisational measures to protect your Personal Data, including encryption (TLS/SSL, AES-256), access controls, and regular security assessments.

Personal Data is retained only as long as necessary for the purposes stated, or as required by law. Upon expiry, data is securely deleted or irreversibly anonymised.

8. Data Breach Notification

In the event of a Personal Data breach, we will:

• notify the Department of Personal Data Protection (JPDP) within 72 hours where feasible;
• notify affected individuals directly where the breach poses a high risk to their rights;
• maintain an internal breach register documenting all incidents.

9. Contact and Complaints

If you are unsatisfied with our response, you may escalate your complaint to the Department of Personal Data Protection (JPDP) Malaysia at www.pdp.gov.my.