Privacy Policy

1. Introduction

Tunjang Jaya Graftek Sdn Bhd (“we”, “us”, or “our”) is committed to protecting and respecting your privacy. This Privacy Policy sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us. Please read it carefully to understand our views and practices regarding your personal data and how we will treat it.

It applies to the Proficia360 marketing website (https://www.proficia360.com), the Proficia360 platform, and enquiries sent to the Proficia360 team. Where our corporate website https://www.tunjangjaya.com is involved, our corporate privacy notice also applies.

Two roles matter here. For data about the individuals who sign up for or administer Proficia360, and for data collected through this website, we are the data user (controller) under the PDPA. For employee, position, and assessment data that an institution uploads to its own workspace, the institution is the data user and we process that data on its instructions as its service provider.

2. Information We Collect

3. How We Use Your Information

• Provide, operate, maintain, and secure the Proficia360 service.
• Configure your institution’s workspace, including hierarchy, roles, skills, and assessment templates.
• Calculate proficiency levels, coverage, capability gaps, and dashboard results for your organisation.
• Authenticate users and apply the access rights your administrators set.
• Respond to enquiries, provide support, and send service or billing notices.
• Improve the platform based on aggregated usage patterns and feedback.
• Comply with legal obligations under the Personal Data Protection Act 2010 (Malaysia) and other applicable law.

4. Legal Basis for Processing

We process personal data on the basis of your consent (given when you register, provide data, or contact us), the performance of a contract (providing the Service your organisation has ordered), our legitimate interests (operating, securing, and improving the platform), and compliance with legal obligations.

For workforce data inside an institution’s workspace, the institution is responsible for having a lawful basis — such as employee consent or a legitimate employment purpose — and for telling its people how their data is used. We process that data on the institution’s instructions.

5. Data Sharing and Disclosure

We do not sell, trade, or rent personal data to third parties. We may share data only with:

• Service providers: hosting, database, email delivery, and payment processing partners who process data on our behalf under confidentiality and data protection obligations.
• Your own organisation: people your administrators provision can see the workforce and assessment data their role permits, as configured in your workspace.
• Professional advisers: auditors, lawyers, and accountants, where necessary to protect our rights or complete a transaction.
• Legal and regulatory requirements: where disclosure is required by law, a court, or a competent Malaysian authority.
• Corporate transactions: if we reorganise or are acquired, personal data may transfer as part of that deal, and we will require the buyer to honour this policy.

6. Data Retention

• Account and administrator data: kept while the account is active, and for a short period afterwards to resolve billing or dispute matters.
• Workforce and assessment data in a workspace: retained for the duration of the institution’s subscription.
• After expiry or termination: an institution may request an export of its data within 30 days. After that window we delete or anonymise the data, except where we must keep it to comply with law, accounting obligations, or a signed agreement.
• Enquiry emails: retained for as long as needed to answer them and to keep a support history, then deleted on request.
• Backups: copies roll over on a scheduled basis, so deleted data disappears from backup within that cycle.

7. Data Security

We implement technical and organisational measures appropriate to the sensitivity of the data we handle, including:

• TLS (HTTPS) for traffic to this website and the platform.
• Authenticated API access using signed session tokens rather than shared or plain-text credentials.
• Workspace isolation, so one institution’s data is not reachable from another institution’s session.
• Role-based access control inside each workspace, managed by your own administrators.
• Least-privilege internal access: only the small number of people who must operate the platform can reach production data, and access is logged.
• Dependency and infrastructure updates applied on a regular maintenance cycle.

No method of transmission or storage over the internet is 100% secure. While we strive to use commercially acceptable means to protect your personal data, we cannot guarantee absolute security.

If you believe an account in your workspace has been compromised, tell us immediately at the address in Section 14 so we can disable sessions and contain the issue.

8. Where We Store Data

Proficia360 infrastructure is operated from Malaysia. Where a sub-processor transfers personal data outside Malaysia, we require protections substantially similar to those in this policy, and we make that transfer only where section 12 of the PDPA permits it or the data subject has consented.

9. Cookies and Local Storage

This marketing website sets no advertising, tracking, or analytics cookies.

When you sign in to the platform, a session cookie is used to keep you authenticated. When you toggle light or dark mode, a display preference is stored locally in your browser.

You can clear cookies and site data in your browser at any time. Clearing the session cookie simply signs you out.

10. Your Rights

Under the Personal Data Protection Act 2010 (Malaysia) and applicable law, you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Request erasure of your personal data, subject to our legal and contractual obligations.
• Withdraw consent for processing, at which point we may no longer be able to provide the service.
• Ask how your data has been used and to whom it was disclosed.
• Lodge a complaint with the relevant authority.

11. Sensitive Data and Who the Service Is For

Proficia360 is built for workplace skills and talent management. It is intended for use by organisations and adults in an employment relationship with them; it is not directed at children.

Do not upload sensitive personal data as defined by the PDPA — such as health, medical, religious, or biometric information — or data about criminal convictions or disciplinary allegations. Skills and proficiency data should stay relevant and proportionate to the stated purpose.

12. Third-Party Links

This website links to our corporate site and to partner or framework references. We are not responsible for the privacy practices of third-party websites; please read their policies before submitting information to them.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes are posted on this page with an updated revision date, and material changes are notified to workspace administrators by email. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

If we become aware of a breach of personal data under our control that poses a risk to individuals, we will notify the affected institution and the relevant authority without undue delay, and tell you what we are doing to contain and remedy it.

14. Contact Us

Questions about this policy, or a request to exercise your rights, should be sent to:

• Tunjang Jaya Graftek Sdn Bhd
• Registration No: 201901031566 (1340896-U)
• Data protection and privacy enquiries: proficia360@tunjangjaya.com
• Corporate website: https://www.tunjangjaya.com