Privacy Policy

At Fish Camp Learning Sdn Bhd (“Fish Camp Learning”, “FCL”, “we”, “us” or “our”), the trust our clients, participants and partners place in us matters as much as the programmes we design for them. This Privacy Policy explains, in plain language, what personal data we collect through www.fishcamp.com.my and in the course of delivering our leadership development, psychometric assessment, and talent management services, why we collect it, and the choices and rights you have over it.

This Policy is issued in accordance with the Personal Data Protection Act 2010 (“PDPA”), as amended by the Personal Data Protection (Amendment) Act 2024, and its subsidiary regulations and guidelines issued by the Personal Data Protection Department of Malaysia (“JPDP”). By visiting our website, engaging our services, or providing us with your personal data, you acknowledge that you have read and understood this Policy.

1. Who This Policy Covers

This Policy applies to:

• Visitors to www.fishcamp.com.my;
• Prospective, current and past corporate clients and their representatives;
• Individual participants in our workshops, coaching sessions, certification courses and public programmes;
• Respondents to our psychometric and behavioural assessments (e.g. EQ-i 2.0, Purposeful Leadership 360°, DISC, RIASEC, Work Values, Personality E.D.G.E.); and
• Associate trainers, facilitators, vendors and job applicants who interact with us.

2. Personal Data We Collect

2.1 Data you give us directly

• Identification and contact details – name, job title, company, email address, phone number, mailing address;
• Programme and engagement details – organisation, department, employee ID, dietary or accessibility requirements for in-person sessions;
• Assessment responses – your answers to psychometric questionnaires and related self-report information submitted through our assessment platforms or those of our licensors;
• Payment and billing information – invoicing details for corporate clients (we do not directly process credit card data on our website);
• Communications – correspondence you send us via email, our contact form, or social media.

2.2 Data collected automatically

• Usage data – IP address, browser type, device information, pages visited, and time spent on our website, collected via cookies and similar analytics technologies (see Section 8).

2.3 Data from third parties

• Where a corporate client nominates its employees for our programmes or assessments, we receive your name and contact details from your employer or its appointed coordinator;
• Assessment norm and scoring data from our certified assessment publishers and licensors (e.g. MHS for EQ-i 2.0, or other licensed instrument providers).

Special note on assessment data: Some of our instruments touch on personality, behavioural style, or emotional intelligence traits. This information is collected strictly for the purpose you or your organisation engaged us for – such as leadership development, coaching, or team building – and is never used to infer or record your race, religion, health status, or other special categories of personal data under the PDPA. We do not knowingly collect such special categories of personal data, and we ask that you do not include them in free-text responses or comments submitted to us.

3. How We Use Your Personal Data

We use your personal data only for the purposes we collected it, or for a directly related purpose. These include:

• Designing, delivering and administering training programmes, workshops, coaching engagements and assessments;
• Generating individual and group-level assessment reports for you and, where you are attending on behalf of an employer, for the sponsoring organisation;
• Managing certification courses and issuing certificates;
• Responding to enquiries and providing customer support;
• Sending you programme logistics, invoices, and service-related communications;
• With your consent, sending updates about our leadership development insights, webinars, or public programmes;
• Improving our website, services and programme content;
• Complying with our legal, accounting and regulatory obligations.

4. Our Legal Basis and Your Consent

Under the PDPA's General Principle, we only process your personal data where you have given consent, or where processing is necessary for the performance of a contract to which you are a party (such as your registration for a programme), necessary for compliance with a legal obligation, or necessary for our legitimate interests in operating our business – provided this does not override your fundamental rights.

Where you complete an assessment nominated by your employer, your employer is typically the party that has obtained the necessary consent from you for that specific purpose, and instructs us as the party administering the assessment on their behalf. If you have questions about the basis on which your data was shared with us, please contact your organisation's HR or L&D representative in the first instance, or reach out to us directly.

You may withdraw your consent to any processing that is based on consent at any time by contacting us using the details in Section 12. This will not affect the lawfulness of processing carried out before your withdrawal, and may affect our ability to continue providing certain services to you.

5. Disclosure of Your Personal Data

We do not sell your personal data. We only disclose personal data in the following circumstances:

• To the corporate client or organisation that engaged us, where the services (including assessment reports) were commissioned on your behalf;
• To licensed assessment publishers and platform providers whose instruments we use to score and generate your reports (e.g. MHS, Insights Discovery, or the Halo Feedback platform), strictly for scoring and report generation;
• To our associate trainers, coaches and facilitators directly involved in delivering your programme, on a need-to-know basis;
• To our service providers who support our operations, such as IT hosting, email and calendar platforms, and accounting services, under confidentiality obligations;
• Where required by law, regulation, court order, or a lawful request from a Malaysian regulatory authority.

Any third party who processes personal data on our behalf is required to protect it to a standard consistent with this Policy and the PDPA.

6. Cross-Border Transfer of Personal Data

Some of the assessment platforms and cloud tools we use (for example, international assessment publishers, learning management systems, or our edX partnership infrastructure) may store or process data outside Malaysia. Where we transfer your personal data outside Malaysia, we take reasonable steps to ensure the recipient country or organisation provides a standard of protection that is comparable to the PDPA, or that another basis recognised under the PDPA applies (such as your consent, or the transfer being necessary for performance of a contract with you).

7. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes described in this Policy, or as required by applicable law (such as the Companies Act 2016 for financial records, generally seven years). Assessment results and reports are typically retained for the duration of our engagement with your organisation and a reasonable period thereafter, after which they are securely deleted or anonymised.

8. Cookies and Website Usage Data

Our website may use cookies and similar technologies to remember your preferences, understand how visitors use our site, and improve our content. You can control or disable cookies through your browser settings; please note that some parts of our website may not function properly if cookies are disabled.

9. Data Security

We maintain appropriate technical and organisational measures to protect the personal data we hold from accidental loss, unauthorised access, alteration or disclosure, in line with the PDPA's Security Principle. This includes restricting access to personal data on a need-to-know basis, using secure platforms for assessment administration, and reviewing our practices periodically. No method of transmission over the internet is completely secure, and we cannot guarantee absolute security, but we take this responsibility seriously.

10. Your Rights as a Data Subject

Under the PDPA, you have the right to:

• Access the personal data we hold about you;
• Request correction of personal data that is inaccurate, incomplete, or outdated;
• Withdraw your consent to our processing of your personal data, where consent is the basis for that processing;
• Request that we limit the processing of your personal data in certain circumstances;
• Request the transfer of your personal data to another data controller, where technically feasible, in accordance with the right to data portability introduced by the 2024 amendments to the PDPA; and
• Lodge a complaint with the Personal Data Protection Department of Malaysia (JPDP) if you believe we have not handled your personal data in accordance with the PDPA.

To exercise any of these rights, please contact us using the details in Section 12. We may need to verify your identity before acting on your request, and we will respond within the timeframe required under the PDPA.

11. Children's Data

Our services are directed at working professionals and organisations. We do not knowingly collect personal data from children under the age of 18. If you believe a child has provided us with personal data, please contact us so we can remove it.

12. Data Protection Officer and How to Reach Us

In line with the Data Protection Officer requirements introduced by the Personal Data Protection (Amendment) Act 2024, we have appointed a Data Protection Officer responsible for overseeing our compliance with the PDPA. If you have any questions, requests, or concerns about this Policy or how we handle your personal data, please contact:

Data Protection Officer, Fish Camp Learning Sdn Bhd
Email: [DPO email – e.g. privacy@fishcamp.com.my]
Address: Lot 231, Second Floor, The Curve, No. 6 Jalan PJU 7/3, Mutiara Damansara, 47810 Petaling Jaya, Selangor, Malaysia
Phone: 03-7660 7730 / 03-7660 7736

We would appreciate the opportunity to address your concerns directly before you approach the Personal Data Protection Department of Malaysia, though you always retain the right to do so.

13. Data Breach Notification

In the event of a personal data breach that is likely to result in significant harm to affected individuals, we will notify the Personal Data Protection Commissioner and affected data subjects in accordance with the data breach notification requirements under the PDPA, without undue delay.

14. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices, our services, or Malaysian law. The updated version will be posted on this page with a revised effective date. We encourage you to review this Policy periodically.

15. Governing Law

This Policy is governed by the laws of Malaysia, including the Personal Data Protection Act 2010 and its amendments.

Fish Camp Learning Sdn Bhd (797816-A) · connect@fishcamp.com.my · www.fishcamp.com.my