Privacy Notice

1.About this Notice

1. 1.1

   TIMS Sdn Bhd (TIMS, we, us or our) operates the TIMS training marketplace and management platform, including tims.com.my, its web applications and the TIMS NFC Digital Profile Card (the Platform). For the purposes of the PDPA, TIMS is the data user for the personal data described in this Notice.

2. 1.2

   If you use TIMS through your employer, your employer is also a data user for the employee data it manages on the Platform, and processes it under its own privacy notice. For that data, we act on your employer's instructions under our Data Processing Agreement.

3. 1.3

   Training Providers receive your details when you enrol in their Training and use them to deliver that Training, under their own privacy practices.

4. 1.4

   This Notice should be read with our Terms of Use.

2.Personal data we collect

Depending on how you use TIMS, we collect:

Identity and contact

Name, email address, phone number, profile photo, and for some features your IC or passport number.

Account and login

Password (stored only as a secure hash), sign-in sessions, email verification and account settings such as language and time zone.

Profile and career

Job title, skills, education, work history, CV details and the public profile information you choose to show.

Organisation records

If your employer uses TIMS: your employee number, department, role, manager, approval history and training budget assignments.

Training records

Enrolments, sessions, attendance, assessment results, certificates, ratings and reviews.

Assessment data

Your responses to PRISM and other TIMS assessments, the scores calculated from them and the narratives generated.

Emergency (SOS) profile

If you turn it on: blood type, allergies, medical conditions, medication, notes, emergency contacts and insurance details.

Payments

Amounts, receipt numbers, tax details and the payment gateway's reference. Card details are entered on the payment gateway's page; we do not store your full card number.

Enrolment forms

Answers you give on a Training Provider's additional-information form, which may include identification, date of birth, emergency contacts and uploaded documents.

Candidate data

If an employer uses our hiring tools: CVs, candidate assessment responses and interview notes that the employer uploads or records.

Communications

Support tickets, enquiries, quotation messages and other messages you send through the Platform.

Technical data

IP address, device and browser type, pages visited, error logs and cookies (see section 13).

3.How we collect it

1. (a)From you, when you register, complete your profile, enrol, take an assessment, fill in a form or contact us.
2. (b)From your organisation, when it invites you, approves your membership or assigns you training.
3. (c)From Training Providers, when they record your attendance, results or certificates.
4. (d)Automatically, through cookies and server logs when you use the Platform.
5. (e)From our service providers, such as payment gateways confirming a payment.

4.Why we use your personal data

We process your personal data to:

1. (a)create and manage your Account and verify your identity;
2. (b)let you discover, enrol in, attend and complete Training, and let Training Providers deliver it;
3. (c)process payments, refunds and receipts;
4. (d)issue certificates and let others verify them;
5. (e)run assessments such as PRISM, produce your results and, where you consent, share them with your organisation;
6. (f)enable organisations to manage employee training, approvals, budgets and reports;
7. (g)provide your Digital Profile Card and, if you turn it on, your SOS emergency profile;
8. (h)send service messages, such as verification emails, enrolment updates and reminders;
9. (i)respond to enquiries and support requests;
10. (j)keep the Platform secure, prevent fraud and misuse, and investigate incidents;
11. (k)improve the Platform using analysis of how it is used; and
12. (l)comply with our legal obligations, including tax and HRD Corp audit requirements.

5.Sensitive personal data

1. 5.1

   Information about your physical or mental health is sensitive personal data under the PDPA. We process the health details in your SOS emergency profile only with your explicit consent, which you give when you turn the profile on.

2. 5.2

   When your SOS profile is on, those emergency details are shown to anyone who scans your NFC card, so that first responders can help you. Your insurance details stay private.

3. 5.3

   You can withdraw your consent at any time by turning the SOS profile off in Settings. The details then stop being shown immediately.

6.Information you must give, and what is optional

1. 6.1

   Your name, email address and a password are required to create an Account. Enrolment, payment and certificate details are required to enrol in and complete Training. A Training Provider may mark some questions on its enrolment form as required.

2. 6.2

   Everything else is optional, including your profile photo, career profile, SOS profile and PRISM assessment.

3. 6.3

   If you do not give required information, we may be unable to create your Account, complete an enrolment or issue a certificate. Leaving optional information out only limits the related features.

7.Who we share it with

We share personal data only as needed for the purposes above:

1. (a)Your organisation, for your training records, approvals and attendance, and for PRISM results only as far as you choose to share them.
2. (b)Training Providers, for the Training you enrol in: your enrolment details, form answers, attendance and results.
3. (c)The public, only what you choose: your public profile, verified certificates, and your SOS profile if you turn it on.
4. (d)Service providers who process data for us under contract, listed in section 8.
5. (e)Payment gateways and banks, to process payments and refunds.
6. (f)Authorities, such as HRD Corp, the Inland Revenue Board (LHDN) or law enforcement, when the law requires it.
7. (g)Professional advisers and successors, such as auditors and lawyers, or a buyer of our business, under confidentiality obligations.

8.Service providers

We use these service providers for specific technical functions. Each is bound by a data processing agreement.

• Cloud storage and AIFile storage (course materials, banners, profile photos, documents) and AI text and image generationSingapore
• Email deliveryService emails (verification, password reset, notifications, quotations)Malaysia / EU
• Database hostingPrimary database, on our own managed serverSingapore
• Network securitySecure connections (TLS), traffic routing and protection against attacksGlobal network

9.Transfers outside Malaysia

1. 9.1

   Our primary hosting is in Singapore, and backups are kept with our cloud storage provider in Singapore. Some service providers may process data in other countries, as listed in section 8.

2. 9.2

   We transfer personal data outside Malaysia only as the PDPA permits, including where you have consented, where the transfer is needed to provide the services you asked for, or where the receiving country gives a comparable level of protection. We use data processing agreements with each service provider to protect your data.

10.How long we keep it

This table shows what we keep, why, for how long, and exactly what happens when you use Delete my account.

11.How we protect it

1. 11.1

   We protect personal data with technical and organisational measures, including encryption in transit (HTTPS), encryption of sensitive fields such as insurance details, role-based access controls, audit logging and rate limiting.

2. 11.2

   Access to personal data is limited to people who need it for their work.

3. 11.3

   If a personal data breach occurs that is likely to cause significant harm, we will notify the Personal Data Protection Commissioner and the people affected as the PDPA requires.

12.Your rights

Under the PDPA you can ask to access and correct your personal data, withdraw your consent, and limit processing, including for direct marketing. Most of this you can do yourself:

1. 12.1

   You can also email privacy@tims.com.my. We may need to verify your identity first.

2. 12.2

   We respond to access and correction requests within 21 days. We may charge a fee for access requests where the PDPA allows it, and we will tell you before we do.

3. 12.3

   If you are not satisfied with our response, you may complain to the Personal Data Protection Commissioner (Jabatan Perlindungan Data Peribadi).

13.Cookies

1. 13.1

   We use essential cookies only: to keep you signed in, remember your language (TIMS_LOCALE) and remember your cookie choice. The Platform does not work properly without them.

2. 13.2

   We do not use advertising or cross-site tracking cookies.

14.Children

1. 14.1

   TIMS is not intended for anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

15.Changes to this Notice

1. 15.1

   We may update this Notice from time to time. We will tell you about material changes by email or through the Platform, and the date at the top shows when it was last updated.

16.Contact us

For questions, requests or complaints about your personal data, contact our Data Protection Officer: