Employee Privacy Notice

The data controller for your employment records is the particular CWC entity that employs you, as stated in your letter of offer — C.W. Chai & Partners (Firm No. AF 001844), CWC Corporate House Sdn Bhd (Reg. No. 201401010315 (1086394-K)) or Limitless Deals Sdn Bhd (Reg. No. 201301029142 (1058972-D)). C.W. Chai & Partners is not the employer of every member of staff, and no entity controls another entity's employee records. "CWC Consulting Group" is a business and marketing brand only; it is not a registered legal entity and is not a data controller.

The staff portal is administered on behalf of each employing entity. If you are unsure which entity employs you and therefore controls your records, check your letter of offer or ask us.

For questions about this notice or your personal data, please contact us at admin@cwchai.com.my.

• Identity and contact details: legal name, preferred name, nationality, identification document type and number, date of birth, address, personal email and phone number, and emergency contact details.
• Employment information: position, department, reporting line, employment and confirmation dates, resignation or exit date, and your letter of offer and employment contract.
• Professional information: academic and professional qualifications, professional body memberships and supporting certificates you upload.
• Leave records: leave applications, approvals, entitlement and balances.
• Work planning and performance: weekly work plans, job assignments, KPI submissions, review outcomes and management comments.
• Portal and security data: account credentials, role and permissions, sign-in history, notification records and an audit log of changes made to your records.

Fields marked as required must be completed for us to activate your portal account and administer your employment. If required information is not provided, we may be unable to activate the account, process leave, or record work and performance data. Some information is recorded by management rather than by you — for example approvals, review outcomes, department changes and exit dates — and we may also obtain information from your referees, professional bodies and records created during your employment.

We process employee personal data to administer your employment and contractual relationship, to plan and allocate work, to manage leave and performance, to pay and administer benefits, to comply with legal, tax and professional obligations, to protect the security of our systems and client information, and where otherwise permitted by Malaysian law. Where we rely on your consent — for example for optional information — you may withdraw it, and we will act on that going forward.

Access is role-based. You can always see your own record. Supervisors, managers and partners can see the records of staff who report to them, according to their level of authority. Partner-level records are not visible to other management staff. Changes to employee records are written to an audit log that records who made the change and when.

Outside the firm, we share employee data only where necessary — with our hosting and database provider, our email delivery provider, Google Workspace services used for records and submissions, and with statutory bodies, auditors, insurers or professional advisers where required. Some providers process data outside Malaysia; we rely on their written data-processing terms, restrict data to what is needed, require encryption in transit, and satisfy ourselves that the transfer is permitted under Malaysian law.

Employment, payroll and staff records are kept for the duration of your employment and then for 7 years after employment ends, or longer where legally required or necessary for an investigation, dispute or legal proceedings. Leave, work-plan and performance records are kept for the same period as the employment file.

Unsuccessful employment applications are kept for 12 months after the relevant recruitment exercise is completed, unless the applicant consents to a longer period. Portal access is withdrawn as soon as a resignation or exit date takes effect. Sign-in and security logs are kept only for the limited period needed for security investigation, unless a longer period is required to investigate a security incident or comply with legal obligations.

When the applicable period expires and no lawful reason for continued retention remains, records are securely deleted, destroyed or anonymised.

Subject to Malaysian law, you may ask for access to your record, correction of inaccurate or out-of-date information, withdrawal of a consent you gave, a stop to direct marketing, a stop or limit on processing likely to cause you unwarranted damage or distress, deletion where applicable, and a portable copy of your data where applicable. Malaysian law does not provide an unlimited right to erasure, and employment records must be retained where the law or our professional obligations require it. The damage-or-distress right is a right to ask us to stop or limit that processing; it is not a right to claim compensation, and the Personal Data Protection Act 2010 does not specifically provide for a compensation claim. If you are not satisfied with how we handle your personal data, you may complain to the Personal Data Protection Commissioner, Department of Personal Data Protection Malaysia (JPDP).

For website and client-facing processing, see our Privacy Notice.