Privacy Notice

"CWC Consulting Group" is a business and marketing brand only. It is not a registered legal entity, it is not a separate data controller, and it does not itself hold or process personal data. The brand covers three separate registered entities:

• C.W. Chai & Partners (Firm No. AF 001844)
• CWC Corporate House Sdn Bhd (Reg. No. 201401010315 (1086394-K))
• Limitless Deals Sdn Bhd (Reg. No. 201301029142 (1058972-D))

C.W. Chai & Partners (Firm No. AF 001844) is the principal data controller for this website, for website administration, and for audit, tax and related professional-service enquiries. Where a particular enquiry, engagement, service or employment relationship is handled by CWC Corporate House Sdn Bhd (Reg. No. 201401010315 (1086394-K)) or Limitless Deals Sdn Bhd (Reg. No. 201301029142 (1058972-D)), that entity is the data controller for the personal data concerned. If you are unsure which entity holds your data, contact us and we will tell you.

Our office is at IOI Boulevard, B-3A-13A, Jalan Kenari 4, Bandar Puchong Jaya, 47100 Puchong, Selangor, Malaysia.

For questions about this Privacy Notice or your personal data, please contact us at admin@cwchai.com.my.

• Enquiries: name, email address, phone number, company name and the content of your message when you submit the contact form or email us.
• Client portal accounts: name, username, company name, email address and account credentials used to access the Resource Centre.
• Staff portal accounts: employment and human-resource information provided by the employee or recorded by management, such as name, position, department, contact details, identification details, emergency contact, employment dates, leave records, work plans, performance submissions and supporting documents uploaded to the portal. Staff-portal processing is described in more detail in our Employee Privacy Notice.
• AI chatbot: the messages you type into the chat window on this website, together with basic session information.
• Technical and security data: IP address, browser type and version, device and operating-system information, referring pages, date and time of access, security and error logs, and sign-in history (including failed sign-in attempts) for portal accounts, together with the session token that keeps you signed in.

Fields marked as required must be completed for us to process your enquiry, application or account request. If required information is not provided, we may be unable to respond, activate an account or administer the relevant service. Anything not marked as required is optional and only helps us respond more usefully.

We may also receive information from your employer, your authorised representatives, our clients, publicly available sources and records created during our professional or employment relationship with you.

• To respond to your enquiry and provide the services you ask about.
• To create, verify and administer client and staff portal accounts.
• To administer internal human-resource matters for our employees, including leave, work planning and performance records.
• To send service-related notifications, such as registration or approval emails.
• To keep the website and portal secure and to comply with legal obligations.

We process personal data with your consent, where necessary to provide requested services, administer an employment or contractual relationship, comply with legal and professional obligations, protect website security, or where otherwise permitted by Malaysian law. We do not sell your personal data and we do not use it for third-party advertising.

We share personal data only with service providers who help us operate this website and our internal processes, and only to the extent necessary. These include our website hosting and database provider, our email delivery provider, the provider of the AI model behind our chatbot, and Google Workspace services (including Google Forms and Google Sheets) used to receive and record submissions.

Some of our service providers may process or store personal data outside Malaysia. Where personal data is transferred outside Malaysia, we rely on the provider's written terms and data-processing commitments, restrict the data to what the provider needs to deliver the service, require encryption in transit, and satisfy ourselves that the transfer is permitted under Malaysian law. You may ask us for information about the safeguards applied to a particular transfer.

We may also disclose data where required by law, by a regulator, or by our professional obligations.

We keep personal data only for as long as we need it for the purpose it was collected, and then for the additional period required by law, by our professional obligations, or to deal with a possible dispute or regulatory query. In practice:

• Website enquiries that do not result in an engagement — 24 months after the last communication.
• Client portal account and login-profile information — throughout the active relationship and up to 12 months after the account is closed.
• Client engagement files, transaction records and professional-service records — at least 7 years after the engagement is completed or terminated, or longer where required by law, professional standards, a regulatory authority, or an investigation, dispute or legal proceedings.
• Employment, payroll and staff records — 7 years after employment ends, or longer where legally required or necessary for an investigation, dispute or legal proceedings.
• Unsuccessful employment applications — 12 months after the relevant recruitment exercise is completed, unless the applicant consents to a longer period.
• AI chat conversations — we do not retain the content of an AI-chat conversation after the active chat session ends. Messages are transmitted to our AI technology provider for the purpose of generating a response.
• Security and sign-in logs — retained only for the limited period needed for reliability, abuse prevention and security investigation, unless a longer period is required to investigate a security incident or comply with legal obligations.

When the applicable period expires and no lawful reason for continued retention remains, records are securely deleted, destroyed or anonymised.

Access to the portal is restricted by account credentials and role-based permissions, and data is transmitted over encrypted connections. Portal activity on employee records is logged. No system can be guaranteed completely secure, so please do not send sensitive documents through the website's chat window.

Subject to Malaysian law, you may ask us to:

• give you access to the personal data we hold about you;
• correct personal data that is inaccurate, incomplete or out of date;
• withdraw a consent you previously gave, which we will act on going forward, although it does not affect processing already carried out or processing we must continue for legal or professional reasons;
• stop processing your personal data for direct marketing purposes;
• stop or limit processing where you believe it is likely to cause you unwarranted damage or distress;
• delete personal data, where applicable; and
• provide your data in a portable form, where applicable and where the law and our systems allow it.

Malaysian law does not give an unlimited right to erasure, and some records must be retained where the law or our professional obligations require it. The right described above is a right to ask us to stop or limit processing likely to cause unwarranted damage or distress; it is not a right to claim compensation, and the Personal Data Protection Act 2010 does not specifically provide for a compensation claim. We may need to verify your identity before acting on a request.

To make a request, contact us at admin@cwchai.com.my. If you are not satisfied with how we handle your personal data, you may complain to the Personal Data Protection Commissioner, Department of Personal Data Protection Malaysia (JPDP).

We may update this notice from time to time. The date at the top of this page shows when it was last revised. Where there is any inconsistency between the English and Bahasa Malaysia versions, both are intended to carry the same meaning; please contact us if anything is unclear.