Privacy Policy

1 Introduction & Scope

IFRAC SDN. BHD. (Company Registration No. 202201008711 / 1454408-X) (“we”, “us”, or “our”), operating the CPE IFRAC LMS platform accessible at cpe.ifrac.com.my, is committed to safeguarding the privacy and integrity of personal data entrusted to us by our students, clients, and platform visitors.

This Privacy Policy is formulated in strict compliance with the statutory provisions of the Personal Data Protection Act 2010 (PDPA) of Malaysia. It explains the types of personal data we collect, how it is processed and protected, with whom it may be shared, and your rights concerning your personal data.

2 Personal Data We Collect

In order to provide accredited Continuing Professional Education (CPE) courses, live webinars, and certificate verification services, we may collect and process the following categories of personal information:

3 Purposes of Processing Personal Data

Under the Personal Data Protection Act 2010, we process your personal data for the following legitimate purposes:

• Service Delivery: To set up student accounts, grant access to course curricula, and admit participants into live Zoom webinar rooms.
• Certification & Compliance: To verify required learning hours and issue official, tamper-proof CPE certificates.
• Payment Processing: To complete financial transactions, issue tax invoices/receipts, and process authorized refunds.
• Student Communications: To transmit essential updates, including seminar date notifications, session reminders, and customer support responses.
• Account Security: To enforce single-device active session controls, preventing unauthorized account sharing.
• Statutory Audits: To comply with regulatory obligations, accreditation audits, and applicable statutory laws of Malaysia.

4 Disclosure of Personal Data

We do not sell, trade, or rent personal data to third parties. Personal data is disclosed solely on a need-to-know basis to trusted service providers bound by strict confidentiality and data protection standards:

5 Data Security & Storage

We implement administrative, technical, and physical safeguards—including SSL/TLS 256-bit transmission encryption, database access restrictions, password hashing, and continuous session monitoring—to prevent unauthorized loss, misuse, or alteration of personal data.

Personal data is retained only for as long as necessary to fulfill the educational, certification verification, and financial reporting purposes described in this policy, or as required by applicable Malaysian statutory retention schedules.

6 Your Rights Under PDPA 2010

In accordance with the Malaysian Personal Data Protection Act 2010, you are entitled to:

• Right to Access: Request a copy of your personal data maintained in our records.
• Right to Rectification: Request correction of inaccurate, incomplete, or outdated personal information (such as updating your Full Name for certificate reissue or updating your Nick Name).
• Right to Withdraw Consent: Withdraw your consent to process your personal data by giving reasonable written notice, subject to legal or contractual obligations (such as retaining completed certificate archives).