Privacy Policy & PDPA: How We Handle Your Data

Last updated: 14 October 2026

This Privacy Policy explains how Niat Murni Solutions (SSM 202503084604 (RA0123143-A)), trading as Niat Murni Academy, collects, uses and protects your personal data. We follow the Personal Data Protection Act 2010 (PDPA), as amended by the Personal Data Protection (Amendment) Act 2024. For the personal data described here, we are the data controller.

1. Personal data we collect

• Name, MyKad or passport number, phone number and email address.
• Company name, if the booking is made through or for an employer.
• Postal address, so we can post your printed certificate.
• Payment records, such as amount, date, payment reference and proof of bank transfer. We do not store card numbers. Card payments are handled by HitPay.
• Class attendance, assessment results and Zoom attendance information, such as your display name and join and leave times.
• Messages you send us through our website chat or WhatsApp.
• Cookies and analytics data from your visits to our website, with your consent where required (see section 11).

Most of this data comes from you or from the person who booked for you, such as your employer.

2. Why we use your data

• To register you for a class and manage your booking.
• To submit your training record to the KKM FoSIM system, as required for food handler training.
• To issue your certificate and allow it to be verified.
• To process payments and issue receipts or invoices.
• To send class reminders and certificates by WhatsApp and email.
• To answer your questions and provide customer support.
• To support HRD Corp claims, if you or your employer are claiming.
• To meet our legal obligations, including tax and accounting records.
• To improve our classes and website.

If you do not give the data needed for registration and the KKM record, we cannot enrol you or issue a certificate.

3. Certificate verification

Anyone with your certificate number or QR code, such as an employer or a council officer, can check it on our verification page. The page shows only limited information, and your MyKad or passport number is partly hidden (masked).

4. Who we share your data with

• The Ministry of Health Malaysia (KKM), through FoSIM, for your training record.
• HRD Corp, if a claim is made for your training.
• The employer who booked for you, for booking, attendance and certificate details.
• Service providers who help us run our service, including hosting, payment (HitPay), email, WhatsApp and Zoom. They may use the data only to provide their service to us.
• Authorities, where the law requires us to disclose data.

We do not sell your personal data.

5. How long we keep your data

We keep personal data only as long as needed for the purposes above or as required by law. Certificate and training records are kept so your certificate can still be verified in future. Payment and accounting records are kept for the period required by Malaysian law. When data is no longer needed, we delete it or make it anonymous.

6. How we protect your data

We use encrypted connections, access controls so that only staff who need the data can see it, and records of who accesses sensitive information. No system is completely secure, but we review our safeguards regularly.

If a personal data breach happens, we will notify the Personal Data Protection Commissioner as required by law. Where the breach is likely to cause you significant harm, we will also notify you.

7. Transfer outside Malaysia

Some of our cloud service providers may store or process data on servers outside Malaysia. When this happens, we take steps to make sure your data has a level of protection that meets the requirements of the Act.

8. Your rights

• Access the personal data we hold about you.
• Correct data that is wrong, incomplete or out of date.
• Withdraw consent for us to process your data. This may mean we cannot continue your booking or issue a certificate.
• Data portability: since 1 June 2025, you may ask us to send your personal data to another data controller, where technically possible.
• Limit processing, including asking us to stop sending you marketing messages.

We may need to verify your identity before acting on a request. Records we must keep by law, such as the training record submitted to KKM, cannot be deleted on request.

9. Data Protection Officer

We have appointed a Data Protection Officer (DPO). To make a request or ask about your data, email info@niatmurni.my with the subject "PDPA" and your booking code if you have one. If you are not satisfied with our reply, you may contact the Personal Data Protection Commissioner.

10. Participants under 18

Participants under 18 need consent from a parent or guardian before booking. A parent or guardian may contact us about the child's data.

11. Cookies

Cookies are small files stored on your device when you visit our website. We use two types:

• Essential cookies keep the website working, for example your language choice, cart, login and security. These are always on.
• Analytics cookies help us understand how visitors use the website. We only use them if you agree through our cookie banner.

You can change your choice at any time through the cookie settings on our website or by clearing cookies in your browser.

12. Language

This policy is available in Bahasa Melayu, English and Chinese. If the versions differ, the Bahasa Melayu version applies.

13. Changes to this policy

We may update this policy from time to time. The date at the top shows the latest version, so please check this page now and then.

Other privacy questions? Email info@niatmurni.my or write to us at Co-Lab,Lot 2.01A Level 2, Nu Sentral ShoppingCentre, Jalan Tun Sambanthan Kuala Lumpur Sentral, 50470Kuala Lumpur Wilayah Persekutuan..