PRIVACY NOTICE

1. Who This Notice Applies To

This Privacy Notice applies to individuals whose personal data is collected and processed by ENM in connection with our services. This primarily includes:

• Employees, expatriates, and personnel of our clients whose work permit applications, extensions, cancellations, or endorsements are managed by ENM ("Data Subjects"); and
• Contact persons and representatives of our clients and business partners whose details we hold for the purpose of managing our business relationships.

2. What Personal Data We Collect

In order to process work permit applications and related immigration services in Sabah, we collect and process the following categories of personal data as provided to us by our clients or their authorised representatives:

• Personal identification information: full name, date of birth, nationality, gender, passport number, passport expiry date, and passport-sized photographs;
• National identification details: Malaysian NRIC number (where applicable) or foreign national identification documents;
• Employment-related information: job title, position, employment contract details, name and registration details of the employing company, salary information, and duration of assignment;
• Educational and professional qualifications: resumes, certificates, and professional credentials;
• Contact information: phone number, email address, and residential address;
• Immigration and travel documents: copies of passports, existing visas, previous work permits, and Visa with Reference (VDR) letters;
• Medical examination results: where required for the work permit application process; and
• Company-related documents: SSM registration forms, company profiles, and supporting corporate documents provided by our clients.

We do not collect personal data directly from Data Subjects. All personal data is provided to us by our clients or their authorised representatives for the specific purpose of carrying out immigration and work permit services on their behalf.

3. How We Use Your Personal Data

We use the personal data collected for the following purposes:

• To compile, prepare, and submit work permit applications, extensions, transfers, and cancellations to the Jabatan Ketua Menteri Sabah (JKM) and Jabatan Imigresen Malaysia Sabah (JIM);
• To apply for Visa with Reference (VDR) letters where required;
• To facilitate passport endorsement processes;
• To communicate with government authorities regarding the status of applications;
• To liaise with our clients regarding the progress and outcome of applications;
• To maintain records of applications processed for audit, compliance, and reference purposes; and
• To comply with applicable laws, regulations, and government directives.

4. Legal Basis for Processing

We process personal data on the following bases under the PDPA:

Contract Performance: The processing is necessary for the performance of our contractual obligations to our clients, who engage us to carry out work permit and immigration services on behalf of their employees.

Legal Obligation: The processing is necessary for compliance with legal and regulatory requirements, including the submission of documents to government authorities as part of the immigration process.

Legitimate Interest: Where applicable, we process data to maintain our business records, manage client relationships, and ensure the quality of our services.

5. Disclosure of Personal Data

In the course of providing our services, we may disclose personal data to the following parties:

• Government authorities: including the Jabatan Ketua Menteri Sabah (JKM), Jabatan Imigresen Malaysia Sabah (JIM), and other relevant government agencies, as required for the processing of work permit applications;
• Our clients: to provide updates on application status, approvals, and other relevant information relating to their employees' work permits; and
• Professional advisors: including legal counsel, auditors, or accountants, where necessary for the conduct of our business.

We do not sell, trade, or rent personal data to any third party. We do not disclose personal data to any party other than those described above unless required by law or with the prior consent of our client.

6. Data Storage and Security

Personal data is stored securely in both electronic and physical formats:

• Electronic data is stored within our Google Workspace environment, which includes encryption at rest and in transit, access controls, and regular security updates. Access is restricted to authorised ENM personnel on a need-to-know basis, and two-factor authentication (2FA) is enabled on all accounts.
• Physical documents containing personal data are stored in locked filing cabinets within our office premises, which are monitored by CCTV. When physical documents are no longer required, they are disposed of securely by shredding.

For further details on our information security practices, please refer to ENM's Information Security Policy.

7. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected and to comply with applicable legal and regulatory requirements.

Work permit application records and supporting documents are retained for a minimum period as required by Malaysian immigration regulations and applicable laws. Once the retention period has expired, personal data will be securely deleted or destroyed.

Where our client instructs us to return or delete personal data upon completion of services, we will comply with such instructions within a reasonable timeframe, subject to any overriding legal retention obligations.

8. Your Rights

Under the PDPA, Data Subjects have the following rights in relation to their personal data:

Right of Access: You may request access to the personal data we hold about you.

Right of Correction: You may request that we correct any personal data that is inaccurate, incomplete, or not up to date.

Right to Withdraw Consent: Where processing is based on consent, you may withdraw your consent at any time. Please note that withdrawal of consent may affect our ability to process the relevant work permit application.

Right to Limit Processing: You may request that we limit the processing of your personal data in certain circumstances.

As personal data is provided to us by our clients rather than directly by Data Subjects, we encourage individuals wishing to exercise their rights to contact their employer in the first instance. Alternatively, requests may be directed to us using the contact details provided in Section 11, and we will liaise with the relevant client to address the request.

We will respond to all valid requests within the timeframes prescribed by the PDPA. We may need to verify the identity of the requester before processing any request.

9. Cookies and Website Data

Our website (www.enm.my) may use cookies or similar technologies to improve user experience and to analyse website traffic. Cookies do not collect personal identification information. By continuing to use our website, you consent to the use of cookies in accordance with this Notice. You may disable cookies through your browser settings, although this may affect the functionality of the website.

10. Changes to This Privacy Notice

We may update this Privacy Notice from time to time to reflect changes in our practices, services, or applicable laws. The updated version will be posted on our website with the revised date indicated at the top of the Notice. We encourage you to review this Notice periodically.

11. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Notice or the way we handle personal data, please contact us at: