Privacy policy.

1. Introduction

The Association of Tourism Training Institutes of Malaysia (ATTIM) is committed to protecting the personal data of our members, course registrants, website visitors, and all other individuals who interact with us. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA), as amended by the Personal Data Protection (Amendment) Act 2024, and any subsidiary regulations made thereunder.

By using our website, submitting a membership or course registration application, or otherwise providing your personal data to ATTIM, you acknowledge that you have read and understood this Privacy Policy.

2. Data Controller

The data controller responsible for your personal data is:

3. Personal Data We Collect

We collect different categories of personal data depending on your relationship with ATTIM:

(a) Members

When you apply for or renew ATTIM membership, we may collect:

• Full name and identity card or passport number
• Email address and telephone / mobile number
• Residential or business address
• Agency licence number and relevant regulatory details
• Supporting documents (e.g. business registration certificate, licence copies)

(b) Course Registrants

When you register for any ATTIM training programme, we may collect:

• Full name and MyKad / NRIC number
• Nationality and country of birth
• Highest academic qualification
• Current employer, job title, and years of experience
• A copy of your identification document for certification purposes

(c) Contact Inquiries

When you submit a query via our contact form, we collect your name, email address, and the content of your message.

(d) Newsletter Subscriptions

When you subscribe to our newsletter, we collect your email address only.

4. Purpose & Legal Basis

We process your personal data for the following purposes and on the following legal grounds:

5. Data Retention

We retain your personal data only for as long as is necessary for the purpose it was collected, or as required by law:

• Member records: Duration of active membership plus 7 years after termination or lapse.
• Course registration records: 7 years from the date of course completion, in line with audit and accreditation requirements.
• Contact / enquiry messages: 2 years from the date of receipt.
• Newsletter subscriptions: Until you unsubscribe or withdraw consent, whichever is earlier.

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised.

6. Your Rights under the PDPA

Under Malaysia's Personal Data Protection Act 2010 (as amended 2024), you have the following rights in relation to your personal data:

• Right to Access: You may request a copy of the personal data we hold about you.
• Right to Correction: You may request that inaccurate or incomplete personal data be corrected.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
• Right to Request Deletion: You may request that we delete your personal data where it is no longer necessary for the purpose for which it was collected, subject to applicable legal obligations.
• Right to Restrict Processing: You may request that we limit how we use your personal data in certain circumstances.
• Right to Lodge a Complaint: If you believe we have not complied with the PDPA, you may lodge a complaint with the Personal Data Protection Commissioner (PDPC) at www.pdp.gov.my.

To exercise any of these rights, please contact us at info@attim.org.my. We will respond within 21 days as required under the PDPA.

7. Cookies

Our website uses essential session cookies solely to maintain your browsing session (e.g. keeping you logged in to the member portal). These cookies are strictly necessary for the operation of the site and are automatically deleted when you close your browser.

We do not use any third-party tracking, analytics, or advertising cookies. No cookie data is shared with external advertising networks or data brokers.

8. Third-Party Disclosure

ATTIM does not sell, rent, or trade your personal data to any third party. Your data may be disclosed only in the following limited circumstances:

• Payment processors: Where you pay for membership or courses online, your payment details are processed by our authorised payment gateway provider in a PCI-DSS compliant manner. We do not store full card details.
• Government and regulatory authorities: We may disclose personal data to the Ministry of Tourism, Arts and Culture Malaysia, the Tourism Malaysia Board, or other competent authorities where required by law, a court order, or regulatory directive.
• Professional advisers: Our lawyers, auditors, and insurers may access personal data on a strictly need-to-know basis and are bound by professional confidentiality obligations.

All third-party service providers engaged by ATTIM are contractually required to handle personal data in accordance with the PDPA 2010 (as amended 2024).

9. Updates to this Policy

We may update this Privacy Policy from time to time to reflect changes in law, our data practices, or organisational structure. Material changes will be communicated via a notice on our website homepage. The date at the top of this page indicates when the policy was last revised.

Last updated: May 2025

10. Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or your personal data, please contact our Privacy Officer:

Email: info@attim.org.my
Post: Privacy Officer, ATTIM, Lot 1-5-1, Wisma Prima Peninsular, Jalan Setiawangsa 11, Taman Setiawangsa, 54200 Kuala Lumpur, Malaysia.