NEW ERA UNIVERSITY COLLEGE (NEUC)
VENDOR PRIVACY POLICY

1. Introduction

In compliance with the Personal Data Protection Act 2010 (PDPA, “the Act”) and its regulations, this Policy is issued to all vendors and individuals acting on behalf of or associated with vendors (“vendor representatives”) of New Era University College (“NEUC”, the University College, “we”, “our”, or “us”), a private higher education institution fully owned by New Era Edu Sdn. Bhd. This Policy informs you of your rights in relation to your personal data that has been and/or will be collected and processed by NEUC.
 

2. Collection of Personal Data

We collect and will continue to collect your personal data in relation to your engagement, procurement, contractual relationship, and/or provision of goods and services to us (collectively referred to as “engagement with us”). Such personal data is necessary for us to perform our procurement management, vendor management, administrative, operational, and institutional functions in accordance with applicable laws, regulations, and internal policies.

We may also continue to collect your personal data during and after the engagement period (where necessary), including for purposes such as contract management, compliance, audit, record retention, and ongoing business relationship management.
 

3. Description of Personal Data

The personal data processed may include, but is not limited to:

1. Vendor Representatives’ General Personal Data
   Name, identification details, designation, and contact information, including driver’s license details, authorization or signature records where applicable.
    
2. Business / Company and Operational Data
   Company information (including name, registration number, date of incorporation, and contact details), contractual and transaction records (including bank account details, agreements, purchase orders, invoices, and payments), tax-related information (where applicable), service performance records, communication records, and system or operational access logs where applicable. NEUC may, prior to commencement of engagement, request and review the vendor’s security policy and related information for due diligence and compliance purposes.
    
3. Sensitive Personal Data (Limited Circumstances)
   Sensitive personal data (where applicable), including biometric data, financial information, and any other sensitive personal data required strictly for site access, safety, biometric access systems, statutory declarations, financial due diligence, or legal compliance purposes in accordance with the PDPA.
   *Sensitive personal data will only be processed where necessary and with your explicit consent, in accordance with PDPA.
    

4. Purposes of Collection of Personal Data

Your personal data is collected and processed for purposes including:

1. Vendor registration, evaluation, and onboarding;
2. Procurement, contract administration, and vendor management;
3. Processing of payments, invoices, and financial transactions;
4. Performance monitoring, service evaluation, and quality control;
5. Coordination of services, operations, and project implementation;
6. Security, access control, and site management where applicable;
7. Compliance with legal, regulatory, audit, and internal policy requirements;
8. Communication and day-to-day operational coordination.
    

5. Sources of Personal Data

We may obtain your personal data from:

1. You directly (e.g. forms, declarations, submissions, correspondence);
2. Vendor representatives or authorized persons;
3. Internal records and systems (including procurement systems, access logs, and CCTV where applicable);
4. Business partners, referees, or related third parties (where applicable);
5. Government or statutory bodies;
6. Background screening, verification, or due diligence service providers (where applicable);
7. Publicly available sources (including business or professional information, where relevant).
    

6. Disclosure of Personal Data

We may disclose your personal data to other departments within NEUC. These departments will treat your personal data as confidential, in accordance with this Policy and with all applicable data protection legislation, and will process such personal data only for the purposes and within the terms set out herein.

We are responsible for the personal data under our control, including personal data disclosed by us to a third-party service provider or vendors (often referred to as the “data processor”). We take every measure to ensure that a comparable level of protection is provided for personal data when processed by such service providers.

NEUC is committed to complying with the PDPA, in particular its policies as well as corresponding guidelines and orders.
 

7. Security of Personal Data

NEUC requires all Data Processors, including vendors, contractors, consultants, cloud providers, and third parties handling personal data on its behalf, to implement appropriate technical and organizational security measures to safeguard personal data against loss, misuse, unauthorized access, disclosure, alteration, destruction, and cybersecurity threats.

Data Processors are required to maintain strict access controls, secure systems and networks, apply data encryption and secure storage practices, ensure confidentiality of personnel, implement logging and monitoring mechanisms, promptly report any data breaches or security incidents, and securely retain or dispose of personal data in accordance with NEUC’s requirements.

Data Processors must also comply with cross-border transfer restrictions, obtain prior approval before appointing subprocessors, and cooperate with NEUC’s audit and compliance reviews to ensure ongoing protection of personal data.

Further details regarding our information security practices and technical safeguards are available in our Security Policy (Vendor).
 

8. Use of Cookies

The cookies used by the official website of NEUC and its internal digital platforms are used for system functionality, user experience, and platform performance. Some cookies may be used by third parties to provide NEUC with information on engagement and promotional effectiveness.

Cookies may collect information related to your use of the platforms, including session and preference data, for authentication, functionality, and system administration purposes. Such cookies do not intentionally collect sensitive personal data unless required for system operation or authentication. You may configure the internet browser settings to manage or disable cookies.
 

9. Transfer of Personal Data

We are committed to ensuring a comparable level of protection for vendor representatives personal data should the information be processed or used outside Malaysia by NEUC’s vendors or experts.
 

10. Data Subject’s Obligations

It is necessary for NEUC to collect and retain personal data of vendor representatives and related contact persons, who are required to provide accurate and complete personal data. Failure to do so may affect the processing of such data for the purposes stated in Clause 4, and may result in procurement, contracting, or vendor-related processes not proceeding or being discontinued.
 

11. Retention of Personal Data

NEUC retains personal data for as long as it is necessary to fulfil the purposes for which it was collected, or as required for legal, regulatory, audit, administrative, or institutional requirements. Where personal data is no longer required for the stated purposes, it will be securely deleted, or archived, unless retention is required by law or for legitimate institutional purposes.
 

12. Rights of Data Subject

1. To request access to personal data
   Vendors and vendor representatives have the right to request access to personal data processed by NEUC upon reasonable notice. Access requests may be made by downloading the prescribed Personal Data Access Request Form, duly completing the form, and submitting it via email to the relevant department.
    
2. To request correction of personal data
   Vendors and vendor representatives have the right to request correction and/or update of their personal data that is inaccurate, incomplete, or outdated. Correction requests may be made by downloading the prescribed Personal Data Correction Request Form, duly completing the form, and submitting it via email to the relevant department.
    
3. To limit the processing of your personal data
   Vendors and vendor representatives are entitled to limit the processing of their personal data by withdrawing their consent, subject to applicable legal requirements and contractual conditions, and within a reasonable period of time.
    

13. Data Breach Notification

NEUC will take reasonable steps to detect, investigate, and address any personal data breach in accordance with the PDPA. Upon awareness, the Data Protection Officer (DPO) will record, investigate and implement security measures, and assess whether notification to the Personal Data Protection Commissioner (Jabatan Perlindungan Data Peribadi, JPDP) is required where necessary, and notify the affected data subject(s) and reporter, where applicable, of the outcome.
 

14. Changes to Privacy Policy

NEUC reserves the right to amend this Policy from time to time without prior notice. Vendors and vendor representatives are advised to check NEUC’s website regularly for the latest version of this Policy. The latest Policy can be accessed at www.newera.edu.my.
 

15. Acknowledgement and Consent

By communicating or engaging with NEUC, vendors and vendor representatives acknowledge that you have read and understood this Policy and consent to the use, processing, disclosure, and transfer of your personal data by NEUC as described herein. You may withdraw your consent by written notice or by completing the relevant form on the website.
 

16. Inquiries and Complaints

Should you require further information about the personal data we hold or the way in which your information is being collected or used which are not answered by this Policy, please contact or write to us at:

Data Protection Officer (DPO)
New Era University College

Address: Blocks B & C, Lot 5, Seksyen 10, Jalan Bukit,43000 Kajang, Selangor, Malaysia
Tel: 603-8740 6392/8210 3709
Email:
For PDPA-related enquiries: dpo@newera.edu.my
For vendor-related enquiries: general@newera.edu.my

(Revised and Approved by Administration Meeting on 20th May 2026)