Enable Business Sdn. Bhd. (“QuickHR”, “we”, “us”, “our”)
(Company Registration No.: 202001007429)
This Data Protection Notice (“Notice”) explains how QuickHR collects, uses, discloses, and safeguards personal data in accordance with the Personal Data Protection Act 2010 (Malaysia) (“PDPA”).
This Notice applies to:
Where QuickHR processes personal data on behalf of a customer, the customer remains the party responsible as the data controller/employer, and processing is governed by the applicable contract and Data Processing Addendum (“DPA”).
QuickHR processes personal data only where consent has been obtained, where processing is necessary for the provision of services, or where otherwise permitted under the PDPA and applicable Malaysian law.
In certain circumstances, QuickHR may process Personal Data without consent where permitted under the PDPA, including for legal compliance, fraud prevention, or security incident response.
“Personal Data” refers to any information relating to an identified or identifiable individual, including but not limited to:
QuickHR does not use personal data for direct marketing without consent, and individuals may opt out of marketing communications at any time.
Certain Personal Data may constitute “Sensitive Personal Data” under the PDPA (including health-related or biometric identifiers), and will only be processed where lawful and necessary for service delivery.
Biometric processing will only occur where enabled by Customer and with lawful employee authorisation.
Personal data may be collected through:
If you provide personal data relating to another individual, you confirm that you have obtained the necessary authorisation to do so.
The Customer remains solely responsible for obtaining any required employee notice, consent, and lawful basis for biometric processing under the PDPA.
QuickHR processes personal data for legitimate business purposes, including:
QuickHR does not sell or trade personal data.
Where QuickHR processes employee or workforce data uploaded by customers:
Customers are responsible for ensuring they have obtained lawful consent or authority to process employee data under the PDPA.
QuickHR may disclose personal data only where necessary to:
All service providers are bound by confidentiality and data protection obligations no less stringent than those set out in this Notice and the DPA.
A current list of approved Sub-Processors is available upon request, subject to confidentiality.
QuickHR does not sell, rent, or commercially trade personal data to any third party.
QuickHR primarily processes customer platform data within approved operational environments.
QuickHR’s primary hosting environment for Malaysian customers is Amazon Web Services (AWS) Singapore.
By using the Services, Customers acknowledge that Personal Data will be processed and stored in Singapore by default, subject to comparable protection safeguards under Section 129 PDPA.
Where cross-border processing is required for:
QuickHR ensures that any cross-border transfer is made only where a comparable standard of protection is maintained, including through contractual safeguards, vendor due diligence, and technical security controls consistent with PDPA requirements.
QuickHR maintains appropriate administrative, technical, and organisational safeguards including
While no system can be guaranteed fully secure, QuickHR takes reasonable and proportionate measures aligned with industry best practices.
QuickHR retains personal data only for as long as necessary for contractual, operational, compliance, and lawful business purposes, after which it will be securely deleted or anonymised in accordance with standard retention cycles.
Following termination:
QuickHR is not obligated to provide deletion certificates unless expressly agreed in writing.
Deletion is subject to technical limitations inherent in encrypted backup systems, and residual copies may persist until overwritten in the ordinary course of operations.
Individuals have the right under the PDPA to:
Requests may be submitted to our Data Protection Officer. QuickHR will respond within a reasonable timeframe, generally within twenty-one (21) business days, subject to verification of identity and applicable PDPA exceptions.
For HRMS platform users (employees whose data is controlled by an employer), such requests should be directed to the relevant employer (the Data Controller). QuickHR will provide reasonable assistance to the Customer where required under the DPA.
If you have concerns about how your personal data is handled, you may contact our Data Protection Officer. We will investigate and respond in accordance with applicable PDPA requirements.
For enquiries or requests:
Data Protection Officer
Enable Business Sdn. Bhd.
Email: dpo@quickhr.co
QuickHR may update this Notice from time to time. The latest version will always be published on our website with the effective date stated above.