Privacy Policy

A. INTRODUCTION

GANGSA GEMILANG SDN BHD (“GGSB”) is committed to protecting the personal data supplied by you to GGSB to ensure compliance with the legal and regulatory requirements in accordance with the Personal Data Protection Act 2010 (“the Act”) which came into effect on 15th November 2013.
This Privacy and Personal Data Protection Policy (“Policy”) is issued to all our immediate and/or prospective customers, suppliers and employees (collectively referred to as “Data Subject”) pursuant to the Act.
For the purpose of this Policy: –
- “Personal Data” means any personal information relating to GGSB’s Data Subject provided to GGSB or made available to GGSB in the course of commercial dealings with GGSB, that relates directly or indirectly to a Data Subject, who is identified or identifiable from that information. This may include but not limited to name, date of birth, identity card number, passport number, address, gender, race, nationality, contact information, religion, education, work and compensation information currently and historically, tax file identification number, EPF number, SOCSO number, bank account information, credit card details, account balances, payment history and account activity, where permitted by applicable law.
- “Sensitive Personal Data” means any personal data consisting of information as to the physical or mental health or condition, political opinions, religious beliefs or other beliefs of a similar nature, commission or alleged commission of any offence or any other Personal Data determined by law; and
- “Third parties” means a person or a company who is not a party to a contract or a transaction with GGSB, including but not limited to GGSB’s agents, subsidiaries, contractors, sub-contractors and professional advisors.
GGSB reserves the right to modify this Policy as required and changes, if any, will be announced through its webpage at rocanahotel.com.
This Policy is issued in both English Language and Bahasa Malaysia. In the event of any inconsistencies between the English version and the Bahasa Malaysia version, the English version shall prevail.

B. SCOPE

This Policy applies to all operations and business units of GGSB.

C. RESPONSIBILITY

Our Personal Data Protection Compliance Officer, is responsible for the necessary registration, customer access and collection of personal data, notice and choice process to limit processing of personal data and for the monitoring the administration of this Policy and enterprise-wide compliance.

D. PERSONAL DATA PROTECTION PRINCIPLES

1. General Principle:

During the course of your transaction and dealings with GGSB, you may be requested to furnish from time to time to GGSB, directly or through online forms and/or other electronic methods, your personal data relevant to the purposes listed in Item 2.1 below. The types of personal data collected will depend on the nature of your dealings or transaction with GGSB.
Save in accordance with this Policy and except as permitted or required under any enactment, law, statute or code, GGSB will not collect, record, hold, store, use, share and disclose (“process”) without prior consent of the Data Subject.
GGSB will not intentionally collect Sensitive Personal Data unless legally required to do so. GGSB will only process any Sensitive Personal Data with the explicit consent of the Data Subject or if the processing is necessary. GGSB works to protect the confidentiality and security of such information it obtains in the course of business. Access to such information is limited and policies and procedures are in place designed to safeguard the information from loss, misuse and improper disclosure.
If you are under 18, you should ensure that you obtain the consent of your parents or legal guardian before using our services and/or products.

2. Notice and Choice Principle:

2.1 Purposes of Collection of Personal Data: – The Personal Data may be processed by us for the following purposes, including but not limited to:

Regulatory and governmental authorities in order to comply with any applicable law or order, direction or regulation of any regulatory appropriate authorities.
Any related companies and subsidiaries within FRANKY group of companies.
GGSB’s business partners and affiliates.
Information technology (IT) service provider.
Data entry service providers.
Storage facility service providers.
Banks and financial institutions.
Insurance providers.
GGSB’s auditors, consultants, accounts, lawyers or other professional advisers.
GGSB’s agents, contractors, sub-contractors and third party service or product providers;

2.2 Source of Personal Data The Personal Data will be collected, processed and used by us are sourced from wholly legitimate and transparent means such as:

Agreements and contracts;
Official registration forms (either electronic or printed);
Official Request for Information forms that are provided to you by our employees or agents;
Any emails or any correspondences that we have received from you requesting for information or making any inquiries;
Any forms that you have submitted on our website or any websites contracted by us;
Any referrals from a person which have included their verifiable personal contact details;
Letters of offer from financial institutions (local and foreign) for pre- approved loans;
Business cards that were dropped or given to our employees, agents, brokers or associates; or
Any documents (including but not limited to statutory forms and returns) that were submitted to us for processing.

2.3 GGSB may disclose personal data to the following class of third parties, including but not limited to:

Agreements and contracts;
Official registration forms (either electronic or printed);
Official Request for Information forms that are provided to you by our employees or agents;
Any emails or any correspondences that we have received from you requesting for information or making any inquiries;
Any forms that you have submitted on our website or any websites contracted by us;
Any referrals from a person which have included their verifiable personal contact details;
Letters of offer from financial institutions (local and foreign) for pre- approved loans;
Business cards that were dropped or given to our employees, agents, brokers or associates; or
Any documents (including but not limited to statutory forms and returns) that were submitted to us for processing.

2.4 The Personal Data provided to us are wholly voluntary in nature and you are not under any obligation or under any duress to do so. However, in to facilitate any of the purposes of Item 2.1 above certain personal details and information are required beforehand. If you fail to supply sufficient personal data as required:

GGSB will not be able to provide you with the necessary notices, services and/or products requested;
GGSB will not be able to process your application or registration for any of the necessary services, products, programs and/or activities; and/or
GGSB will not be able to formalize any contract and/or agreement / tenders / Letter of Awards;
GGSB will not be able to enter into and complete the necessary commercial transaction, agreement or dealing with you or in your favour.
GGSB will not be able to comply with any applicable law, regulation, direction, court order, by laws, guidelines and/or codes applicable to us.

If you do not want GGSB to disclose, transfer, use or process otherwise your personal data for any of the purposes listed in Item 2.1 above or if you wish to withdraw your consent in full or in part or limit the processing of your personal data, you may contact GGSB in writing at the particulars set out in Item 7.4 below.

3. Disclosure Principle:

GGSB will not disclose any Personal Data without the consent of the Data Subject and for the purpose for which the Personal Data is processed.
GGSB will only disclose your Personal Data for any purpose other than the purpose for which the Personal Data was to be disclosed at the time of its collection if your consent has been obtained, the disclosure is necessary for the administration of justice or was required or authorised by or under any law or by the order of a court.
The information that GGSB gathers is not sold, given to, or otherwise shared with other organisations for commercial or any other purposes.

4. Security Principle:

GGSB shall take practical steps to safeguard the integrity, confidentiality and security of all Personal Data, to protect Personal Data from destruction or loss, misuse, alteration or unauthorised and accidental access or disclosure.
These steps include entering into written agreements with subcontractors who process Personal Data in accordance with GGSB’s instructions, if any, and incorporating GGSB’s own data protection standards as a minimum.
GGSB will employ a number of safeguards, appropriate to the sensitivity of the information, to protect Personal Data such as physical measures, organizational measures and technological measures, for example locked filing cabinets, restricted access to offices, security clearances and limiting access on a “need to know” basis only to relevant users for the purpose of performing their official duties and use of passwords and encryption.
Procedures for implementing these measures will be communicated to all GGSB’s employees and third parties to ensure compliance with this principle.
GGSB shall ensure that any security policy developed or implemented by GGSB complies with the security standard required under the Act and any applicable law that may from time to time be in force.

5. Retention Principle:

Any personal data supplied by you will be retained by GGSB as long as necessary for the fulfilment of any of the purposes stated in Item 2.1 above or otherwise permitted by any applicable law that may from time to time be in force.
If any personal data is no longer required for the purpose for which it was processed, GGSB shall take all reasonable steps to ensure that it is destroyed or permanently deleted.

6. Data Integrity Principle:

GGSB takes reasonable steps to maintain complete, current, and accurate information about its Data Subject. Any inaccurate information that is brought to GGSB’s attention will be corrected as quickly as possible after notification. Procedures will be maintained to ensure that any reported inaccuracies are promptly and effectively handled and that Data Subject’s information remains as accurate, current and complete as possible.

7. Access Principle:

Data Subject can have access to his/her Personal Data that GGSB has in its possession or control and may request that his/her Personal Data be amended for purposes of accuracy, completeness and up-to-date, except where compliance with a request to such access or correction is refused under the Act.
In accordance with the Act, an individual may forward a written request to GGSB’s Personal Data Protection Compliance Officer to limit or stop processing their personal data, subject to any applicable legal restrictions, contractual conditions and a reasonable time period.
Personal data supplied by you to GGSB must be accurate, complete and not misleading. If you know that your personal data held by GGSB is inaccurate, incomplete, misleading or not up-to-date, you may make a data correction request in writing to GGSB.
You may send your data access request, data correction request or any inquiries to GGSB in writing at the following address:

Attention :	Personal Data Protection Compliance Officer
Correspondence Address :	A7370, 1st Floor, Jalan Kubang Buaya, 25250 Kuantan, Pahang Darul Makmur, Malaysia
Email Address :	pdpa@rocanahotel.com
Telephone No. :	09-517 3993
Facsimile No. :	09-517 3983