Registration privacy notice
This notice explains how personal data is collected, used, disclosed, protected and retained when you register for the AWWA Malaysia Tour workshop.
1. Who is responsible for your personal data?
WHYTEHOUSE EDUCATION GROUP SDN BHD (Company No. 201401036915 (1113056-X)) is solely responsible for personal data collected through this registration website.
AWWA is the workshop partner and receives only information reasonably needed to deliver the programme. AWWA is not jointly responsible for this registration website.
2. What personal data do we collect and where does it come from?
Depending on your registration, we may collect:
- lead and participant names, email addresses and telephone numbers;
- role, organisation, city or location;
- professional background, experience, age groups supported, workshop interests and free-text learning questions or challenges;
- dietary selection and optional allergy information;
- billing name, billing email and billing address when an invoice or receipt is requested;
- registration type, promotional code, attendance, certificate and registration status;
- payment method category, amount, payment status, payment references and refund information;
- consent confirmations, notice version and audit evidence; and
- technical or security information needed for fraud prevention, service integrity and Cloudflare Turnstile.
This information comes from you, a lead registrant authorised by you, the hosted payment provider, or service providers supporting the workshop.
3. Why do we use your personal data?
We use personal data to register participants, manage seats and secure payment, communicate confirmations and reminders, plan meals and safety arrangements, deliver the workshop, record attendance, issue certificates, handle billing and refunds, maintain service security, keep business records and comply with law.
We use contact details for future-programme marketing in line with the marketing consent confirmed during registration. Photography or video for documentation and publicity is covered by the consent confirmed during registration. You may withdraw either consent at any time after registering.
4. Required, optional and sensitive information
Names, contact details, participant role, dietary selection, required confirmations and payment information needed to complete a paid booking are obligatory. If they are not supplied, WhyteHouse may be unable to process or complete the registration.
Optional fields, such as allergy information and billing details, may be left blank. The consent confirmations shown during registration — including marketing updates and photography/video — must all be agreed to before a registration can be completed. You may withdraw the marketing and photography/video consents at any time afterwards without affecting your existing registration.
Allergy information is optional and may reveal health information. It is treated as sensitive personal data and processed only with express consent for meal and safety planning.
5. Group registrations
A lead registrant must:
- show each participant this notice before submitting their details;
- be authorised to provide those details;
- obtain express permission before entering allergy information; and
- accurately record each participant's optional choices where applicable.
Each participant retains their own privacy rights and receives a link to this notice with their confirmation email.
6. Who may receive or process your personal data?
Access is limited according to operational need. Personal data may be received or processed by:
- restricted WhyteHouse administrators;
- AWWA personnel involved in workshop delivery;
- venue, catering and certificate support personnel on a need-to-know basis;
- CHIP for hosted payment processing;
- Resend for transactional email delivery;
- DigitalOcean for application hosting;
- Cloudflare for Turnstile security and encrypted R2 backup storage; and
- professional advisers, regulators, courts or law-enforcement bodies where required or permitted by law.
Payment credentials are entered on CHIP's hosted service and are not stored by this website.
7. Processing outside Malaysia
Relevant personal data may be processed in Singapore or other locations used by service providers. WhyteHouse remains responsible and uses reasonable contractual, access-control, encryption and organisational safeguards for transfers outside Malaysia.
8. How do we protect your personal data?
We use role-restricted administration, authenticated access, encryption in transit, encrypted backups, security monitoring and service-provider controls. No internet service is completely risk-free; suspected incidents are investigated and handled according to applicable law.
9. How long do we keep personal data?
- Incomplete or unsuccessful attempts
- Up to 90 days after the registration or payment attempt expires.
- Allergy and dietary information
- Up to 30 days after the workshop, unless an incident or legal obligation requires longer retention.
- Registration and workshop records
- Up to 24 months after the workshop for attendance, certificates and programme administration.
- Financial and compliance records
- Up to 7 years for payment, invoice, refund, accounting, consent and compliance evidence, or longer where legally required or needed for a dispute.
- Marketing details
- Until consent is withdrawn or after 24 months without engagement, whichever occurs first.
- Encrypted backups
- Removed through the configured backup lifecycle, normally within 90 days.
Once personal data is no longer required, it is securely deleted or anonymised. A legal claim, investigation, statutory obligation or unresolved transaction may require the affected record to be kept longer.
10. Your choices and rights
You may contact WhyteHouse to ask what personal data we hold, request access or correction, withdraw consent, object to or limit non-essential processing, request deletion where no legal reason requires continued retention, or raise a privacy complaint.
We may request reasonable identity verification before disclosing or changing personal data. Withdrawing consent does not affect processing that lawfully occurred before withdrawal.
11. Changes to this notice
We may update this notice when the programme, law or service providers change. A material change will be identified by a new version or effective date and, where appropriate, communicated directly.
12. Contact and complaints
Send privacy requests or questions to hq@whytehouse.edu.my. Our published contact location is Sungai Nibong, Penang, Malaysia.
If your concern is not resolved, you may contact the Personal Data Protection Commissioner of Malaysia.