2. Personal Information We Obtain From Third Parties

In addition to the Personal Information that we and our Partners collect directly from you, including through your interaction with the Sites and your participation in Programs and other services that we and our Partners offer, we collect some Personal Information from third parties.

3. Certain Generally-Applicable Uses of Personal Information

In addition, all of the Personal Information we collect directly and from third parties may be used for the following additional purposes, all of which are related to the operation of our business and our provision of Our Services:

• Our and our Partners’ internal record-keeping;
• To enable us or our Partners to contact you by e-mail, text or phone for any of the above reasons;
• Where necessary as part of any restructuring of the Keypath Group;
• For compliance with legal, regulatory, and other good governance obligations;
• To convert Personal Information into pseudonymous and/or anonymous data, and use it (normally on an aggregated statistical basis) for research and analysis;
• To gain insight that enables us and our Partners to measure the effectiveness of Our Services;
• To learn about potential and current students, their interests, needs and resources applicable to the Programs, so that we can improve the Programs and provide you and others with better services; and
• To evaluate potential and current students’ needs and resources applicable to the Programs, and to tailor our marketing messages to your and their specific interests, needs, and abilities.

When we use your Personal Information for our business purposes, those business purposes include working with our Partners to make Programs available, responding to your, our students’ and potential students’ comments and complaints, marketing our and our Partners’ products and services, improving and developing new products and services, and ensuring the productivity, functionality, and security of the Site.

D. How Long We Keep Personal Information.

We will keep your Personal Information as long as we have a business need to do so and/or as necessary to meet the purpose for which the information was collected and used, unless a longer period is required by law or by contract with our Partners. For example, we will keep Personal Information for at least as long as you continue to be enrolled in any Program. And, if any Site allows you to create an account, we will keep the Personal Information associated with your account for as long as you maintain it. Business needs for which Personal Information may be retained include legal, tax, accounting, risk management, and other business purposes.

All applicant, enrollment, and student details will be kept for at least as long as we continue to provide services to our Partners, unless we agree otherwise with the Partners. Once we cease to have a relationship with our Partners, our practice is to de-identify all Personal Information we have learned in the course of that relationship.

It is important to note that some information may be made public. For example, with your consent we may use your image and testimonials in promotional materials. Accordingly, your information will be able to be seen and republished for as long as the marketing materials continue to be posted online, or as long as the hard copies remain in existence. In addition, we or our Partners may make available services that enable you to post information on the Sites, in public forums and on message boards. In these cases, once posted the information will be able to be seen and republished by others for as long as the web page remains active. Even if web pages are deleted, they may continue to be accessed if they are archived or cached. Therefore, you should think carefully before giving your consent to the use of your name, image, and comments in any materials and, if applicable, before posting anything in any public area of the Sites.

HOW WE COLLECT AND USE NON-PERSONALLY IDENTIFIABLE INFORMATION

A. What Is Non-Personally Identifiable Information?

Non-personally identifiable information refers to information that is not and cannot be used to identify a specific individual, including when combined with other data and stored information. This may include information about the statistical characteristics of the visitors to the Sites or persons who enroll in Programs. While this information may define how you fit into a particular group of people, it is not unique to you, and it cannot be used (without other information) to specifically identify you. This section describes how we collect and use non-personally identifiable information.

B. The Non-Personally Identifiable Information We Collect and Why.

When you visit the Sites or interact with us electronically (such as through email), we may automatically collect standard internet and website log information, and details of patterns about how the Site visitors behave. This information includes your internet service provider name, your operating system, your browser type and browser language, the IP address of your computer or other device (unless such IP address can be used to identify you), your access times, the website that referred you to the Sites, the specific web pages you visit and the date and time of those visits, and links clicked as you visit the Sites.

We use this information to evaluate the Site, to find out which parts of the Site are popular or that may need improvement, and to enhance your and others’ Site experiences.

C. Cookies and Other Tracking Technologies.

The Site utilizes “cookies”, anonymous identifiers and other tracking technologies such as web beacons, which enable us to distinguish you from other users and provide you with information that is customized for you. For more information, see the “Cookie Policy” section of this Privacy Policy.

D. Analytics Services.

The Site may use analytics tools and services to collect information about use of the Site, such as how often users visit the Site, what pages they visit when they do so, and what other sites they used prior to visiting the Site. We use the information we collect from the analytics services to maintain and improve the Site and our and our Partners’ services. The analytics services we use include Google Analytics, Facebook Ads, and others.

E. Anonymous Information.

Anonymous information refers to information that does not enable identification of an individual user, such as aggregated or demographic information. We may use anonymous information or disclose it to third party service providers to improve the Sites and our and our Partners’ services. We may also disclose anonymous information to third parties, including market research firms.

COOKIES POLICY

A. What Are Cookies?

Cookies are small amounts of data that are stored on your browser, device, or the page you are viewing when you visit a website. Some cookies are deleted once you close your browser or application (session cookies), while other cookies are retained even after you exit so that you can be recognized when you return (persistent cookies). Cookies do not typically contain any information that directly personally identifies a user, but may become Personal Information (that is, information that identifies a specific person) when combined with other data and stored information.

B. How We Use Cookies.

We use both session and persistent cookies on the Site. The cookies we use are generally divided into the following categories:

• Mandatory cookies: These are cookies that are required for the operation of the Site, such as cookies that enable you to log into secure areas.
• Functional cookies: These are cookies that remember choices that you make when you visit the Site such as language options. They help to make your visit more personal and assist your navigation of the Site.
• Analytics/Marketing cookies: These are cookies that automatically collect information about your use of the Site, such as the pages you visit, and the links you followed. These help us recognize previous visitors to the Site, and understand how many people are using the Site and how they navigate through it. As mentioned above, we use analytics services to analyze user behavior, so these third parties will place these types of cookies on the Site.

C. Your Choices About Cookies.

If applicable, our Sites may show a cookies consent pop-up. This cookie consent pop-up may only appear on your first visit to the relevant Site, however you may change or withdraw your consent in relation to cookies at any time by contacting us using the information provided in this Policy.

Most web browsers automatically accept cookies, but you can usually change your settings to prevent that, such as by having your device warn you each time a cookie is being sent or choosing to turn off all cookies. On the Site, you will be able to accept all cookies, accept some cookies, or decline all cookies other than mandatory cookies. This can be done through your web browser settings, and because each browser is different, you should look at your browser’s “Help” menu to learn how to modify your cookie settings. There are also online resources that may help you learn more how to opt out of targeted behavioral advertising from many major third party network advertisers.

If you do disable cookies from your browser you may not be able to access certain sections of the Site that use essential cookies, and this may make your experiences on the Site less efficient.

D. Do Not Track Requests.

Currently, certain browsers, including Firefox, Google Chrome, Safari and Internet Explorer, offer a “do not track” (DNT) option. This option, using a technology known as a DNT header, sends a signal to websites visited by the user about the user’s DNT preference, if any, set on the browser. However, we do not currently commit to responding to browsers’ DNT signals. We cannot make this commitment because no common industry standard for DNT has been adopted by industry groups, technology companies, or regulators.

HOW WE MAY SHARE INFORMATION

A. Sharing Information with our Partners.

We collect, use, and process your Personal Information on behalf of our Partners, and accordingly, it will be shared with the Partners for all purposes consistent with this Privacy Policy, including to process applications and enrollment materials and to fulfill our contractual relationship with the Partners and the Partner School. In addition, we may also collect and share your Personal Information with the Partners so that we can collaborate with them to develop, deploy, and deliver additional Programs and courses, and to facilitate flexible online learning.

Please note that we have no control over how the Partners use Personal Information and other information we share with them. Our Partners have their own privacy policies, and their collection and use of your Personal Information is subject to their policies, which will be different from this Privacy Policy.

B. Sharing Information with Others.

In addition to sharing information with our Partners (as discussed above) we may share information with other third parties in the following circumstances:

• We may share your information, including Personal Information, to third party service providers to whom we may outsource our marketing activities, so that we or others may provide you with periodic mailings, or may contact you regarding products, services, or events.
• We may employ other companies and people to perform tasks on our behalf and we may need to share Personal Information with them in order to provide Our Services to you. For example, such parties may handle our data management and/or email distribution. Unless we tell you differently, they do not have any right to use your Personal Information beyond what is necessary to assist us.
• We may share information, including Personal Information, with our corporate affiliates in the Keypath Group for our and their legitimate business purposes, including the potential expansion and promotion of our and their product and service offerings, and other uses consistent with the purposes described in this Privacy Policy. Other companies in our group and some of our service providers are located outside of Malaysia. As a result, personal information collected and held by us may be disclosed to recipients in other countries, including recipients located in the United States, the UK, Philippines, Singapore and Canada. We will not disclose your Personal Information to third parties outside Malaysia without first taking all reasonable precautions and exercising all due diligence to ensure the personal data will not be processed in the receiving jurisdiction in a manner which contravenes the Malaysian legislation.
• We may share your Personal Information with your employer, if your employer is paying for your enrollment in a Program.
• We will share Personal Information with third parties for other purposes if we have your express “opt-in” consent to do so, which may include other Universities or partner schools.
• We may disclose non-personal, aggregate, anonymous data in a de-identified format for any legitimate business purpose.
• We may disclose Personal Information at the request of law enforcement or government agencies or in response to subpoenas, court orders, or other legal process to establish, protect, or exercise our legal or other rights or to defend against a legal claim, or as otherwise required or allowed by law.
• We may disclose Personal Information if we believe that such action is appropriate to (a) protect the rights, property, or safety of a user of the Site or any other person, (b) investigate or prevent a violation by you of any contractual or other relationship with us or our Partner School, (c) investigate or prevent your actual or potential illegal, fraudulent, or harmful activity, or (d) detect, prevent, or otherwise address fraud, security, or technical issues.
• We may share information, including Personal Information, in connection with, during negotiations of, or as a part of the closing of any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.

We will never sell your Personal Information.

SOCIAL SHARING FEATURES AND THIRD PARTY WEBSITES

The Site may offer social network and similar sharing features, such as Facebook, Twitter, Instagram, and YouTube buttons, which let you share information related to the Site, our Partner School, and/or the Program(s) you enroll in through your preferred social media platforms. In addition, the Site may include links to other third party websites. Those sites, and the third parties’ use of any data that may be collected by those sites, is not governed by this Privacy Policy. You should always review the privacy policies and data notifications of any site you visit before submitting your Personal Information.

If you permit a connection between the Site and your social network page(s) or another third party site, we (and the other site operator) may be able to identify you, and associate the information we (and they) receive with information we (and they) already have about you. In addition, depending on how you use those features and your settings with the social network or other third party site, the information you share may be available to others, including your friends and/or the public. For more information about how your information may be shared through those social networks and other third-party sites once it is provided to them, you should review the privacy policies of those social networks and other third party sites.

Our Security Measures

The Keypath Group uses a variety of industry-standard security measures to maintain the safety of your Personal Information, including measures designed to secure your Personal Information from accidental loss and from unauthorized access, use, alteration and disclosure. We store the Personal Information you provide on secure (password- and firewall-protected) servers.

The Keypath Group has developed and maintains information security policies and supporting procedures to protect Personal Data, as well as undertaking an annual security awareness training program and deploys periodic phishing simulations for all employees.

The Keypath Group currently holds SOC2 Type II Certification.

The Keypath Group’s cybersecurity team deploys and maintains technical measures to protect the Keypath Group and its Partners’ information assets including data encryption, Multi-Factor Authentication (“MFA”), network and endpoint security, protection of privileged accounts, and regular third-party vulnerability scans and penetration tests.

Unfortunately, no electronic data transmission over the Internet can be guaranteed to be 100% secure. As a result, while we believe that we use reasonable measures to protect Personal Information, we cannot ensure or warrant the security of any information transmitted or otherwise provided to us or received from us.

If any portion of the Site allows you to create an account, it will be your responsibility for keeping your account and password confidential. We will never ask for your password (except, if applicable, when you create your account and log into the Site).

YOUR RIGHTS REGARDING YOUR INFORMATION

A. General Rights.

If you have any questions regarding this Privacy Policy or our use of your Personal Information, you can contact our Confidentiality and Security Team by email at cst@keypathedu.com or by phone at +60327052662. In addition, you can also contact us at any time at cst@keypathedu.com to request for access to, request for a copy of, and request that we make any edits to your Personal Information.

If, where applicable, you have an account on any Site, you can access and edit your account information online, by signing into your account and selecting the information you want to edit.

As noted above, we have standard retention practices with respect to the Personal Information we collect. If you would like to request any earlier removal of your Personal Information, please contact us at cst@keypathedu.com. Please note that we may not be able to completely remove Personal Information from the Site or our systems in certain circumstances. This will be true if the data is not in a searchable format, if it is retained in backup systems or cached or archived pages, if we need it to prevent fraud or future abuse, or if we are required by law to keep it.

B. Your Rights Regarding Direct Marketing.

As noted above in this Privacy Policy, we may use your Personal Information to provide you with marketing and promotional information about our and our Partners’ products and services. These promotions may be made by mail, email, telephone, instant messaging application, or text (SMS) message, or other methods that may become relevant or available.

When providing us with a phone number, you will be requested to give your express consent to be called and/or texted by us or by our Partners at the number you provide. These calls and messages will contain information in relation to Our Services and/or information about the Partners, Program(s), and/or course(s) you may be interested in or that may be of interest based on your indicated preferences. You understand that these calls may be generated using an automated technology, including, by way of example, auto-dialer and click-to-dial technologies. These calls may be recorded for quality assurance and training purposes. Your consent to receive calls or texts is not required in order to enroll in any Program or receive any educational or related services from our Partner School. If you provide your consent for direct marketing communications, you will be able to change your mind and withdraw your consent at any time.

All promotional materials that are sent using electronic means will include a simple means for you to stop receiving further communications. For example, we may provide you with an “unsubscribe” link, a method to unsubscribe from text (SMS) communications, or an email address to which you can send an opt-out request.

You can manage your consent preferences with respect to direct marketing activities by contacting us at cst@keypathedu.com.

Please note that despite your phone and email preferences, we may need to contact you regarding your enrollment at our Partner School, as required by law, or regarding legal matters. However, we will not send you marketing communications if you have opted out of receiving them.

A NOTE ABOUT CHILDREN AND MINORS

The Site is not targeted to, and we have no interest in collecting information from, children, and we do not knowingly gather any Personal Information from children under the age of 13. If you are a parent or a legal guardian who believes that your minor child provided us with any Personal Information, please contact us at cst@keypathedu.com.

If you are under the age of 18, you shall not provide your Personal Information to us without first obtaining the consent of your parent or legal guardian. Where you submit your Personal Information to us, we will take it that your parent or legal guardian has consented to the provision of your Personal Information to us.

CHANGES TO THIS PRIVACY POLICY

We may make changes to this Privacy Policy. Any modifications will be effective when the changes are posted to the Site. You can review the most current version of this Privacy Policy at any time by accessing the section of the Site labeled Privacy Policy, and you can determine when this Privacy Policy was last revised by referring to the “Last Updated” legend at the top of this Privacy Policy. You are expected to check this Privacy Policy from time to time to take notice of any changes.

LANGUAGE OF THIS PRIVACY POLICY

In accordance with the requirements of Section 7(3) of the Malaysian Personal Data Protection Act 2010, this Privacy Policy is to be issued in both English and Bahasa Malaysia. In the event of any inconsistencies or discrepancies between the English version and the Bahasa Malaysia version, the English version shall prevail.