Personal Data Protection Notice

1. About This Notice

This Personal Data Protection Notice ("Notice") is issued pursuant to Section 7 of the Personal Data Protection Act 2010 ("PDPA 2010" or "Act 709") of Malaysia. It describes how Adcellent Biz Sdn Bhd processes personal data collected in connection with the ESG gen platform (https://esggen.my).

By registering or using ESG gen, you acknowledge that you have read and understood this Notice. Please also read our Privacy Policy for further details on data handling practices.

2. Data Controller

Adcellent Biz Sdn Bhd (Company No. 1511714-V)
D13-07, Menara Suezcap 1, KL Gateway, Jalan Kerinchi
59200 Kuala Lumpur, Malaysia
Tel: +6011-3318 4600
Email: hello@adcellent.com.my

3. Personal Data We Process

4. Purposes of Processing

Under Section 6 of the PDPA 2010, we process your personal data for the following purposes:

1. To register and maintain your account on the ESG gen platform;
2. To deliver ESG reporting, gap analysis, carbon calculator, industry benchmarking, and report generation services;
3. To generate ESG compliance reports for submission to Bursa Malaysia or other regulatory bodies;
4. To send transactional communications (account activation, password reset, subscription notices);
5. To maintain an audit trail for compliance and regulatory purposes;
6. To monitor platform security, detect fraud, and prevent unauthorised access;
7. To improve the platform through aggregated and anonymised analytics.

5. Consent

By registering an account on ESG gen, you expressly consent to the collection, use, and disclosure of your personal data for the purposes stated in Section 4 above, in accordance with the PDPA 2010.

You may withdraw your consent at any time by contacting us at hello@adcellent.com.my. Please note that withdrawal of consent may affect our ability to provide some or all of the Platform services to you, and may be subject to applicable legal or contractual retention obligations.

6. Mandatory or Optional Provision

Mandatory

The following data is required to create and use your account:

• Full name
• Email address
• Password

Optional

The following data is collected only when you choose to provide it:

• Phone number
• Bursa Malaysia sector
• Company revenue tier and employee count

7. Consequences of Not Providing Data

If you do not provide the mandatory personal data listed in Section 6, we will be unable to create your account or deliver the Platform services described in this Notice. Optional data, if not provided, may result in reduced functionality (e.g., sector-specific benchmarking will not be available without a Bursa sector selection).

8. Disclosure

Your personal data may be disclosed to:

1. Other authorised users within your company account, as configured by the account owner (e.g., a consultant assigned to your company will be able to view your ESG data);
2. Hostinger International Ltd., our hosting provider, solely for the purpose of hosting and maintaining the Platform;
3. Malaysian regulatory authorities, courts, or law enforcement where required by applicable law, court order, or government regulation.

We will never sell, rent, trade, or otherwise disclose your personal data to any other third party without your explicit consent.

9. Data Transfer

Your personal data is stored on servers operated by Hostinger International Ltd. Hostinger maintains data centres that comply with applicable data protection standards. Where data is processed outside Malaysia, we take reasonable contractual and technical steps to ensure adequate protection consistent with the requirements of the PDPA 2010.

10. Security and Retention

We implement administrative, technical, and physical security measures appropriate to the nature of the personal data processed, including:

• Passwords stored using bcrypt hashing (one-way; original passwords are never stored);
• HTTPS (TLS) encryption for all data transmitted between your browser and our servers;
• Session-based authentication with CSRF token protection;
• Role-based access control ensuring users can only access data they are authorised to view.

Retention Periods

11. Your Rights Under the PDPA

Under the PDPA 2010, you have the following rights:

• Right to Access (Section 30): Request access to your personal data held by us. We will provide a copy within 21 working days.
• Right to Correction (Section 34): Request correction of inaccurate, incomplete, misleading, or out-of-date personal data.
• Right to Withdraw Consent: Withdraw consent to the processing of your personal data, subject to legal obligations and contractual terms. Withdrawal may limit our ability to provide the Platform services.
• Right to Limit Processing: Request that we cease or limit processing of your personal data where processing is no longer necessary for the stated purposes.

12. How to Exercise Your Rights

Submit a written request to hello@adcellent.com.my or by post to the address in Section 2. Please include your full name and the email address associated with your account so we can verify your identity.

• We will respond within 21 working days of receiving your request.
• We may require proof of identity before processing your request.
• Access or correction requests may be subject to a prescribed fee under the PDPA 2010.
• If your request is refused, we will provide written reasons as required by the Act.

If you are dissatisfied with our response, you may lodge a complaint with the Personal Data Protection Commissioner of Malaysia.

13. Contact the Data Controller

For any queries, access/correction requests, complaints, or consent withdrawal regarding your personal data:

Adcellent Biz Sdn Bhd (1511714-V)
D13-07, Menara Suezcap 1, KL Gateway, Jalan Kerinchi
59200 Kuala Lumpur, Malaysia
Email: hello@adcellent.com.my
Phone: +6011-3318 4600