Privacy Policy

Privacy Policy

Effective 1 July 2026 Governed by Malaysia PDPA 2010

01 Who we are

Q Lab Academy is the training brand of Q Lab Sdn Bhd (Company Registration No. 930345-V) (“Q Lab”, “we”, “our” or “us”), a subsidiary of the Malaysian Software Testing Board (MSTB). Q Lab specialises in Software Quality Assurance training, with a core focus on Requirements Engineering, Software Testing, testing tools, and test process frameworks. Q Lab Sdn Bhd is the data controller responsible for your personal data.

This policy explains how we collect, use, share, store and protect your personal data, and your rights, in line with Malaysia’s Personal Data Protection Act 2010 (“PDPA”) and its amendments.

02 What this policy covers

This policy applies to personal data we collect through our website (qlsb.my), our course registration and enquiry forms, the delivery of our training, and our communications with you.

03 The personal data we collect

  • Identity and contact details: your name, job title, email address, phone number, and the organisation you work for.
  • Registration and billing details: company name and address, payment/billing information, and HRD Corp employer and claim details where applicable.
  • Identification numbers: your NRIC or passport number, which we collect where needed for HRD Corp grant claims and to issue your certificate. We use these numbers only for those purposes.
  • Training records: attendance, assessment or examination results, and certification records.
  • Special requirements you tell us: for example dietary or accessibility needs for in-person sessions (see “Sensitive personal data” below).
  • Website and technical data: IP address, browser type, and cookie data when you use our website.

04 How we collect your personal data

  • Directly from you, when you fill in a form, email or call us, or attend a session.
  • From your employer or a colleague, when they register you for a course.
  • Automatically, through cookies and similar tools when you use our website.
  • From third parties, such as HRD Corp, where relevant to a grant claim.

05 Why we use your personal data

  • To process your registration and manage your place on a course.
  • To deliver the training and issue certificates.
  • To process payments and, where applicable, HRD Corp grant claims.
  • To respond to your enquiries and provide support.
  • To meet our legal, tax and regulatory obligations.
  • To send you course updates, newsletters or event invitations, only where you have agreed to receive them.

We will only use your personal data for the purposes above, or for a directly related purpose.

06 Our legal basis

We process your personal data on the basis of your consent, the need to perform our contract with you (or your employer), and our legal obligations. By submitting your details through our forms, you consent to us processing your personal data as described in this policy.

07 Sensitive personal data

The only sensitive personal data we collect is the health or accessibility information you choose to share so we can support you at in-person sessions: for example, dietary requirements or accessibility needs. Under the PDPA this requires your explicit consent, and we use it only for that purpose. We do not collect any other sensitive personal data.

08 Sharing your personal data

We may share your personal data with:

  • our trainers and associates who deliver the course;
  • certification bodies (such as IREB and TMMi) to register examinations and issue certificates;
  • HRD Corp, for grant claims;
  • our service providers who support our operations, specifically our payment gateway, cloud storage, and website hosting providers;
  • professional advisers, and regulators or authorities where required by law.

We share personal data only with parties that need it for the purposes above, and we do not sell your personal data.

09 Where your data is stored, and transfers outside Malaysia

Your personal data is stored both in Malaysia and outside Malaysia. Some of our service providers (such as our cloud storage and website hosting providers) hold data on servers located overseas. Where personal data is processed outside Malaysia, we take reasonable steps to ensure it is protected to a standard consistent with the PDPA.

10 Cookies and website analytics

Our website uses cookies to make the site work and, through Google Analytics, to understand how the site is used so we can improve it. When you first visit, a cookie-consent banner lets you accept or decline non-essential cookies, including analytics cookies.

11 Marketing communications

We will only send you marketing, such as course updates, newsletters or webinar invitations, if you have opted in. You can unsubscribe at any time using the link in our emails or by contacting us.

12 How long we keep your personal data

We keep your personal data only for as long as necessary for the purposes in this policy and to meet legal and tax requirements:

  • Training and certification records: kept for five (5) years.
  • Marketing contact details: kept until you unsubscribe, and in any case no longer than five (5) years of inactivity.
  • Financial and tax records: kept for seven (7) years, as required by Malaysian law.

After these periods, we securely delete or anonymise the data.

13 Keeping your personal data secure

We use appropriate organisational and technical measures to protect your personal data against loss, misuse and unauthorised access. Only staff and partners who need access for the purposes above are given it.

14 Your rights

Under the PDPA, you may:

  • request access to the personal data we hold about you;
  • ask us to correct it if it is inaccurate or out of date;
  • withdraw your consent at any time;
  • ask us to stop using your data for direct marketing;
  • where applicable, request a copy of your data (data portability).

To exercise any of these rights, please contact us using the details in section 16. We will respond within the timeframe required by law.

15 Data breaches

If a data breach occurs that is likely to cause you significant harm, we will notify the Personal Data Protection Commissioner and, where required, the affected individuals, in line with the PDPA.

16 How to contact us

For any questions about this policy, or to exercise your rights, please contact us:

Q Lab Academy
G-03A-5, Setiawalk, Persiaran Wawasan, 47160 Puchong, Selangor, Malaysia
Email: info@qlsb.my
Phone: +603-2741 1958
Website: qlsb.my

17 Language

This policy is published in both English and Bahasa Malaysia, as required by the PDPA. If there is any inconsistency between the two versions, the English version shall prevail.

18 Changes to this policy

We may update this policy from time to time. The current version will always be available on our website, with the effective date shown below.

19 Effective date

This version of the policy takes effect on 1 July 2026.

Privacy question?

Email us at info@qlsb.my and a human will reply within one business day.

Read terms Contact us →