Privacy & PDPA Policy

1. Who we are

GPEX Central Sdn Bhd ("GPEX", "we", "us" or "our") is the data controller responsible for the personal data described in this policy. We are a Cambridge English Authorised Platinum exam centre operating in Malaysia (company registration number available on request). If you have any questions about this policy or how we handle your data, you can reach us at hello@gpex.com.my.

2. What personal data we collect

Depending on how you interact with us, we may collect:

• Application form data — for Speaking Examiner, Exam-Day Staff and institutional partner applications. This may include your name, contact details, qualifications, experience, availability and supporting documents you choose to provide.
• Contact details — name, email address and phone number when you make an enquiry or correspond with us.
• e-Invoice and tax details — where we are required to issue a compliant e-Invoice, this may include your Tax Identification Number (TIN), business registration details and billing address.
• Correspondence — the content of messages you send us and our records of our responses.

We ask only for data that is relevant to the purpose for which it is collected, and we tell you at the point of collection whether providing it is necessary.

3. Why we use your data

We process personal data to:

• Receive, assess and respond to your application or enquiry, and communicate with you about it.
• Deliver and administer our services, including exam administration and our work with partner institutions.
• Issue invoices and meet our legal, tax and regulatory obligations — including Malaysia’s LHDN e-Invoicing requirements.
• Maintain accurate records and protect the integrity and security of our operations.

4. Lawful disclosure of your data

We do not sell your personal data. We may disclose it only where it is lawful and necessary, including to:

• The Inland Revenue Board of Malaysia (LHDN) and other government authorities, where required by law — for example, for e-Invoicing and tax compliance.
• Authorised service providers acting on our behalf — such as accounting, tax and IT providers — who are bound to handle data only as we instruct.
• Cambridge University Press & Assessment, where relevant to the administration of Cambridge English exams.

5. Data retention

We keep personal data only for as long as it is needed for the purpose it was collected, or for as long as the law requires us to retain it (for example, tax and accounting records). When data is no longer required, we take reasonable steps to securely delete or anonymise it.

6. How we protect data

We take practical and appropriate measures to protect personal data against loss, misuse, unauthorised access, disclosure or alteration. Access to data is limited to those who need it to do their work, and we require our service providers to apply comparable safeguards.

7. Your rights

Under the PDPA, you have the right to:

• Access the personal data we hold about you.
• Request correction of data that is inaccurate, incomplete or out of date.
• Withdraw your consent to our processing of your data, subject to legal and contractual limits.
• Ask us how your data is being used and to whom it may be disclosed.

Where you withdraw consent or ask us to delete data, please note we may still need to retain certain records to meet our legal obligations.

8. Cookies and fonts

This website uses only minimal, essential cookies needed for it to function. We do not use cookies to build advertising profiles. Our fonts are self-hosted, so loading a page does not share your browsing data with third-party font providers.

9. Consent notices on our forms

Our application and enquiry forms reproduce a specific PDPA consent notice at the point of collection. That notice tells you, in plain language, what data the form collects, why, and how it will be used before you submit — and your submission confirms your consent on those terms.

10. How to contact us

To exercise any of your rights, ask a question about this policy, or make a complaint about how we handle your data, contact us at hello@gpex.com.my. We will respond within the timeframes required by the PDPA. We may update this policy from time to time; the "last updated" date above shows when it last changed.