Privacy Policy

Definitions

Key terms used in this policy are defined below to help you understand how we handle information and what each processing activity entails.

Personal data means any information that relates to an identifiable individual, such as name, contact details, job title, and professional records provided for training registration or account management.
Processing refers to any operation performed on personal data, including collection, storage, use, disclosure, retention, and deletion conducted in support of training services and platform operation.
User denotes any individual who accesses CareerHubStep services, registers for courses, interacts with content, or is represented by an organizational account.
Service refers to the training programs, learning platform features, assessments, reporting tools, and related administrative functions provided by CareerHubStep.
Cookies are small data files placed on a device to support session management, preferences, analytics, and content personalization for platform users.

Data collection

We collect data that is necessary to deliver training services, manage accounts, fulfill contractual obligations, and improve the platform. Data collection is limited to what is relevant and proportionate for those purposes.

Data you provide

Information you voluntarily submit when registering, enrolling, or communicating with us is used to administer services and maintain client relationships.

Full name and preferred name
Contact details including email address and telephone number
Employment details such as job title, employer, department and professional background
Curriculum vitae, certifications and training history supplied for course placement
Account credentials and profile information for access to the learning platform
Payment and billing information necessary to process course fees and invoices

Automatically collected data

When you use our platform, we automatically collect technical and usage information to maintain and improve service availability and user experience.

Device and browser information, including user agent strings
IP address and approximate location inferred from network data
Usage data such as pages visited, session duration and feature interactions
Performance and error logs that support technical troubleshooting
Cookie identifiers and anonymized analytics metrics
Time stamps related to account activity and course progress

Third-party sources

We may receive information about you from trusted partners and service providers that support service delivery and compliance.

Payment processors and business service providers for billing purposes
Cloud hosting and infrastructure vendors that store and process platform data
Analytics and reporting providers that supply aggregated usage insights

Purposes of processing

We process data to operate the platform, provide training services, meet legal obligations, and improve service quality. Processing is based on specific lawful bases and legitimate interests.

Account creation, authentication and profile management
Program enrollment, scheduling, delivery and assessment of training services
Billing, invoicing and business administration for paid services
Customer support, communications and service notifications
Platform improvement through analytics, testing and research activities
Compliance with legal obligations and industry standards
Security, fraud prevention and incident response
Organizational reporting to support HR and learning strategy

Legal bases for processing

We rely on relevant legal bases to process personal data depending on the activity; these bases are described below to clarify lawful processing grounds.

Performance of a contract: processing necessary to deliver services you requested or to manage an organizational agreement
Legitimate interests: for platform operation, security, analytics and business improvement where interests are balanced against individual rights
Consent: where required for optional features such as marketing communications or specific data uses
Legal compliance: processing required to meet statutory obligations or respond to lawful requests from authorities

Regulatory standards and data subject rights

For individuals whose rights are governed by applicable data protection regulations, CareerHubStep respects statutory rights including access, rectification and objection. Requests are handled promptly according to legal timeframes.

Right to access personal data we hold and to request a copy
Right to rectify inaccurate or incomplete personal data
Right to request erasure of personal data where processing is not required by law or contract
Right to restrict or object to certain types of processing, subject to legal and contractual constraints
Right to data portability in structured, commonly used machine-readable formats where applicable
Right to withdraw consent at any time for processing activities based on consent, without affecting prior lawful processing

Cookies and tracking

Cookies and similar technologies help us deliver a secure and personalized learning experience. We use a mix of essential, functional and analytics cookies.

Cookies used include session cookies for authentication, persistent cookies for preferences, and third-party cookies for analytics and performance measurement.

Categories: essential (required for service), functional (preferences and settings), analytics (usage tracking), and marketing (optional third-party providers).

You can manage cookie preferences through your browser settings or via the cookie control tool available on our website. Disabling certain cookies may affect platform functionality.

Full cookie policy

Data sharing and disclosures

We share personal data only with entities that help deliver our services or where required for legal reasons. All third-party relationships are governed by data protection commitments.

Service providers and subcontractors supporting platform hosting, payment processing and analytics
Affiliates or partners engaged to deliver specific program components or assessments
Regulators, law enforcement or courts where disclosure is required by law
Professional advisors and auditors who support corporate compliance and business reporting
Prospective acquirers or partners during a business reorganization, subject to confidentiality safeguards
Human resources or procurement teams of client organizations for participant verification and program administration

International transfers

CareerHubStep may transfer personal data to jurisdictions outside Malaysia to enable service delivery and to engage global service providers. Transfers occur only where appropriate safeguards are in place.

We use contractual protections, data processing agreements, and, where applicable, recognized transfer mechanisms to protect personal data when it is transferred internationally.

Data retention

We retain personal data for as long as necessary to provide services, meet contractual obligations, and comply with legal requirements. Retention periods are periodically reviewed.

Account and profile information is retained for the duration of the active account plus a reasonable period for administrative and legal purposes, typically up to seven years where required for business records.

Communications and support correspondence are retained for the period necessary to resolve matters and maintain service quality, usually for at least two years unless otherwise required.

Technical logs and analytics data are retained in aggregated or anonymized form for performance monitoring and product improvement; raw logs are retained for a limited period for operational troubleshooting.

When personal data is no longer required, we securely delete or anonymize it in accordance with our retention schedules and applicable legal obligations. You may request deletion subject to contractual or legal constraints.

Data Security and Confidentiality

CareerHubStep implements administrative, technical and physical measures designed to protect personal data relevant to professional development training activities. Measures include role-based access controls, encrypted storage for sensitive records, secure transmission protocols (TLS) for data in transit, routine security assessments, and staff training on data handling principles. Retention periods are limited to what is necessary for training delivery, recordkeeping and compliance obligations. We continuously review controls in line with industry practice and regulatory expectations to reduce risk and maintain operational integrity.

Encryption of sensitive data in transit and at rest
Access controls and audit logging limited to authorised personnel
Regular security reviews, patch management and staff awareness training

Your rights

As a participant or visitor, you have specific rights regarding your personal data. These rights enable you to understand, access and manage the information CareerHubStep holds about you. Requests are handled in a structured manner to ensure timely and appropriate responses.

Right to access personal data we hold about you
Right to request correction or update of inaccurate information
Right to request deletion of personal data where lawful and appropriate
Right to request restriction of processing in specific circumstances
Right to withdraw consent for processing where consent is the legal basis
Right to data portability for data you provided in a structured, commonly used format
Right to object to direct marketing processing
Right to lodge a complaint with a supervisory authority if you believe your rights are not respected

How to Exercise Your Privacy Rights

To submit a request to access, correct or manage your personal data, contact CareerHubStep using the details below. Provide sufficient information to locate the records (full name, training reference or email used to register) and the nature of your request. We will verify your identity before taking action to protect your information and the rights of others. For written requests, include a clear statement of the remedy you are seeking.

[email protected]

We aim to acknowledge routine requests within 7 business days and to complete substantive requests within 30 calendar days where feasible. Complex or cross-border requests may require additional time; you will be informed if an extension is necessary.

Marketing Communications

CareerHubStep may contact you with information about relevant training opportunities, programme updates and administrative notices where you have opted in or where contact is necessary for enrolment and service delivery. Marketing communications are sent based on the communication preferences you set in your account or during registration.

To stop receiving marketing messages, use the unsubscribe link in any marketing email or update your preferences via your account on CareerHubStep.pro. You may also contact us to manage your communication preferences; transactional and service-related messages may continue where necessary for delivery of purchased services.

Children and Minors

CareerHubStep is intended for adult learners and professional development participants. We do not knowingly collect personal data from individuals under 16 years old without verifiable parental or guardian consent. If we become aware that we have collected data from a minor without appropriate consent, we will take steps to delete the information in accordance with applicable law.

Links to Third-Party Sites

Training materials and platform pages may contain links to external websites and services. CareerHubStep is not responsible for the privacy practices or content of third-party sites. Review the privacy policy of any external site you visit. Third-party integrations used to deliver services will be disclosed where they process personal data on our behalf.

Policy Updates

This Privacy Policy may be updated to reflect changes in practices, legal requirements or service enhancements. Material changes will be posted on CareerHubStep.pro with the effective date. Continued use of our services after an update indicates acceptance of the revised policy.