GHGReporting Sdn. Bhd. (Registration No. 20261010355) ("GHGReporting", "we", "us") operates the website ghgreporting.ai and the reporting platform at app.ghgreporting.ai. Our address is 50-04-06, Level 4, Wisma UOA Damansara, No. 50 Jalan Dungun, Damansara Heights, 50490 Kuala Lumpur.
This notice explains how we handle personal data under the Personal Data Protection Act 2010 (PDPA) of Malaysia.
This notice applies to people who visit our website or send us an enquiry, users of the platform at our client and operator organisations, people who sign agreements with us electronically, billing contacts, and anyone who contacts us by email, telephone or WhatsApp.
| Where it comes from | What we collect |
|---|---|
| Enquiry forms on our website | Name, work email, company name, job title, telephone number, company type, number of sites, reporting need and deadline, your message, your consent choices, the page you came from and campaign details |
| Platform accounts | Name, work email, telephone number, job title, organisation, role, sign in records and settings |
| Use of the website and platform | Internet Protocol (IP) address, browser and device type, pages visited, times of access, and actions taken in the platform |
| Electronic signing | Name, job title, email, mobile number, the signature you type or draw, one time code records, IP address, device details and the times you viewed and signed |
| Billing | Billing contact names, emails and telephone numbers, company registration and tax identification numbers, billing address, invoices and payment records. Card and bank account numbers are entered on our payment provider's page and are not stored by us |
| Communications | Emails, call notes and messages you exchange with us |
We use personal data to:
We may use automated tools, including artificial intelligence, to summarise enquiries and suggest information for our team to check. These tools do not make decisions about you, send messages on their own or set prices.
Our clients and operators record waste and operational data in the platform. Some records may include names of their staff or contractors. We handle that data on their behalf and on their instructions, under our agreement with them. If your details appear in such records, please contact the organisation that recorded them; we will help them respond to you.
We do not sell personal data. We share it only with:
Some of our service providers store or process data outside Malaysia. When this happens, we take the steps required by the PDPA so that your personal data receives a comparable level of protection.
| Data | How long |
|---|---|
| Enquiries that do not become clients | Up to 24 months after our last contact, then removed or made anonymous |
| Platform account data | For as long as the account is active, then 90 days for data export, then archived as our agreement with your organisation provides |
| Signed agreements and signing records | 7 years after the agreement ends |
| Invoices, payments and accounting records | 7 years, as tax and company law require |
| Security and access records | 7 years |
We encrypt data in transit and in storage, require two step sign in for our staff, limit access by role and keep a tamper evident record of activity. Our staff can enter a client's account only for a recorded reason; support staff need a time limited approval, and each client's administrators can see a log of every such access to their account.
You may ask to see or correct your personal data, withdraw your consent, limit how we use it, or receive a copy of it in a commonly used format. You can unsubscribe from updates at any time using the link in every update email.
Send requests to Dr Patrick Nyeo, Data Protection Officer, at privacy@ghgreporting.ai, or write to our address above. We will confirm who you are before acting and reply within 21 days. A fee may apply to access requests where the law allows.
If a personal data breach is likely to affect you, we will notify the Personal Data Protection Commissioner and, where required, you, as the PDPA requires.
Fields marked "(required)" on our forms are needed to reply to you or to provide the service. If you do not provide them, we may not be able to respond or set up your account. Marketing consent is always optional.
We may update this notice. The effective date at the top shows when it last changed; we will tell platform users of important changes by email.
This notice is available in Bahasa Malaysia and English. If there is any difference between them, the English version prevails.