Taylor’s Education Group (“Taylor’s”, “we”, “us”, or “our”) is committed to protecting your personal data and respecting your privacy.

This Privacy Statement and Personal Data Protection Notice explains how we collect, use, disclose, store, transfer, and protect your personal data when you interact with any Taylor’s Education Group entity, including when you visit our websites, apply to our institutions, enrol as a student, work with us as staff, attend events, or use our services.

By using our websites or providing your personal data to us, you consent to the collection, retention, processing, and use of your personal data in accordance with this Privacy Statement.

About Taylor’s Education Group (the “Group”)

This Privacy Statement is issued on behalf of the Taylor’s Education Group.

For the purpose of this Privacy Statement:

• Educrest Sdn. Bhd. is the parent company of Taylor’s Education Sdn. Bhd. (“TESB”) and the wider Taylor’s Education Group.
• TESB owns and/or manages Taylor’s education institutions and operations, including but not limited to Taylor’s University, Taylor’s College, Taylor’s Schools, Lexel International School, Taylor’s Hostel Management, British University of Vietnam, Taylor’s Education Pte. Ltd., and other related entities (“Group Entities”).

Depending on your relationship with us, different Group Entities may act as a Data Controller (or “data user”) for your personal data. However, personal data may be shared across the Group where necessary for operational, administrative, educational, security, legal and regulatory purposes.

Scope of this Privacy Statement

This Privacy Statement applies to personal data collected through:

• Any of our Taylor’s websites (including www.taylors.edu.my and related institutional websites);
• When you create an account and fill in our online application forms, admissions portals and enquiry forms;
• Student, staff, alumni, parent and visitor records;
• Events, surveys, feedback forms and research;
• Communications with us (email, phone calls, messaging platforms);
• Campus systems including security access and CCTV;
• Any other services and engagements with Taylor’s Education Group.

This Privacy Statement does not apply to third-party websites that may be linked from our websites.

Personal Data We Collect

We may collect, use, store and transfer different kinds of personal data, including but not limited to:

Personal Identification and Contact Data

• Full name
• NRIC/passport number
• Nationality
• Gender
• Date of birth
• Home address / correspondence address
• Email address
• Phone number
• Emergency contact details
• Parent/guardian details (where applicable)

Education and Academic Data

• Educational background
• Qualifications and transcripts
• Programme enrolment details
• Attendance, academic performance and assessment records
• Student ID and related records

Employment and HR Data (Staff and Applicants)

• CV/resume, employment history
• Professional certifications
• Background screening information (where applicable)
• Payroll and tax-related information (where applicable)

Technical and Usage Data

When you visit our website, we may collect technical data such as:

• IP address
• Browser type and version
• Operating system and device type
• Your unique device identifier (UDID) or mobile equipment identifier (MEID) for your mobile device
• Date and time of access
• Time zone setting
• Domain name from which you access the Internet
• Website address from which you linked to our website
• Website browsing actions and usage patterns

We may collect technical data above when you visit or use any TEG Group website or data other Group members collect about you. Information you provide to a member of the TEG Group may be shared between us (for example, when your child is registered as a student in one of our schools, this information could be shared with the other TEG institutions like the College or University). We will also share your personal data for the purposes of the TEG alumni Programme, and any other of our financial schemes you may have signed up to (though will only do so with your consent, where consent is legally required).

Marketing and Communications Data

• Your communication preferences
• Consent records for marketing
• Participation in events and campaigns

Sensitive Personal Data

Where permitted by law and necessary, we may collect sensitive personal data such as:

• Health information (e.g., medical conditions for student support)
• Disability information
• Religious information (where relevant for dietary/accommodation arrangements)
• Biometric data (e.g., for access control if implemented)

We will only process sensitive personal data with your explicit consent or where permitted by law. Where sensitive personal data is processed through AI-enabled systems or automated technologies, Taylor's Education Group shall implement additional safeguards proportionate to the sensitivity of the information involved.

How We Collect Personal Data

We collect personal data through the following means:

• Directly from you, when you register, submit enquiries, apply, enrol, sign up for services, respond to surveys, attend events, or communicate with us.
• Automatically, through your use of our websites and systems (e.g., cookies, IP addresses, browser logs).
• From third parties, such as agents, education partners, scholarship sponsors, referees, employers, government authorities, or service providers, where relevant and permitted.

Providing your personal data is generally voluntary, but in some cases it may be necessary for us to provide services, process applications, or fulfil legal and regulatory obligations.

Purposes for Which We Use Your Personal Data

We use your personal data for purposes including but not limited to the following:

Education and Student Administration

• Processing applications, admissions, enrolments and registrations
• Student administration and academic management
• Delivering teaching, learning, examinations and assessments
• Managing scholarships, financial aid and student support services
• Providing access to student platforms, learning systems and facilities

Employment and HR Administration

• Processing job applications and recruitment
• Staff administration, payroll, benefits and HR operations
• Managing staff training and performance
• Compliance with labour laws and statutory obligations

Group Operations and Centralised Database Management

To support efficient administration and consistent service standards across Taylor’s Education Group, we may:

• collect, consolidate, centralise, store, manage and process personal data in a Group-wide database, including student, staff, alumni, parent/guardian and prospective student information;
• share such information among Group Entities for operational, academic, HR, finance, compliance, reporting and strategic purposes.

Personal data may be processed and shared within Taylor's Education Group where necessary for the purposes described in this Privacy Statement, based on consent where required by law, contractual necessity, legal obligations or other lawful bases, subject to applicable data protection laws.

Communications and Customer Support

• Responding to enquiries, feedback, complaints or requests
• Providing notices, updates and announcements
• Sending administrative communications relating to your relationship with us

Website and Service Improvement

• Ensuring website content is presented effectively
• Administering, supporting, improving and developing our websites and systems
• Measuring the number of visitors to different sections of our websites

Artificial Intelligence ("AI"), Automation and Advanced Technologies

To improve operational efficiency, service delivery, educational support, customer experience, security, analytics, research and administrative processes, Taylor's Education Group may utilise artificial intelligence ("AI"), machine learning technologies, automated tools, data analytics platforms and similar technologies.

Such technologies may be used to:

• process enquiries and requests;
• assist with admissions, enrolment and student administration processes;
• support learning, academic and research activities;
• generate reports, summaries, recommendations and administrative outputs;
• enhance website functionality and user experience;
• improve security, fraud prevention and risk management;
• assist staff in carrying out operational, academic, compliance and support functions.

Personal data submitted to us may be transferred to, stored in, analysed by or processed through AI-enabled systems, cloud platforms, databases or service providers located within or outside Malaysia.

We will implement reasonable safeguards to ensure that any use of AI technologies is consistent with applicable laws, contractual obligations, confidentiality requirements and our data protection policies.

Unless expressly stated otherwise, AI systems used by Taylor's Education Group are intended to support human decision-making and do not solely determine decisions that produce legal or similarly significant effects on individuals.

Marketing and Promotional Activities

• Providing you with information about programmes, services, events, products or offerings which may interest you
• Conducting marketing campaigns and outreach initiatives
  (where you have consented or where permitted by law)

You may opt out at any time (see “Marketing Communications and Opt-Out” below).

Legal, Compliance and Security

• Preventing fraud and misuse of our systems
• Ensuring compliance with laws, regulations, accreditation requirements and government directives
• Managing campus security, visitor management and access control
• Handling disputes and enforcing our rights

Legal Basis for Processing (PDPA + GDPR-Aligned)

We process personal data based on one or more of the following grounds:

• Consent (including explicit consent where required)
• Contractual necessity (e.g., to process admissions, enrolment or employment matters)
• Legal obligations (e.g., regulatory reporting, immigration compliance, taxation)
• Legitimate interests (e.g., administration, security, service improvement, operational efficiency), balanced against your rights (where applicable)
• Vital interests (e.g., emergencies affecting safety and welfare)

Disclosure and Sharing of Personal Data

Authorised personnel within Taylor’s Education Group will be able to access your personal data.

We may also disclose your personal data to third parties, including:

• Other Group Entities (including Educrest Sdn. Bhd. and affiliated companies)
• Service providers and vendors acting on our behalf (e.g., IT systems, cloud services, payment processors, learning platforms, marketing agencies, AI service providers, cloud-based artificial intelligence platforms, machine learning service providers, automation providers, and technology partners supporting operational, academic, administrative, compliance, cybersecurity and customer service functions)
• Professional advisors (e.g., lawyers, auditors, consultants)
• Government agencies, regulators, accreditation bodies and law enforcement where required
• Scholarship sponsors, insurers or partner organisations (where applicable)

We will not sell or trade your personal data.

Unless required or permitted by law, we will not otherwise share, sell or distribute any personal data you provide to us without your consent.

International Transfers of Personal Data

Your personal data may be transferred to, stored in, or processed in countries outside Malaysia, including where:

• Group Entities operate outside Malaysia (e.g., Vietnam, Singapore);
• service providers host systems in other jurisdictions (e.g., cloud hosting).

Please note that some countries may not have the same level of data protection laws as Malaysia.

However, we will take reasonable steps to ensure that any overseas transfer is conducted in accordance with applicable laws, including the PDPA and, where applicable, GDPR principles, by implementing appropriate safeguards.

Data Retention

We will retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including for legal, accounting, regulatory and reporting requirements.

When personal data is no longer required, we will take reasonable steps to delete, anonymise, or securely dispose of such data in accordance with our retention policies and applicable laws.

Security of Personal Data

We take appropriate technical and organisational measures to safeguard personal data against unauthorised access, misuse, loss, alteration, disclosure, or destruction.

These measures may include access controls, password protection, encryption (where applicable), system monitoring, and internal policies restricting access to authorised personnel only.

That said, no method of transmission over the internet or method of electronic storage is completely secure. While we strive to protect your personal data, we cannot guarantee absolute security of any data transmitted to us online. Any transmission is done at your own risk.

Where you have been provided with (or have selected) a password that enables you to access certain parts of our systems or websites, you are responsible for keeping such password confidential and for ensuring it is not shared with any third party.

Cookies, IP Addresses and Website Analytics

When you visit our websites, we may automatically collect certain information about your device and browsing activity, including:

• IP address
• browser type and version
• operating system
• device identifiers
• website usage patterns and navigation behaviour
• date and time of access

This information is generally collected for statistical purposes and is used to help us:

• administer our website and systems,
• improve functionality and user experience,
• monitor performance and security, and
• generate aggregated reports.

Cookies

Cookies are small text files that may be stored on your device when you visit our website. Cookies help us recognise your browser, remember your preferences, and enhance your experience.

Cookies do not normally identify you personally, but they allow us to associate your browser session with certain usage patterns.

You may manage or disable cookies through your browser settings. Please note that if cookies are disabled, certain website features may not function properly.

Marketing Communications and Opt-Out

Where you have consented, or where permitted under applicable law, we may contact you through various channels such as email, telephone, SMS, or other digital platforms for purposes including:

• programme information,
• promotional offers,
• events and activities,
• alumni engagement,
• updates on Taylor’s Education Group initiatives.

You may opt out of receiving marketing communications at any time by:

• using the unsubscribe function (where available), or
• contacting us directly using the contact details in the “Personal Data Protection Officer / Contact Details” section.

Please note that even if you opt out of marketing communications, we may still send you administrative or operational communications that are necessary for your relationship with us (e.g., admissions, enrolment, HR, billing, policy updates).

Disclosure of Personal Data Within the Group (Centralised Database)

Taylor’s Education Group operates as an integrated education group. To support effective administration and consistent service delivery, we may store personal data in a centralised Group database, which may be managed or controlled by Educrest Sdn. Bhd. and/or relevant Group Entities.

This means your personal data may be shared within Taylor’s Education Group for purposes including:

• admissions and enrolment processing,
• student lifecycle management,
• academic and learning support,
• finance, billing and scholarship administration,
• alumni and career services,
• staff management and HR processing,
• compliance reporting and internal audit,
• strategic planning and analytics,
• risk management and legal compliance.

By submitting your personal data to any Taylor’s Education Group entity, you acknowledge and consent to the collection, storage, processing, and sharing of your personal data within the Taylor’s Education Group for these purposes, subject to applicable laws.

Third Party Service Providers

We may engage third-party service providers to support our operations, including IT hosting providers, learning management systems, AI and machine learning service providers, generative AI platforms, automation providers, cloud storage providers, customer support platforms, marketing and communications providers, payment service providers, consultants, and professional advisors.

Where third party service providers process personal data on our behalf, we take reasonable steps to ensure that they are bound by appropriate contractual obligations and maintain adequate technical and organisational measures to protect personal data. Such service providers are required to comply with their own obligations under applicable data protection laws, including any obligations imposed directly upon data processors under the Personal Data Protection Act 2010 and its amendments.

Nothing in this Privacy Statement shall be construed as relieving any third-party service provider or data processor of its independent legal responsibilities under applicable law.

Third Party Links

Our websites may contain links to third-party websites or services that are not operated or controlled by Taylor’s Education Group.

We do not assume responsibility for the privacy practices, content, policies, accuracy, or security of such third-party websites. You are encouraged to review the privacy notices and terms of use of those third-party sites before providing any personal data.

Children’s Personal Data

Taylor’s Education Group recognises the importance of protecting children’s personal data.

Where our websites are accessed by children, we do not intentionally collect personal data from children unless such data is provided with the consent of a parent or guardian, or where collection is necessary for educational administration.

Where required by law or reasonably practicable, consent for the collection and processing of children's personal data shall be obtained from a parent, guardian or person having parental responsibility.

Where a child contacts us (for example, by email), we will use the information provided only to respond to the enquiry and not for marketing purposes unless consent has been obtained.

Your Rights (PDPA + GDPR-Aligned)

You may have certain rights under Malaysia’s Personal Data Protection Act 2010 (“PDPA”), and where applicable, under GDPR principles.

These rights may include the right to:

• request access to your personal data held by us;
• request correction of inaccurate, incomplete, misleading or outdated data;
• withdraw consent for processing (subject to legal and contractual restrictions);
• request deletion or removal of personal data (where legally permitted);
• object to processing for direct marketing purposes;
• request restriction of processing in certain circumstances;
• request data portability (where applicable and feasible);
• lodge a complaint with the relevant data protection authority (where applicable).

To exercise these rights, you may contact us using the contact details in the “Personal Data Protection Officer / Contact Details” section.

Please note that we may require verification of identity before processing your request.

Personal Data Access Requests and Fees

You may request a copy of your personal data held by us.

Where permitted by law, we may impose a reasonable administrative fee for processing access requests.

Personal Data Protection Officer / Contact Details

If you have any questions, concerns, complaints, or requests regarding this Privacy Statement or your personal data, please contact our Data Protection Officer (DPO):

Data Protection Officer (DPO)
Taylor’s Education Group
Email: dpo@taylors.edu.my
Address: No. 1, Jalan Taylor’s,
47500 Subang Jaya,
Selangor Darul Ehsan, Malaysia
Phone: +603-5629 5000

Updates to this Privacy Statement

We may update or amend this Privacy Statement from time to time to reflect changes in law, regulatory requirements, operational practices, or business needs.

Where changes are significant, we will publish a prominent notice on our website.

Your continued use of our websites or continued engagement with Taylor’s Education Group after such updates will constitute acknowledgement of the revised Privacy Statement.

Governing Law

This Privacy Statement shall be governed by and construed in accordance with the laws of Malaysia.

ANNEXURE A
PERSONAL DATA PROTECTION NOTICE (PDPA NOTICE – MALAYSIA)