General Privacy Statement

Definitions

To keep terms clear, we define key concepts used throughout this policy. These definitions help explain what types of information we process and how terms such as 'personal data', 'processing', and 'service' apply to our educational offerings and digital tools.

Personal data means any information relating to an identified or identifiable natural person, such as name, email address, phone number, billing details, and course interaction logs that can be linked to an individual.

Processing covers any operation performed on personal data, including collection, storage, use, analysis, anonymization, deletion, and transfer in support of course delivery, support, and community management.

User refers to visitors, prospective students, enrolled learners, instructors, and community members who access the MindaTopAI site or services.

Service denotes the educational content, digital tool integrations, training workshops, community features, and any related online resources provided by MindaTopAI.

Cookies are small text files placed on a user's device to enable features, remember preferences, analyze usage, and support targeted content such as relevant case studies or course recommendations.

Data You Provide

When you register, enroll, or communicate with us, you may provide information needed to create accounts, process payments, or participate in courses. Examples and typical items are listed below.

• Contact details: full name, email address, phone number (+60121886600) and postal address for optional postal correspondence.
• Account information: username, hashed password, profile image and preferences to personalize course recommendations.
• Transactional data: billing details, invoices, and payment confirmations for course purchases and subscriptions.
• Course submissions and project files: code samples, datasets you upload, project descriptions, and recordings of presentations where provided for feedback and collection review.
• Communications: messages platform with support, forum posts, and feedback submitted during workshops or clinics.
• Recruitment and business inquiries: details submitted when applying for roles, partnerships, or corporate training engagements including Business ID 761563285946 for verification where applicable.

Third-Party Sources

We may receive information from third-party services you link to or authorize, such as payment processors, identity verification partners, or integrated tool providers used in practical labs.

• Payment processors: receive transactional data necessary to complete purchases and refunds (we do not store full card numbers).
• Identity and verification services used for corporate agreements or certification validation where required.
• Integrated platform providers that facilitate tool-based exercises and sandbox environments for hands-on cases.

Legal Bases for Processing

For users in jurisdictions with data protection laws, including the EU where applicable to some learners, we rely on lawful bases such as contract performance, consent, legitimate interests, and legal obligations as described below.

• Performance of a contract: processing necessary to provide purchased courses, deliver materials, and fulfill subscription services.
• Consent: for optional communications, marketing, or certain analytics features where users explicitly opt in.
• Legitimate interests: to maintain security, improve services, and analyze aggregated learning outcomes while safeguarding individual rights.
• Compliance with legal obligations: processing required to meet tax, corporate, or regulatory requirements for training providers operating from Malaysia.

Sharing and Disclosure

We share personal data only as necessary to provide services, comply with legal obligations, and support integrated learning environments. Shared data is limited to what is required and governed by agreements where appropriate.

• Service providers: payment processors, hosting providers, analytics platforms, and integrated lab tool vendors under data processing agreements.
• Legal and regulatory authorities: when required by law, court order, or to protect legal rights and safety.
• Corporate partners and employers: with your explicit consent or under corporate training agreements where participant data is needed for certification or reporting.
• Research and aggregated reports: anonymized and aggregated data shared for educational research or public reporting without identifying individuals.
• Acquirers and successors: in the event of a business sale or restructuring, personal data may be transferred as part of the transaction under protective terms.
• Open forum and community contributions: content you post publicly in forums or project galleries may be visible to others and reused as case study examples unless you request removal.

Data Retention

We retain personal data only as long as necessary for the purposes described, to meet contractual obligations, or to comply with legal requirements. Retention periods vary by data type and use case.

Account data is retained while your account is active and for a limited period after account closure to allow for dispute resolution, billing, or regulatory compliance, typically not exceeding two years unless legal obligations require longer retention.

Support and forum messages are retained to preserve learning context and community history; users may request deletion of specific posts subject to moderation policies and legal constraints.

System logs and security monitoring records are retained for operational needs and fraud prevention, usually for a period aligned with industry practice to ensure incident contribute capabilities.

When data is no longer required, we delete or anonymize it in a manner that prevents re-identification. Requests for erasure are handled per applicable laws after verification of identity and review of contractual or legal constraints.

Your Rights

Users have a set of rights regarding their personal data. Below are practical steps and examples of how participants in MindaTopAI courses can exercise these rights, illustrated with scenarios from our workshops and support cases.

• Right to access: request a copy of personal data we hold, for example enrollment records or course completion logs used in a training scenario.
• Right to rectification: ask us to correct inaccurate contact details or profile information used for course assignments.
• Right to erasure: request deletion of personal information where retention is no longer necessary for administrative or legal reasons, illustrated by alumni data removal requests.
• Right to restrict processing: ask us to suspend processing of personal data while a dispute about accuracy is contribute, as in a case where a trainee contests a certification record.
• Right to data portability: request a machine-readable export of personal data you provided, often used by participants who want to migrate project artifacts between platforms.
• Right to object: object to direct marketing communications or profiling-based messages tied to course recommendations.
• Right to withdraw consent: withdraw consent for a specific processing activity (for example, use of your project data in marketing case studies) without affecting other legal bases for processing.
• Right to lodge a complaint with a supervisory authority in Malaysia if you believe your rights under applicable data protection laws have been breached.

Marketing communications

MindaTopAI sends course updates, event invitations, and product newsletters based on preferences you select during registration or via your account settings. Communications may reference practical case studies or upcoming hands-on sessions relevant to your interests. We base selections on explicit preferences and past interactions rather than unverified predictions.

You can opt out of marketing emails at any time via the unsubscribe link in each message or by contacting us directly. Opting out will not affect administrative messages about your enrollments or essential platform notifications.

Third-party links and services

Our platform may include links to third-party tools, cloud services, analytics providers, or learning resources. These third parties have their own privacy practices. For training exercises that integrate external tools (for example, notebook environments or dataset repositories), participants receive clear instructions and case-based guidance on data handling and privacy settings.