Privacy Policy - Employee Background Screening Services

Introduction

SANZA SOLUTIONS (“SANZA”, “we”, “us” or “our”) is committed to protecting the privacy, confidentiality and personal data of individuals whose information is processed in connection with our Employee Background Screening Services.

This Privacy Policy explains how we collect, obtain, use, verify, disclose, retain, protect and otherwise process personal data when providing employee background screening, pre-employment screening, due diligence, verification and related services to our clients.

We are committed to handling personal data responsibly and in accordance with applicable data protection and privacy laws, including the Personal Data Protection Act 2010 (“PDPA”) of Malaysia, where applicable, and other applicable privacy requirements in the jurisdictions in which we operate.

Scope of this Privacy Policy

This Privacy Policy applies to personal data processed in connection with:

      • Employee and pre-employment background screening;
      • Employment verification;
      • Education and qualification verification;
      • Professional accreditation and certification verification;
      • Professional reference checks;
      • Identity verification;
      • Criminality and integrity checks, where legally permissible;
      • Bankruptcy and insolvency checks, where legally permissible;
      • Civil litigation and court-record searches, where legally permissible;
      • Credit and financial-related checks, where legally permissible;
      • Business interest, directorship and shareholding checks;
      • Regulatory, sanctions, watch-list and compliance screening;
      • Due diligence and business intelligence services; and
      • Other verification services requested by our clients.

This Policy applies to candidates, employees, former employees, referees, respondents, representatives of client organisations, and other individuals whose personal data may be processed in connection with our services.

Personal Data We may Process

Depending on the scope of the screening assignment, we may process the following categories of personal data:

Identity Information –

      • Full name;
      • Previous or alternative names;
      • Date of birth;
      • Nationality;
      • Idenification or passport information;
      • Employment pass or other relevant identification information.

Contact Information –

      • Residential or correspondence address;
      • Telephone number;
      • Email address;
      • Other contact details provided for verification purposes.

Employment Information –

      • Current and previous employers;
      • Job titles and positions;
      • Employment commencement and termination dates;
      • Employment status;
      • Responsibilities and duties;
      • Reason for leaving, where lawfully obtainable;
      • Remuneration information where specifically authorised and legally permissible;
      • Employment documentation provided for verification purposes.

Education and Professional Information –

      • Educational institutions;
      • Qualifications and certificates;
      • Dates of attendance;
      • Graduation or completion information;
      • Professional memberships;
      • Licences, certifications and accreditations.

Screening and Verification Information –

      • Professional reference responses;
      • Court or litigation information where legally available;
      • Bankruptcy or insolvency information where legally available;
      • Credit-related information where legally permissible;
      • Business ownership or directorship information;
      • Regulatory and compliance information;
      • Sanctions and watch-list information;
      • Other information reasonably necessary to perform the requested screening.

We will generally process only information that is reasonably relevant to the particular screening service requested.

Source of Personal Data

Personal data may be obtained from:

      • The individual being screened;
      • Our client or prospective employer;
      • Current or former employers;
      • Educational institutions;
      • Professional bodies and accreditation organisations;
      • Referees and professional contacts;
      • Government agencies and public authorities;
      • Courts and publicly accessible official records;
      • Credit reference agencies, where legally permissible;
      • Regulatory and enforcement authorities;
      • Publicly available sources;
      • Third-party verification providers;
      • Recruitment agencies; and
      • Other lawful sources relevant to the requested screening.

Where information is obtained from third parties, we take reasonable steps to ensure that the information is obtained and processed through lawful and appropriate channels.

Purpose of Processing

Personal data may be processed for the following purposes:

      1. To conduct employee and pre-employment background screening;
      2. To verify information supplied by an individual;
      3. To authenticate educational, employment and professional qualifications;
      4. To conduct integrity, compliance and due diligence checks;
      5. To identify potential discrepancies, inconsistencies or material omissions;
      6. To prepare and deliver screening reports to authorised clients;
      7. To communicate with referees, employers, institutions and other respondents;
      8. To comply with applicable legal and regulatory requirements;
      9. To protect the rights, property and legitimate interests of SANZA, our clients and other parties;
      10. To prevent fraud, misrepresentation and other unlawful activities;
      11. To maintain appropriate records of screening activities;
      12. To manage contractual and business relationships; and
      13. To perform other purposes expressly authorised by the client or individual, where applicable.

Consent and Lawful Processing

Where required by applicable law, SANZA will obtain appropriate consent or rely on another lawful basis before processing personal data.

For employee background screening, the individual may be required to complete and sign a Background Screening Consent Form / Consent Letter authorising SANZA and/or its authorised service providers to conduct the specified checks.

The consent may include permission to:

      • Verify employment history;
      • Verify education and professional qualifications;
      • Contact referees and previous employers;
      • Conduct lawful public-record searches;
      • Conduct relevant integrity and compliance checks;
      • Obtain information from relevant institutions or authorised third parties; and
      • Process and report verification results to the authorised client.

The scope of consent will depend on the services requested and the applicable legal requirements.

Client Responsibility

Our clients are responsible for ensuring that they have a lawful basis to request background screening services and, where required, have obtained appropriate consent from the individual concerned.

Clients are also responsible for:

      • Providing accurate screening instructions;
      • Ensuring that requested checks are relevant to the position or business purpose;
      • Providing appropriate candidate consent where required;
      • Using screening reports only for authorised purposes;
      • Protecting the confidentiality of screening reports;
      • Limiting access to authorised personnel;
      • Complying with applicable employment, anti-discrimination and data protection laws; and
      • Maintaining appropriate safeguards for personal data received from SANZA.

SANZA does not make employment decisions on behalf of clients. Final hiring, retention, promotion or other employment decisions remain the responsibility of the client.

Verification Process

Background screening results may be obtained through different verification methods depending on the jurisdiction, availability of records and applicable legal restrictions.

These may include:

      • Direct verification with employers or institutions;
      • Telephone or email verification;
      • Official databases and records;
      • Publicly available information;
      • Regulatory sources;
      • Court or government records;
      • Credit reference databases, where permitted;
      • Documentary verification; and
      • Other lawful verification methods.

The availability and scope of information may vary between jurisdictions.

Certain organisations, including financial institutions, employers, recruitment agencies and other regulated entities, may be restricted from releasing information because of confidentiality, contractual or data protection obligations.

Where verification cannot be completed because information is unavailable, restricted or cannot lawfully be disclosed, the screening report may state that the information could not be independently verified.

Accuracy of Information

SANZA takes reasonable steps to ensure that information included in screening reports is accurate, relevant and obtained from appropriate sources.

However, information may sometimes be incomplete, outdated, unavailable or subject to limitations imposed by the source.

Where discrepancies are identified, we may communicate with relevant sources or request supporting documentation from the individual, where appropriate and legally permissible.

An individual may be given an opportunity to provide clarification or supporting documents where required by applicable law or the screening process.

Screening Results and Discrepancies

A background screening report may identify discrepancies between information provided by an individual and information independently obtained during the screening process.

Examples may include:

      • Differences in employment dates;
      • Differences in job titles;
      • Unverified qualifications;
      • Inconsistent documentation;
      • Incomplete employment history;
      • Inaccurate declarations;
      • Information that cannot be independently verified; or
      • Other material inconsistencies relevant to the requested screening.

The identification of a discrepancy does not, by itself, constitute a determination of misconduct, fraud or criminal behaviour.

Clients are responsible for assessing the information contained in the report and making their own decisions in accordance with applicable law.

Disclosure of Personal Data

Personal data may be disclosed, where appropriate and lawful, to:

      • The client that authorised the screening;
      • The client’s authorised representatives;
      • Employers and former employers;
      • Educational institutions;
      • Professional organisations;
      • Referees;
      • Government agencies and public authorities;
      • Courts or regulatory authorities;
      • Credit reference agencies where legally permissible;
      • Approved third-party screening or verification providers;
      • Professional advisers and service providers; and
      • Other parties where disclosure is authorised or required by law.

We do not sell personal data for unrelated commercial purposes.

Cross-Border Data Transfers

Employee background screening may involve verification across different countries and jurisdictions.

Where personal data is transferred outside Malaysia or the jurisdiction in which it was collected, SANZA will take reasonable steps to ensure that the transfer and subsequent processing are carried out in accordance with applicable data protection requirements.

Cross-border processing may be necessary where:

      • A candidate has worked or studied overseas;
      • A referee or previous employer is located overseas;
      • Verification must be conducted with an overseas institution;
      • International sanctions or compliance screening is required; or
      • The client has requested international screening.

Data Security

SANZA implements reasonable technical, organisational and administrative safeguards designed to protect personal data against:

      • Unauthorised access;
      • Unauthorised disclosure;
      • Loss;
      • Misuse;
      • Alteration;
      • Destruction; and
      • Other unlawful or unauthorised processing.

Access to screening information is restricted to authorised personnel and service providers who require access for legitimate business or screening purposes.

Where appropriate, we may use access controls, secure communication methods, authentication measures, confidentiality obligations and other security measures.

Confidentility

All background screening information and reports are treated as confidential and are intended only for authorised purposes.

Screening reports are generally provided to the authorised client and should not be distributed, reproduced or disclosed to unauthorised parties without appropriate authority or legal basis.

SANZA personnel and relevant service providers are expected to maintain confidentiality in relation to personal data and screening information.

Data Retention

SANZA will retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including:

      • Completion of the screening assignment;
      • Client and contractual requirements;
      • Record-keeping purposes;
      • Legal and regulatory obligations;
      • Dispute resolution;
      • Fraud prevention; and
      • Establishment, exercise or defence of legal claims.

When personal data is no longer required, we will take reasonable steps to securely delete, destroy, anonymise or otherwise dispose of the information in accordance with applicable requirements and our internal retention procedures.

Individual Rights

Subject to applicable laws and any lawful restrictions, individuals may have rights to:

      • Request access to personal data held about them;
      • Request correction of inaccurate or incomplete information;
      • Ask questions regarding the processing of their personal data;
      • Withdraw consent where consent is the applicable legal basis and withdrawal is legally effective;
      • Request information regarding the purposes of processing; and
      • Exercise other rights available under applicable data protection legislation.

Requests may be subject to verification of identity and applicable legal or regulatory limitations.

Withdrawal of consent may not affect processing already carried out lawfully before the withdrawal.

Requests for Correction or Clarification

If an individual believes that information contained in a screening report is inaccurate or incomplete, they may contact SANZA and provide details of the information in question together with relevant supporting documentation.

Where appropriate, SANZA may review the information and, where reasonably practicable and legally permissible, contact the relevant source for clarification.

Where the information was lawfully obtained from an independent third-party source, SANZA may be unable to amend the source’s underlying record but may record relevant clarification or supporting information in accordance with applicable procedures.

Third-Party Websites and Sources

Our services may involve accessing third-party websites, databases, public records or online platforms.

SANZA is not responsible for the privacy practices, security measures or content of third-party websites that are outside our control.

Individuals should review the privacy policies of relevant third parties where appropriate.

Children and Minors

Our Employee Background Screening Services are primarily intended for employment and business-related purposes involving adults.

Where information concerning a minor is required for a lawful and legitimate purpose, SANZA will process such information only where appropriate and in accordance with applicable legal requirements.

Data Breach and Security Incidents

SANZA maintains procedures intended to identify, assess, manage and respond to actual or suspected personal data breaches and security incidents.

Where applicable law requires notification to affected individuals, clients, regulators or other authorities, SANZA will take reasonable steps to comply with the applicable notification requirements.

Changes to this Privacy Policy

SANZA may update this Privacy Policy periodically to reflect changes in:

      • Applicable laws and regulations;
      • Our services;
      • Data processing practices;
      • Security measures; or
      • Business operations.

The updated version will indicate the relevant effective or revision date.

Governing Law

This Privacy Policy shall be interpreted in accordance with the laws applicable to SANZA SOLUTIONS and the relevant processing activity.

Where Malaysian law applies, this Policy is intended to operate consistently with the Personal Data Protection Act 2010 (PDPA) and other applicable Malaysian laws and regulations.

Where screening is conducted in another jurisdiction, additional local privacy and data protection requirements may apply.

Contact Us

For questions, requests concerning personal data, correction requests, privacy concerns or other matters relating to this Privacy Policy, please contact:

SANZA SOLUTIONS
Privacy / Data Protection Department
Email: [email protected]

When submitting a privacy request, please provide sufficient information for us to identify the relevant individual and screening assignment. We may request reasonable proof of identity before processing certain requests.

Acknowledgement

By providing personal data and, where required, providing consent for Employee Background Screening Services, the individual acknowledges that their personal data may be collected, used, verified, disclosed and processed for the purposes described in this Privacy Policy and the applicable Background Screening Consent Form.

This Privacy Policy should be read together with the relevant Background Screening Consent Form, Client Services Agreement, Data Processing Agreement and other applicable contractual or privacy documents.

SANZA SOLUTIONS is committed to protecting personal data while delivering professional, confidential and responsible Employee Background Screening Services.