PGMSPostgraduate Management SystemSign in

Privacy notice (PDPA 2010)

This notice explains how the Postgraduate Management System (PGMS) processes personal data under Malaysia's Personal Data Protection Act 2010 (PDPA). It is a draft and must be reviewed by the university's data protection officer before go-live.

What we collect

  • Account data: name, email, role, staff or matric number, password (stored only as an Argon2id hash).
  • Academic records: programme, supervision, milestones, examination results, fees and uploaded documents.
  • Security and usage data: sign-in times, IP address, approximate location derived from the IP address, device type, operating system and browser.
  • Landing-page visits: pages viewed, referring site, buttons clicked and time on page, linked to a random per-tab identifier rather than a cookie.

Why we process it

  • To administer postgraduate admission, supervision, examination and graduation.
  • To secure accounts, detect misuse and keep an audit trail of decisions.
  • To improve the service using aggregated visit statistics.

Retention and storage

Security logs are kept for 365 days by default. Academic records are kept according to the university's records-retention schedule. Files are stored in encrypted cloud object storage and accessed only through short-lived signed links.

Your rights

You may request access to or correction of your personal data, or withdraw consent where processing is based on consent, by contacting:

IP geolocation is provided by DB-IP (db-ip.com) and is approximate.