Legal
Privacy policy
Last updated: 15 October 2026
This notice explains what personal data PositiveLinks collects, why we collect it, who we share it with, and how you can see it, correct it or ask us to stop using it. We give it under the Personal Data Protection Act 2010 of Malaysia. This notice is available in English and in Bahasa Malaysia.
1. Who we are
Agensi Pekerjaan PositiveLinks Asia Sdn Bhd (201001029798 (913718-W)) gives this notice. The company is a private employment agency licensed under the Private Employment Agencies Act 1981. It is registered as a data user with the Personal Data Protection Commissioner. In this notice, "PositiveLinks", "we" and "us" mean that company.
Two related companies may also handle your personal data, and this notice covers them too. PositiveLinks Advisory Sdn Bhd (202001024643 (1380963-V)) provides HR advisory and contracting services in Malaysia. PositiveLinks Asia Inc (SEC registration 2023110125445-03) runs our office in the Philippines. The company you deal with is responsible for the personal data it holds about you.
Our Malaysia office is at C08 Common Ground, 1F Citta Mall, 1 Jalan PJU 1A/48, Ara Damansara, 47301 Petaling Jaya, Selangor. Our Philippines office is at Unit 11A, 11th Floor, Country Space 1, H.V. Dela Costa Street, Salcedo Village, Bel-Air, Makati City 1209, Metro Manila.
2. Who this notice is for
This notice is for anyone whose personal data we hold because of our recruitment, contracting or HR advisory work. That includes:
- candidates, meaning anyone who sends us a CV, applies for a job, contacts us about work, or whom we contact about a role;
- people who apply to work at PositiveLinks itself, through the Careers page of our website or in any other way;
- people who are referred to us by someone else;
- referees who give a reference for a candidate;
- people who work for our clients and for companies we would like to work with;
- visitors to www.thepositivelinks.com.
Our own employees, including contractors we employ and place with clients, receive a separate notice when they join us.
3. How we get your personal data
Most of the personal data we hold comes from you. You may give it to us when you:
- email us your CV or a message;
- fill in the contact form, a form on our Careers page or a job application form on our website;
- apply for a job we advertise, on our website or on a job board;
- message us on LinkedIn, by InMail, on WhatsApp, by phone or in person;
- attend an interview or a meeting with us.
Some of it comes from other people or places. We may receive your details from:
- someone who refers you to us, such as a former colleague;
- a client who asks us to contact you;
- a referee you have named;
- job boards where you have posted your CV for employers and recruiters to see;
- professional profiles you have made public, such as your LinkedIn profile;
- Apollo, a business contact database, which we use to find people at companies we would like to work with and, sometimes, candidates.
If we get your details from someone other than you, we tell you where they came from the first time we contact you.
4. What personal data we collect
If you are a candidate, or you apply to work at PositiveLinks, we collect your name, your email address and mobile number, the city and country you live in, your current employer, your CV and cover letter, your work history, qualifications and skills, your LinkedIn profile, your current and expected pay, your notice period and your right to work. We also keep notes of our conversations and interviews with you, and the references we take with your agreement.
If you work for a client or a company we would like to work with, we collect your name, job title, company, work email address, phone number and the messages you send us.
If you use our website, our forms collect what you type into them and any file you upload. Our website host, Netlify, records technical details of each visit, such as your IP address, in its server logs. Our pages load their fonts from Google Fonts, so Google also receives your IP address. Our website does not set cookies and does not use advertising or analytics tools.
We do not ask for your identity card number, race, religion, health information or photograph when you first send us your CV. Some clients need some of these later in their hiring process, for example for a background or medical check. If that happens, we ask you first and use the information only with your explicit consent.
5. Why we use your personal data
We use a candidate's personal data to:
- consider you for the role you applied for, and for other roles with our clients that may suit you;
- contact you about those roles;
- send a client a profile of you with your name and contact details removed, to find out whether the client has a suitable role, after telling you that we are sending it;
- send your full CV to a client for a role you have agreed to be put forward for;
- arrange interviews, take references and manage offers;
- keep a record of the work we have done with you;
- send you news about roles and the job market, if you have not asked us to stop.
If you apply to work at PositiveLinks, we use your personal data to assess you for a job with us. We may also use it to consider you for roles with our clients, in the ways listed above.
We use a business contact's personal data to:
- reply to your enquiry and provide the service you ask for;
- manage our work with your company, including invoices;
- tell you about our services, if you have not asked us to stop.
We also use personal data to meet our duties under the law, and to establish or defend a legal claim.
6. Whether you have to give us your personal data
Giving us your personal data is voluntary. Without your contact details and CV, we cannot consider you for roles or put you forward to a client. Without the fields marked "required" on our forms, we cannot reply to you.
7. Who we share your personal data with
We send your full CV to a client only for a role you have agreed to. Before that, we may send a client a profile with your name and contact details removed, and we tell you before we send it.
We may also share your personal data with:
- our related companies named in section 1, where they are handling the role or the service;
- referees, to confirm the reference you asked them to give;
- the companies that provide the systems we use to run our business, which handle your data on our instructions. These are Vincere, our applicant tracking system, which is the database where we keep candidate records and job applications; Microsoft, which provides our email and documents; Netlify, which hosts our website and stores the messages sent through our contact and careers forms;
- other services we use to find and contact people: Apollo, our business contact database; LinkedIn; WhatsApp, which is owned by Meta; and Google, which provides the fonts on our website. Some services, such as LinkedIn, WhatsApp and Google, handle data under their own privacy terms;
- our professional advisers, such as lawyers, auditors and accountants;
- government bodies, regulators, courts and the police, where the law requires us to.
We do not sell or rent your personal data to anyone.
8. Sending your personal data outside Malaysia
Some of the people and companies in section 7 are outside Malaysia. Your personal data may go:
- to the Philippines, where PositiveLinks Asia Inc and some of our clients are based;
- to Singapore, Indonesia and other countries where a client hiring for a role is based;
- to the countries where our service providers keep their servers, which may be outside Malaysia.
We send personal data outside Malaysia only where the Personal Data Protection Act 2010 allows it. That means the country has a law that is substantially similar to Malaysia's or protects personal data to an adequate level, or you have agreed to the transfer, or the transfer is needed for a role or service you have asked for. Where we use a service provider abroad, we rely on its written commitments to protect your data.
9. How long we keep your personal data
We keep personal data only for as long as we need it for the purposes in section 5, and then we delete it.
| Whose data | How long we keep it |
|---|---|
| A candidate we have not placed, or someone who applied to work at PositiveLinks and was not hired | 2 years after our last contact with you. Before we delete your record, we may ask whether you want us to keep it. |
| A candidate we have placed in a role | 7 years after the placement, because we need the record for our contract with the client and for tax purposes. |
| A candidate or business contact we found through a job board, LinkedIn or Apollo who did not reply to us | 12 months after our first message. |
| A business contact | For as long as we work with your company, and 2 years after that. |
| A message sent through our website that does not lead to any work | 12 months. |
| The copy of a contact or careers form kept by Netlify | 30 days, after we have moved it into our own systems. |
We may keep personal data for longer where the law requires it, or where we need it to deal with a legal claim. Job applications made on our job pages go straight to Vincere and no copy is kept by Netlify.
10. How we protect your personal data
We limit access to personal data to the people at PositiveLinks who need it for their work. Our systems are protected by passwords and by the security measures of the companies that provide them. We require our service providers to keep personal data secure and to use it only on our instructions. If you tell us you are thinking of leaving your employer, we treat that as confidential.
If a breach of personal data happens that is likely to cause you significant harm, we will tell you, and we will tell the Personal Data Protection Commissioner, as the law requires.
11. Your rights
You have the right to:
- ask whether we hold personal data about you, and ask for a copy of it;
- ask us to correct personal data that is wrong, incomplete, misleading or out of date;
- withdraw your consent to our use of your personal data, in full or in part;
- ask us to stop sending you news about roles or our services;
- ask us to limit how we use your personal data, including data about other people that can be identified from it;
- ask us to send your personal data to another organisation, where this is technically possible;
- complain to the Personal Data Protection Commissioner at www.pdp.gov.my.
To use any of these rights, write to us at the address in section 12. We reply to a request for access or correction within 21 days. If we cannot finish within 21 days, we tell you in writing within those 21 days why we need more time, and we finish within a further 14 days. We do not charge a fee for a request.
If you withdraw your consent, we stop using your personal data for the purposes that depend on it. We may then be unable to consider you for roles.
12. How to contact us
You can contact our Data Protection Officer, Marcus Koh, about this notice or your personal data:
- by email at pdpa@thepositivelinks.com;
- by phone on +603 2381 0710;
- by post at C08 Common Ground, 1F Citta Mall, 1 Jalan PJU 1A/48, Ara Damansara, 47301 Petaling Jaya, Selangor.
13. Your consent
When you give us your personal data after this notice has been made available to you, or tick the consent box on one of our forms, you agree to our using it as this notice describes. You can withdraw that agreement at any time, as section 11 explains.
14. If you give us someone else's personal data
If you refer a friend or colleague to us, or name a referee, please tell that person first and make sure they are happy for us to contact them. We will give them this notice when we first contact them.
15. Changes to this notice
We may update this notice. The date at the top shows when it last changed. If a change affects how we use personal data we already hold, we will tell the people affected.
16. Language
This notice is published in English and in Bahasa Malaysia. If the two versions differ, the English version applies.