Data Privacy and PDPA Compliance

Borong operates as a Malaysian company and processes personal data in accordance with Malaysia's Personal Data Protection Act 2010 (Act 709) (PDPA). The PDPA governs the processing of personal data in commercial transactions and applies to any person who processes or has control over the processing of personal data in Malaysia.

The PDPA is administered by the Personal Data Protection Department under the Ministry of Digital. It establishes seven data protection principles that data users must comply with: the General Principle, the Notice and Choice Principle, the Disclosure Principle, the Security Principle, the Retention Principle, the Data Integrity Principle, and the Access Principle.

Borong's data handling practices are designed to comply with each of these principles as they apply to the personal data processed through the platform.

General Principle

Borong processes personal data only for the purposes for which it was collected, or for directly related purposes. The primary purpose of processing is the operation of the eProcurement platform and the services contracted by the client organisation. Personal data is not processed for purposes beyond this without the knowledge and, where required, the consent of the data subject.

Notice and Choice Principle

Individuals whose personal data is processed by Borong are informed of the purposes of processing, the types of third parties to whom the data may be disclosed, and their rights under the PDPA. This information is provided through Borong's Privacy Notice, which is available on the platform and at borong.com/legal/privacy-policy/

Disclosure Principle

Borong does not disclose personal data to third parties except where necessary to provide the contracted services (for example, sharing order details with the relevant supplier to fulfil a purchase), where required by law, or with the consent of the data subject. Borong does not sell personal data.

Security Principle

Borong applies technical and organisational measures to protect personal data against loss, misuse, unauthorised access, disclosure, alteration, and destruction. These measures include encryption in transit and at rest, role-based access controls, and multi-tenant data isolation. Details of Borong's security controls are available on the Security page.

Retention Principle

Personal data is retained only for as long as it is necessary for the purposes for which it was collected, or as required by law or contractual obligation. Procurement records may be retained for audit and compliance purposes in accordance with applicable retention requirements. When data is no longer needed, it is securely deleted or anonymised.

Data Integrity Principle

Borong takes reasonable steps to ensure that personal data processed on the platform is accurate, complete, and kept up to date. Client administrators are responsible for maintaining the accuracy of user account information within their organisation. Data subjects may request correction of inaccurate personal data.

Access Principle

Individuals have the right to request access to their personal data held by Borong, and to request correction of any inaccurate or incomplete personal data, in accordance with the PDPA. Requests should be submitted in writing to the contact details below. Borong will respond to access and correction requests within the timeframe required by the PDPA.

Organisations that process personal data using Borong's platform as a data processor may request a data processing agreement (DPA) that documents Borong's obligations regarding the personal data processed on their behalf.