Privacy Policy

Effective date: 26 September 2026

This Privacy Policy (also our Personal Data Protection Notice) explains how AFS Corporate Sdn. Bhd. (Registration No. 202601039081 (1701176-P)) and its subsidiaries, together known as AFS Group of Companies (“AFS Group”, “we”, “us” or “our”), collect, use, disclose and protect personal data through this website, afscorporate.com.my, and its company pages. It is issued in accordance with the Personal Data Protection Act 2010 of Malaysia (“PDPA”), as amended, and reflects internationally recognised privacy principles.

If you do not agree with this Policy, please do not submit personal data to us through this website. Where you provide personal data of another person (for example, a colleague named in an enquiry), you confirm you have their consent to do so.

1. Who is responsible for your data

The data user (controller) is AFS Corporate Sdn. Bhd., F-2-3, Pacific Place Commercial Centre, Jalan PJU 1A/4, Ara Damansara, 47301 Petaling Jaya, Selangor, Malaysia. Where your enquiry concerns a specific company, that company may also act as a data user for the data it receives. The companies of the group are:

• AFS Corporate Sdn. Bhd. (Registration No. 202601039081 (1701176-P))
• AFS Energy Sdn. Bhd. (Registration No. 202501053397 (1654803-T))
• AFS Mining Sdn. Bhd. (Registration No. 202601037844 (1699939-U))
• AFS Plantation Sdn. Bhd. (Registration No. 202601037852 (1699947-M))
• Kinabalu Timber Holding Sdn. Bhd. (Registration No. 202401004882 (1550732-H))
• Khatulistiwa Explorer Sdn. Bhd. (Registration No. 202501046084 (1647492-M))
• Dewifirda Design Sdn. Bhd. (Registration No. 202601038775 (1700870-P))
• AFS Maharani Laboratory Sdn. Bhd. (Registration No. 202601038931 (1701026-U))
• AFS Construction and Development Sdn. Bhd. (Registration No. 202601038932 (1701027-V))
• AFS Property Sdn. Bhd. (Registration No. 202201002089 (1447786-V))

2. Personal data we collect

• Data you give us: your name, organisation, email address, telephone number, the company you are contacting and the content of your message when you use our enquiry form or email us; and, if you apply for a role, the details and documents you choose to send.
• Technical data: IP address, browser and device type, pages requested, date and time, and referring page, recorded automatically by our hosting provider in server and security logs.
• Analytics data (only with your consent): pages visited, approximate location derived from IP address, device and browser information and interaction events, collected by Google Analytics.

We do not ask for sensitive personal data (such as health, religious belief, political opinion or criminal records) through this website. Please do not send it to us unless we specifically request it for a lawful purpose.

3. Why we use your data

• to respond to enquiries and route them to the relevant group company;
• to discuss and manage business, partnership, supplier and investor relationships;
• to assess job applications and communicate with candidates;
• to operate, secure and improve this website, including preventing fraud, spam and abuse;
• to understand website usage in aggregate, where you have consented to analytics;
• to comply with legal and regulatory obligations and to establish, exercise or defend legal claims.

We process your data on the basis of your consent, to take steps at your request before entering into a contract, to comply with our legal obligations, or for our legitimate interests in running and protecting our business, where those interests are not overridden by your rights. We do not sell your personal data and do not use it for automated decision-making that has legal or similarly significant effects on you.

4. Whether you must provide data

Providing personal data is voluntary. The name, email address and message fields in our enquiry form are required so that we can reply; if you do not provide them, we may be unable to respond to your enquiry.

5. Cookies and analytics

This website does not use advertising cookies. Google Analytics loads only after you select “Accept analytics”; until then no analytics cookies are set. Your choice is stored in your browser's local storage and you can change it at any time using the analytics control at the bottom of the page. Our configuration disables Google signals and advertising personalisation, and does not send URL query parameters. You can also block or delete cookies through your browser settings. Google's use of data is described at policies.google.com/privacy.

6. Who we share data with

• companies within AFS Group of Companies, where needed to handle your enquiry;
• service providers acting on our instructions, including website hosting (Vercel Inc.), email and enquiry delivery services and, with your consent, Google LLC for analytics;
• professional advisers such as lawyers, auditors and company secretaries, under duties of confidentiality;
• regulators, courts, law enforcement or other authorities where required or permitted by law;
• a prospective buyer or successor in the event of a merger, acquisition or restructuring, subject to confidentiality obligations.

7. International transfers

Some of our service providers store or process data outside Malaysia, including in the United States. Where this happens we transfer data in accordance with section 129 of the PDPA, relying on the recipient's contractual commitments and safeguards that provide a level of protection comparable to the PDPA.

8. How long we keep data

We keep personal data only as long as necessary for the purposes above. As a guide, enquiries are kept for up to two years after the last communication, unsuccessful job applications for up to one year, and records connected to a business relationship for as long as required by Malaysian tax, company and other laws (generally seven years). Server logs are retained for short periods set by our hosting provider. Data is then securely deleted or anonymised.

9. How we protect data

We use practical administrative, technical and physical safeguards, including encrypted HTTPS connections, access controls limited to people who need the data, and contractual obligations on our service providers. No transmission over the internet is completely secure, and we cannot guarantee absolute security. If a personal data breach occurs that is likely to cause significant harm, we will notify the Personal Data Protection Commissioner and affected individuals as required by law.

10. Your rights

Subject to the PDPA and applicable law, you may:

• request access to, and a copy of, the personal data we hold about you;
• request correction of data that is inaccurate, incomplete, misleading or out of date;
• withdraw your consent, in full or in part, or limit how we process your data;
• ask us to stop processing that is likely to cause you substantial damage or distress, or to stop direct marketing;
• request that data you provided be transmitted to another data user (data portability), where technically feasible;
• where the laws of your country give you further rights, such as erasure or objection, exercise those rights.

To make a request, email general@afscorporate.com.my with the subject “Personal Data Request”, marked for the attention of our Data Protection Officer. We may need to verify your identity, and we will respond within the time required by law (21 days for access and correction requests under the PDPA). A fee may be charged for access requests where permitted. If you are not satisfied with our response, you may complain to the Personal Data Protection Commissioner of Malaysia or the authority in your country.

11. Children

This website is intended for business and professional audiences and is not directed at children under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

12. Third-party websites

This website links to other websites, including the dedicated websites of some group companies. Those websites may have their own privacy notices, and we are not responsible for the practices of websites we do not control.

13. Changes to this Policy

We may update this Policy to reflect changes in our practices or the law. The updated version will be posted on this page with a new effective date. Material changes will be highlighted on the website.

14. Language

This Policy is published in English. A Bahasa Malaysia version is available on request. In the event of any inconsistency, the version required by law to prevail shall prevail.

15. Contact us

Data Protection Officer, AFS Corporate Sdn. Bhd., F-2-3, Pacific Place Commercial Centre, Jalan PJU 1A/4, Ara Damansara, 47301 Petaling Jaya, Selangor, Malaysia. Email: general@afscorporate.com.my.