Home/Privacy Policy

Privacy Policy

Last updated: 11 June 2026

1. About this notice

This Privacy Policy explains how the MIPAC TVET platform at mipactvet.ciast.gov.my (the "Platform") collects, uses, shares, and protects personal data. It covers the public website and the secure portals, including the participant portal where competition entries are registered and managed.

It applies to website visitors, account holders, the team members named in competition entries, and the appointed personnel (judges, secretariat, management, administrators) who run the competition through the Platform.

The Platform is operated by the Pusat Latihan Pengajar dan Kemahiran Lanjutan (CIAST) under the Department of Skill Development, Ministry of Human Resources Malaysia. CIAST handles personal data in line with the principles of Malaysia’s Personal Data Protection Act 2010 (Act 709), including its 2024 amendments.

By using the Platform or submitting personal data through it, you accept the handling described in this notice. A Bahasa Melayu version of this notice will be published when the Platform’s Bahasa Melayu pages go live.

2. Who is responsible for your data

CIAST is the organisation responsible for personal data collected through the Platform (the "data controller" in data-protection terms). Contact details:

Pusat Latihan Pengajar dan Kemahiran Lanjutan (CIAST)
Jalan Petani 19/1, Seksyen 19, 40300 Shah Alam, Selangor Darul Ehsan, Malaysia
Email: info@ciast.gov.my
Phone: +603-5543 8200

3. Data protection contact

Placeholder pending CIAST appointment. CIAST will designate a data protection liaison for the Platform. The officer’s name and contact details will be published in this section once appointed. Until then, direct personal-data questions and requests to info@ciast.gov.my.

4. Personal data the Platform collects

4.1 When you create an account

Full name
Email address (used as your username)
Password, stored only in a one-way encrypted form (a hash), never as plain text

4.2 When you register a project

Project title and competition category
The project’s institution (the institution the entry officially represents)
Your contact phone number
Billing contact details (payer name, payer reference, payer phone, payer email), since the payer may differ from the account holder
Per team member, the form collects full name, email, phone number, IC number, position at their institution, and role in the project

The IC number is the identity key of the competition. It is used to verify each team member’s identity and eligibility and to apply the Competition Guidelines’ one-entry-per-person rule. Date of birth and age may be derived from it for on-screen display, and are not stored separately.

4.3 When you submit competition materials

Abstracts, posters, the full report, video and prototype links, and supporting documents. Submitted materials may themselves contain personal data, such as names or faces in a project video. Submit only material you have the right to share.

4.4 When an edition charges a registration fee

The payment receipt you upload. Payment itself happens through iPayment, the government payment gateway, outside the Platform, so the Platform never collects card or online-banking credentials. MIPAC TVET 2026 charges no fee, so no payment data is collected this edition.

4.5 When you contact the secretariat

Your name, contact details, and the content of your enquiry, whether sent through the Platform’s contact channels or by email.

4.6 Collected automatically

Server and security logs (IP address, browser and device information, requested pages, timestamps)
Sign-in session records (the IP address and browser used at sign-in)

These records exist to keep the Platform secure and to diagnose technical problems. The Platform runs no third-party analytics and no advertising trackers.

5. Why personal data is collected

Running the competition. Registration, screening, payment verification where a fee applies, submission handling, evaluation, results, and archiving.
Identity and eligibility. Verifying team members through their IC numbers and applying the one-entry-per-person rule.
Communication. Deadline reminders, status updates, screening outcomes, results announcements, and operational notices, delivered in the portal and by email.
Awards and recognition. Producing certificates, award records, and ceremony materials.
Publication of results. Displaying published results on the Platform’s public pages (see section 7).
Security and accountability. Protecting the Platform, keeping audit trails of administrative actions, and investigating misuse.
Legal compliance. Meeting obligations under Malaysian law and government recordkeeping requirements.

Personal data is not used for marketing and is never sold.

6. Team members’ data

A competition entry is usually registered by one account holder who enters the details of every team member. Before naming a team member, the account holder must have that member’s agreement to take part and to their details being submitted, including the IC number.

If someone has named you on a team, this notice applies to your data too. Contact the secretariat if you believe you were named on an entry without your agreement.

7. Who can see your data

Within CIAST, access is role-based and limited to what each role needs:

Secretariat. Registration details, screening, payment verification, and results administration for the editions they operate.
Judges. Only the submission materials of entries assigned to them. Evaluation is blind, so participant names and institutions are withheld from judges during scoring.
Management. Read-only oversight and reporting.
Administrators. System administration and data correction, with actions recorded in an audit trail.

Published results are public information. Each published entry's project title, team member names, institution, category, award tier, and rank appear on the public Results page, the Archive, news posts, and home-page showcases. The Archive is the competition’s permanent public record.

In editions with a registration fee, billing contact details of eligible entries are passed to the CIAST finance office so that bills can be created on iPayment.

CIAST may disclose personal data to law enforcement or government authorities where Malaysian law requires it.

Personal data is never sold or rented, is not shared with advertisers, and is not sent to third-party analytics services.

8. Where your data is stored

All Platform data, including uploaded files, is stored on CIAST’s own dedicated government server infrastructure in Malaysia, managed by the CIAST IT Department. The Platform does not use commercial cloud hosting, and personal data is not transferred outside Malaysia.

Emails from the Platform are sent through CIAST’s own email infrastructure.

Share links that participants choose to provide (for example Google Drive or YouTube) point to external services. Material on those services is stored by them under their own terms, by the participant’s own choice.

9. How long data is kept

Account data. Kept while the account remains active.
Competition records. The Archive is the competition’s permanent record. Published fields (project title, team member names, institution, category, award tier, rank) and archived entry records are retained indefinitely.
IC numbers. Kept for identity and eligibility verification and for the audit record of the editions entered. Never published, and restricted to the roles that need them.
Logs. Server and security logs are kept on a rolling basis of around ninety days, then deleted automatically.

When an account is closed, personal data that is no longer needed is removed within a reasonable period. Records that must remain (published results, archived entries, audit trails) are retained per the rules above, so a former participant’s name and institution stay visible on publicly archived results.

10. How data is protected

CIAST applies administrative, technical, and physical safeguards, including:

Encrypted connections (HTTPS) for all traffic between your browser and the Platform.
Passwords stored only as one-way encrypted hashes.
Role-based access controls, so each internal role sees only what it needs.
Sign-in sessions that expire automatically after inactivity.
IC numbers masked in operational system logs.
Audit logging of administrative and data-correction actions.
Hosting on CIAST’s own government server, operated by the CIAST IT Department.

No method of storage or transmission is perfectly secure, so absolute security cannot be guaranteed. Keep your password confidential and sign out on shared devices.

11. Data incidents

If a personal-data incident occurs, CIAST will act to contain and remedy it. Where an incident is likely to cause significant harm to affected individuals, CIAST will notify the affected users and the relevant authorities, in line with current Malaysian data-protection practice.

12. Cookies

The Platform uses essential cookies only:

A session cookie that keeps you signed in. It is HTTP-only and secure, meaning scripts cannot read it and it travels only over encrypted connections.
A preference cookie that remembers your language choice.
Security tokens that protect forms against forgery.

There are no advertising, analytics, or third-party tracking cookies. Blocking essential cookies in your browser will prevent sign-in from working.

13. Your rights and choices

Access. Ask for a copy of the personal data held about you. CIAST aims to respond within twenty-one (21) days of a verified request.
Correction. Ask for inaccurate, incomplete, or outdated personal data to be corrected.
Withdrawal. Withdraw consent to further processing by written notice. Withdrawing during a competition may mean withdrawing the entry it relates to.

To exercise any of these, write to info@ciast.gov.my. CIAST will verify your identity before acting on a request.

Requests may be limited where fulfilling them would compromise the integrity of an ongoing evaluation, the published results record, or audit trails required by Malaysian law.

14. Children’s data

The competition is open to serving TVET instructors, so all participants are working adults. The Platform does not knowingly collect personal data from anyone under the age of 18. If such data is found, it will be deleted promptly.

15. Changes to this notice

CIAST may revise this Privacy Policy from time to time. The "Last updated" date at the top of this document shows when the most recent revision took effect. Material changes will be announced through a Platform notice or by email to registered account holders.

16. Contact

For questions, requests, or complaints regarding your personal data, contact CIAST at:

Email: info@ciast.gov.my
Phone: +603-5543 8200
Address: Pusat Latihan Pengajar dan Kemahiran Lanjutan (CIAST), Jalan Petani 19/1, Seksyen 19, 40300 Shah Alam, Selangor Darul Ehsan, Malaysia