Data Privacy Notice | Caltex Cambodia

Caltex Malaysia Data Privacy Notice

Click here for Bahasa Version

1. Who are we and how does this Notice apply?

1.1 This Notice applies to Chevron Malaysia Limited and the following affiliate companies:
(a) Semai Sinar Sdn Bhd
(b) Murni Bistari Sdn Bhd
(c) Chevron (Malaysia) Sdn Bhd
(d) Prime Petroleum Management Sdn Bhd
(e) Pentastar Corporation Sdn Bhd
(collectively referred to in this Notice as "Chevron")

2. What is the purpose of the Notice?

2.1 Chevron collects personal data to conduct its business, to provide and market its goods and services and to meet its legal obligations. Chevron is bound by the Malaysian Personal Data Protection Act 2010. This Notice addresses personal data protection matters - that is, information or opinions relating to an individual that can be used to identify that individual. Its purpose is to explain, in general terms, the type of personal data that Chevron holds and why we hold it, and how Chevron collects, uses and discloses that information. In this Notice, where we refer to "you" or "your", we are referring specifically to natural persons as opposed to other entities such as partnerships, trusts and companies.

3. Sources from which Chevron collects personal data

3.1 Aside from personal data that is collected from you directly, Chevron also collects personal data through the following sources:

(a) In the employment context, including pre-employment

through hardcopy forms or through forms provided on Chevron's website;
intranet website pages (for employees);
in face-to-face meetings and in interviews;
from third parties, such as from referees and job recruitment agencies.

(b) Commercial customers, StarCard Customers and Customers generally

from hardcopy forms, such as application forms, registration forms, purchase orders etc;
through forms provided on Chevron's website pages;
in face-to-face meetings;
from third parties, such as credit reporting agencies, and loyalty card providers such as BCard;
from media agencies, public relations agencies and social investment partners (such as non-governmental organisations).

(c) Suppliers, Vendors and Service Providers

from hardcopy application forms;
through forms provided on Chevron's website pages;
in face-to-face meetings and interviews;
from third parties, such as credit reporting agencies;
from public relations agencies and social investment partners (such as non-governmental organisations).

(d) Others: Members of the Media, Property & Asset Purchasers

from public relations agencies and social investment partners (such as non-governmental organisations);
from property agents (if you are a property & asset purchaser);
from public relations agencies and social investment partners (such as non-governmental organisations).

4. What information does Chevron collect?

4.1 The personal data Chevron may collect about you is dependent upon your relationship with Chevron. The following are some examples of the types of personal data that Chevron may collect from individuals:

(a) In the employment context:

i) Pre-employment

application form details - full name, identification card number, contact numbers (land line and mobile), gender, address, email address, last drawn salary, date of birth as well as ethnicity and religion (optional);
resume details - which will usually include details such as your name, address, telephone numbers, academic qualifications, employment history, and referees;
reference checking;
medical data, such as details relating to your health and details provided in the medical clearance documentation; and
criminal record checks.

(ii) Employment

employment application form details - full name, identification card number, contact numbers (land line and mobile), gender, address, email address, date of birth, ethnicity and religious beliefs;
medical data, such as details relating to your health;
bank account details (for salary/wages);
tax file number details, SOCSO and EPF file reference numbers and income tax numbers;
personal data of your spouse or dependents; and
details of any criminal record.

(b) Commercial customers

personal details - including full name, identification card number, addresses, contact numbers, email address, date of birth, details relating to the company you are employed in, your photograph, nationality and ethnicity;
details relating to land titles, plans and sale & purchase agreements (where applicable);
financial details including banking details, bank account statements (where applicable);
details contained in company or business registration documents;
trade reference and credit checks.

(c) StarCard Customers

application forms - information including but not limited to names, identification card number, addresses, contact numbers, email address and employment details (designation, company name);
your StarCard account number and details;
financial details including bank account details; and
trade reference and credit checks.

(d) Customers generally

monitoring and/or recording interactions with customer service representatives at Chevron's call centre - customers' and employees' conversations at Chevron's call centre may be monitored and/or recorded for coaching, training, record keeping and dispute resolution purposes. Callers will be notified at the outset if such monitoring or recording is to occur and be given the option not to have the call recorded. Chevron may, even if the phone call is not recorded, collect personal data during those telephone calls to assist with your query.
competitions and contests - Chevron may use the personal data collected from competitions and contests (for example, the contestant's name and address) to market certain products to the contestants. Where Chevron intends to do this, it will advise the contestant of this in the competition's terms and conditions.

(e) Suppliers, Vendors and Service Providers

personal details - including names, identification card number, address, contact numbers, email address and any other details provided in business cards;
details contained in company or business registration documents;
financial details including banking details, bank account statements (where applicable); and
trade reference and credit checks.

(f) Others: Members of the Media, Property & Asset Purchasers, Property Owners or Occupiers

for property & asset purchasers, financial details - including tax file number and bank account details;
personal details - including names, identification card number, addresses, contact numbers, email address

5. Is it mandatory for you to provide your personal data?

5.1 Generally in most cases, the provision of your personal data is voluntary. However if you do not provide Chevron your personal data, Chevron will not be able to process your personal data for the Purposes and Additional Purposes outlined in this Notice, and in turn will not be able to provide you the services and products which you have requested for. However in certain circumstances provision of your personal data may be mandatory, as outlined below.

5.2 In the context of employment:
Where you have been accepted for employment with Chevron, provision of your personal data to Chevron is mandatory for the Purposes outlined below, and failure to provide the same may result in non-compliance with laws and Chevron being unable to provide you the benefits that come with employment. Where your family members are covered under Chevron’s medical scheme, provision of your family member’s personal data would be mandatory. Failure to provide your family member’s information for this purpose will result in your family member(s) not being able to enjoy the medical benefits offered under Chevron’s medical scheme.

5.3 Vendors, Suppliers or Service Providers:
Provision of your personal data is mandatory and failure to provide your personal data may be a breach of laws or regulatory requirements, and may cause Chevron to be unable to engage you to provide services or products or issue payments to you for products or services provided.

6. How does Chevron use your personal data?

6.1 Subject to certain exceptions (for example, the disclosure of personal data when allowed or required by law), Chevron will only use and/or disclose your personal data for:

(a) the primary purpose for which it is collected; or
(b) a related purpose, where you would reasonably expect that it be used and/or disclosed without your further consent.

6.2 Generally, Chevron will use your personal data for business and activities of Chevron, and for the purposes relating to any contract or agreement which you have entered into with Chevron which shall include, without limitation, the following (“the Purposes”):-

(a) In the context of employment

(i) Pre-employment

For purposes of assessment of suitability for employment, including for pre-employment medical fitness determination; and
For general administrative and record-keeping purposes.

(ii) Employment

For headcount and payroll planning and processing;
For purposes of processing and administration of retirement funds (where applicable);
For workforce development, training and certification;
For planning of business travel;
For performance management;
For administering, approving and monitoring employee benefits and entitlements, such as insurance coverage and medical benefits;
For the provision of subsidies or advances (where applicable);
To monitor access to the workplace, related facilities and systems;
For internal investigations and legal suits or proceedings, including reference checks with law enforcement agencies.

(b) Commercial Customers

For purposes of entering into a contract with Chevron or in furtherance of you seeking to enter into a contract with Chevron;
To determine the suitability of products and services for you;
To determine your eligibility for our products and services and offer them to you;
To process your application for a credit or cash account;
Where you are applying for credit facilities, to facilitate or enable any credit evaluations and credit risk checks as may be conducted by Chevron which may occur from time to time;
To facilitate the enforcement of your contractual obligations with us, amongst others, including but not limited to any default in payment of any outstanding monies owing to Chevron and/or to ensure you maintain a good credit rating or standing with Chevron;
To comply with applicable laws and to assist with any government agencies or bureaus or bodies including for the purpose of police or regulatory investigation;
Where you are a Chevron Business Point (CBP) user, for purposes of registration as a CBP user, for purposes of keeping training attendance lists, and for issuance of bulk receiving badges;
To register you or your company as Chevron’s business partner;
To assist you to comply with the applicable laws, including assistance in obtaining the relevant governmental licences and approvals;
To process any incentives provided to you, such as trips, under incentive programs run by Chevron;
To contact you or your company.

(c) StarCard Customers

To process, verify and manage your application for membership;
To provide you the benefits offered to members;
To process replacement of lost cards or issuance of additional cards;
To provide you with the products you have ordered or other products and services you have requested as well as service support;
To process your participation in any events, activities, contests, promotions, polls or surveys organised by Chevron;
To contact you if you are declared a winner;
For publication of your testimonials in relation to activities, events or contests run by Chevron;
To develop, enhance and provide products and services to meet your needs;
To process exchanges or product returns.

(d) Suppliers, Vendors and Service Providers

For the purposes of engaging you to provide services or products;
To facilitate or enable any checks as may be required by Chevron in order to engage you;
To process payments relating to any products or services you have provided;
To contact you or your company.

(e) General (applicable to all)

To respond to questions, comments and feedback from you;
To communicate with you for any of the purposes listed in this Notice and for any other purposes related to the business activities of Chevron;
Where you have signed up to participate in any events, activities, contests, promotions, polls, surveys or any corporate social responsibility (CSR) activities organised by Chevron (such as the Fuel Your School Program), to process your participation in the same and, where applicable to contact you if you are declared a winner of a contest;
For internal administrative purposes, such as record-keeping purposes, auditing, data analysis, database records;
For risk management and security purposes and for purposes of detection, prevention and prosecution of crime;
For regulatory approvals and compliance with the law and any amendments in force;
To pursue or defend legal claims on behalf of Chevron, its employees, affiliates, and agents; and
For such other purposes as may be required or permitted by law.

6.3 You agree and consent to Chevron using and processing your personal data for the Purposes and in the manner as identified in this Notice. Chevron may also retain your personal data for as long as necessary to fulfill the purpose(s) for which it was collected and to comply with applicable laws including laws relating to evidence, and your consent for such purposes remains valid after termination of our relationship with you.

7. Will Chevron send you marketing material and what can you do to stop that?

7.1 A related purpose for which Chevron collects personal data may be marketing. However, if this is not the case, Chevron is entitled to use your personal data for marketing or promotional efforts if you have consented to receiving such material.

7.2 Where you have given your consent, Chevron may use and process your data for marketing and promotional purposes such as (“Marketing Purposes”):

To send you alerts, newsletters, updates, mailers, promotional materials, special privileges, festive greetings from Chevron, its partners, sponsors or advertisers;
To notify and invite you to events or activities organised by Chevron, its partners, sponsors or advertisers;
To process your registration to participate in or attend an event or activity and to communicate with you regarding your attendance at the event or activity;
To share your personal data with its partners, advertisers, event companies or sponsors who may communicate with you to market their products, services, events or promotions;
Where you are a property or asset purchaser and where you have requested the same, to provide you updates on property sales and tenders;
by way of post, telephone call, short message service (SMS), by hand and/or by email.

7.3 If you do not consent (or if you wish to withdraw consent you have previously given) to Chevron for the processing of your personal data for Marketing Purposes please contact Chevron’s Compliance Coordinator using the contact details stated below. Chevron will not charge you or in any way disadvantage you if you choose to opt out of the Marketing Purposes.

8. Who does Chevron share your data with?

8.1 Your personal data may be transferred, accessed or disclosed to third parties for the Purposes or for Marketing Purposes. Further, Chevron may engage other companies, service providers or individuals to perform functions on Chevron’s behalf, and consequently may provide access or disclose your personal data to such service providers or third parties.

8.2 Such third parties typically fall into the following categories:

service providers such as our maintenance contractors, IT service providers, company secretarial service providers, payroll administrators, business-to-business marketing agencies, and courier service providers;
our banking and financial services providers;
our professional advisors, including our legal advisors, auditors, accountants and consultants;
our business and promotional partners;
debt collection agencies if you default on your credit obligations (where you have requested for credit facilities);
regulatory and governmental authorities in order to comply with statutory and government requirements;
credit reference agencies (where you have applied for credit facilities);
insurance companies;
marketing, public relations, advertising and trade promotion agencies;
our social investment partners (such as non-governmental organisations);
landlords and building management (for employees for purposes of workplace security);
insurance assessors;
billing and mailing houses;
delivery contractors.

8.3 Chevron may also share your personal data with various departments within Chevron, with Chevron headquarters in the United States of America and with Chevron regional offices located worldwide.

9. When does Chevron share information?

9.1 Chevron generally will only disclose personal data to third parties without your consent if that disclosure is necessary for the purpose(s) for which that information was collected. Set out below are some examples of where it is necessary for Chevron to disclose personal data to third parties:

(a) In the employment context:

Payroll arrangements - Chevron provides its external payroll processing company with employees' personal details (including, but not limited to, employees' names, addresses, bank account details, tax file numbers) for purposes of calculation of wages, salaries and taxes payable. Insurance arrangements - Chevron advises insurers of employees' personal details (including, but not limited to, employees' names, addresses, medical reports) to enable those insurers to properly process medical, hospitalization, disability and death claims.
Recruitment systems - Chevron requires prospective employees to complete documentation and submit to pre-employment checks, including completing application forms, reference checking, pre-employment medical, drug testing and criminal record checks which involves disclosure of personal data to various third parties.
Video monitoring - external security advisers/contractors may view security tapes that have been recorded in the workplace.
Medical - Chevron may, with the employee's consent, provide the company doctor or any medical specialists retained by Chevron with employees' medical records for the purposes of their employment with Chevron.
Worker's compensation - Chevron may disclose employees' records (including the employees' medical records) to its insurers and their agents for the purpose of processing claims.

(b) Generally and in a commercial context:

Credit checks on new and existing individual customers - Chevron may provide necessary personal data to credit reporting agencies to ascertain an individual's financial position if the person is a new or an existing customer.
Competitions - in some cases Chevron uses third parties to run its competitions or contests. In these instances, unless otherwise disclosed to the contestant prior to, or at the time of, entering the competition (normally set out in the competition's terms and conditions), any personal data collected about a contestant will be returned to Chevron.
Administrative functions - personal data may be with various departments within Chevron, with Chevron headquarters in the United States of America and with Chevron regional offices located worldwide for internal administrative functions and where there are shared servers or data centres.

10. When does Chevron transfer your personal data abroad?

10.1 Your personal data may be transferred to, stored, used and processed in a jurisdiction other than Malaysia such as to Chevron’s headquarters located in the United States of America and related companies which are located worldwide and to Chevron’s regional data centres, credit servers and shared services which are located outside Malaysia. You understand and consent to the transfer of your personal data out of Malaysia as described herein.

11. How can you access your personal data?

11.1 If you want access to your personal data held by Chevron, please put your request in writing and clearly identify the personal data which you are seeking access to. This is important to ensure that the information can be retrieved quickly and cost effectively. All requests for access must be addressed to the Compliance Coordinator (see contact details below).

11.2 Depending on the circumstances, Chevron reserves the right to charge you a reasonable administrative fee, in the amounts as permitted under law. For example, Chevron's reasonable administrative costs might include:

reasonable staff costs in locating and collating the information;
reasonable reproduction or photocopying costs; and
reasonable costs involved in having someone explain the information to you.

11.3 In some instances as permitted under law, Chevron may not release the personal data, such as where the expense of providing access to you is disproportionate to the risks to your or another person’s privacy.

12. What if your personal data is inaccurate?

12.1 Chevron will take reasonable steps to correct personal data that is inaccurate. You should contact Chevron if your personal data changes. If Chevron believes it is inappropriate to delete or alter the original information, it will discuss with you alternative ways of correcting the information that satisfies the needs of both parties.

13. How do you make inquiries or complaints?

13.1 If you wish to make an inquiry or a complaint to Chevron about the processing of your personal data, please provide full details of your complaint in writing and send it to the Compliance Coordinator (see contact details below).

14. How will changes to this Notice be notified?

14.1 Chevron may amend the Chevron Personal Data Protection Notice from time to time to take into account new laws and technology, changes to Chevron's operations and practices, and the changing business environment. The most current version of this Notice will be located on the intranet for employees and at http://www.caltex.com.my for external users or a copy can be obtained by contacting the Compliance Coordinator. Chevron shall have the right to modify, update or amend the terms of this Notice at any time by placing the updated Notice at http://www.caltex.com.my. By continuing to communicate with Chevron, by continuing to use Chevron’s services, purchasing products from Chevron or by your continued engagement with Chevron following the modifications, updates or amendments to this Notice, such actions shall signify your acceptance of such modifications, updates or amendments.

14.2 In the event of any conflict between the English and other language versions of this Notice, the English version shall prevail.

15. How to contact us?

15.1 If you would like more information concerning Chevron's approach to privacy or how Chevron handles your personal data, you can write to:

Compliance Coordinator,
Chevron Malaysia Limited
Telephone: 603 2289 6688
Email: compliancecoordinator@chevron.com
Fax: 603 2289 6608

15.2 You acknowledge that your withdrawal of consent may in some circumstances result in the termination of your relationship with Chevron and that Chevron may still retain legal rights to process your personal data following a withdrawal of your consent.

16. Acknowledgement and Consent

16.1 You confirm that you have read and understood this Notice and consent to the processing of your personal data by Chevron as described above. In the event you do not consent to the processing of your personal data as described in this Notice, please contact Chevron using the contact details above.

Click here for Bahasa Version