Privacy Policy

1. Who we are

Weststar Engineering Sdn Bhd ("Weststar", "we", "us") is the data user responsible for the personal data processed in WorkPulse. WorkPulse is operated for Weststar's own workforce and is not offered to the public.

2. What we collect

Depending on how you use WorkPulse, we collect:

• Identity and contact details: name, staff number, NRIC or passport number, date of birth, email, phone number, address and emergency contacts.
• Employment records: department, position, grade, reporting line, employment type, start and end dates, and probation and confirmation records.
• Attendance: clock-in and clock-out times, the method used, the work location matched, and the device's location at the moment you clock.
• Leave: applications, balances, and the supporting documents you attach, such as medical certificates.
• Claims, advances and petty cash: amounts, descriptions, projects and the receipts you upload.
• Payroll: salary, allowances, deductions, bank account details, and EPF, SOCSO, EIS and income-tax (PCB) numbers and contributions.
• Recruitment: for candidates, your application, résumé, and interview and offer records.
• Account and usage: sign-in records, the device and browser used, and an audit trail of changes made in the system.

Most of this comes from you or from HR. Some comes from your manager (for example, approvals) or from our single sign-on service, Orbit 360, when you sign in through it.

3. How we use it

We use personal data only to run employment and HR at Weststar, namely to:

• record attendance and working time, and manage shifts;
• process leave, claims, advances and approvals;
• calculate and pay salaries and make statutory contributions and filings;
• recruit and onboard new staff;
• keep employment records, produce HR reports and meet our legal obligations;
• secure the system, investigate misuse and keep an audit trail;
• send you notifications about requests that need your attention.

We do not sell personal data or use it for advertising.

4. Who we share it with

Inside Weststar, people see only what their role needs. For example, your manager sees your team's requests, and HR and Finance see the records they process. Outside Weststar, we disclose personal data to:

• Government bodies as the law requires: KWSP (EPF), PERKESO (SOCSO and EIS) and LHDN (income tax);
• Our bank, to pay salaries and claims;
• Service providers who host and operate WorkPulse for us, including the AI providers described under HERA below, who act on our instructions;
• Other parties where the law requires it, or with your consent.

Some service providers process data outside Malaysia. Where they do, we take steps so that the data is protected to a standard comparable to the PDPA.

5. Location and the mobile app

The mobile app asks for location permission so it can check that you are at an approved work location when you clock in or out. We store your location only at the moment you clock, together with the attendance record. We do not track your location continuously or outside working time.

If you turn on automatic clocking, the app checks your location against approved work locations so it can clock you in when you arrive. You can turn it off or withdraw location permission in your phone's settings at any time; you can then still clock manually where your work location allows it.

The app also uses the camera or photo library, only when you choose to attach a receipt or document.

6. HERA, the HR assistant

HERA is an optional assistant that answers HR questions and drafts requests such as leave applications and claims. HERA never submits or approves anything for you; you review and confirm every draft.

To answer you, HERA sends your question, along with the HR records it needs and has permission to read, to third-party AI services (Anthropic and Google). Receipts you upload may also be read by these services to fill in claim details. They process this data to provide the service to us. HERA cannot read records your role is not allowed to see.

7. How long we keep it

We keep employment, payroll and tax records for as long as you work with us and afterwards for as long as the law requires, for example under the Employment Act 1955, the EPF Act and the Income Tax Act. We then delete or anonymise them.

For unsuccessful candidates, we delete the application, résumé and offer records 12 months after the decision, unless you asked to stay in our talent pool.

8. How we protect it

We protect personal data with role-based access controls, encrypted connections (HTTPS), optional two-step sign-in, and an audit trail of changes. Only authorised staff can see or change your records.

9. Your rights

Under the PDPA you may:

• access the personal data we hold about you, and get a copy;
• correct data that is inaccurate, incomplete or out of date. You can update much of your profile yourself in WorkPulse;
• withdraw consent or limit how we process your data. If the data is needed to employ or pay you, this may affect what we can do;
• object to processing that is likely to cause you damage or distress.

To make a request, contact us as described below. We may need to verify your identity before we act on it.

10. Changes to this notice

We may update this notice from time to time. The date at the top shows when it last changed. If a change is significant, we will tell you in WorkPulse.

11. Contact us

For questions about this notice or your personal data, contact the Human Resources department of Weststar Engineering Sdn Bhd.