Grand Columbia Group of Companies, including its subsidiaries, associated companies, and holding companies (collectively, “Grand Columbia”, “we”, “us”, or “our”), is committed to safeguarding the personal data entrusted to us. In this Privacy Policy, “you” and “your” refer to any individual whose personal data we hold, including third parties whose data has been provided to us on their behalf.
This Privacy Policy explains how we gather, use, retain, and share your personal data in the course of our business activities and through your interactions with our website. We may update this Policy from time to time; any revised version will be posted on our website. Where required by applicable law, we will notify you of material changes.
Grand Columbia does not intentionally collect personal data from individuals under the age of 18 without verified parental or guardian consent. If you are under 18, please seek consent from a parent or guardian before submitting any personal data to us. Should we become aware that we hold data from a minor without such consent, we will take steps to delete it promptly. Please contact us if you believe we hold such data.
(1) Personal Data We Collect
“Personal data” refers to any information that identifies or could reasonably identify an individual. Depending on the nature of your interaction with Grand Columbia, we may collect the following categories of data:
- identity information: full name, national identification or passport number, date of birth, nationality, and gender;
- contact information: home or business address, email address, and telephone or mobile number;
- financial and transactional data: bank account details, payment records, billing history, and credit information;
- business and professional information: company name, designation, and business registration details;
- family and third-party information: details of family members or related parties voluntarily provided by you;
- behavioural and preference data: your preferences and choices in relation to products and services obtained from us;
- technical data: IP address, browser type, device identifiers, and website usage data collected via cookies or similar technologies;
- premises security data: CCTV footage and access records at Grand Columbia facilities; and
- communications data: records of enquiries, correspondence, and feedback submitted to us.
We collect personal data through the following channels:
- directly from you, via registration and application forms, email, telephone, in-person interaction, or our website and mobile applications;
- indirectly, from authorised representatives, employers, agents, or publicly available sources; and
- automatically, through your use of our digital platforms, including through cookies and analytics tools.
Certain personal data fields are mandatory for us to process your request or provide services. Where you choose not to provide such data, we may be unable to proceed with your application or deliver the relevant service.
(2) How We Use Your Personal Data
2.1 For Customers and Prospective Customers
We process your personal data as required or permitted by law, and to fulfil our obligations in connection with your commercial relationship with us, including to:
- receive and fulfil your requests for products or services;
- manage and administer your account and transactions with us;
- process payments, refunds, and billing matters;
- communicate with you about our services, events, and relevant updates;
- facilitate your entry or participation in any Grand Columbia promotion, competition, or event;
- maintain a safe, secure, and compliant environment at our premises;
- conduct internal audits, investigations, and security reviews;
- perform analytics to better understand customer preferences and improve our offerings;
- personalise products, services, and communications directed to you;
- administer loyalty programmes and reward schemes;
- share data within the Grand Columbia Group for internal reporting, analytics, and service coordination;
- send marketing and promotional communications where you have given the necessary consent;
- comply with our legal, regulatory, and statutory obligations; and
- maintain internal records and support customer relationship management activities.
2.2 For Vendors, Suppliers, Tenants, and Service Providers
We process your personal data as required or permitted by law, and in connection with our commercial dealings with you, including to:
- evaluate and process applications, tenders, or credit account requests;
- conduct due diligence and creditworthiness assessments;
- administer and give effect to contracts, tenancy agreements, and commercial arrangements;
- process payments and manage financial transactions;
- meet insurance, audit, and compliance requirements;
- carry out internal security and investigative processes; and
- maintain vendor, supplier, and service provider records.
If you have agreed to receive marketing or promotional materials from Grand Columbia, you may withdraw that consent at any time by using the unsubscribe option in our communications or by contacting us directly at the details in Section B6.
2.3 Data Analytics
Grand Columbia may consolidate data across its group of companies to conduct analytics for business planning, customer experience improvement, and service development. This may include analysing transaction patterns and usage behaviour to tailor our products and communications. Where required by applicable law, your consent will be obtained before your data is used for this purpose.
(3) Sharing and Disclosure of Personal Data
3.1 Within the Grand Columbia Group
Your personal data may be accessed by and shared with entities within the Grand Columbia Group including subsidiaries, associated companies, and holding companies where this is necessary to fulfil the purposes described in Section 2. We ensure that internal access is limited to staff whose roles require it, and that appropriate confidentiality obligations are in place.
3.2 Third-Party Recipients
We may disclose your personal data to third parties in the country of collection or elsewhere where this is required by law, necessary to fulfil a contractual obligation, or otherwise in accordance with the purposes set out in Section 2. These third parties may include:
- professional service providers, including legal, audit, secretarial, and advisory firms;
- financial institutions, payment processors, and insurance providers;
- technology and infrastructure providers, including cloud hosting and IT support services;
- marketing, advertising, and analytics partners;
- event organisers, logistics providers, and facilities management companies;
- joint venture partners, business collaborators, and affiliate networks;
- law enforcement agencies and courts, where disclosure is legally required; and
- government authorities, statutory bodies, and regulatory agencies in the countries where Grand Columbia operates.
In the event of any potential or completed merger, acquisition, restructuring, or disposal of business, your personal data may be disclosed or transferred to the relevant parties involved in such a transaction. By providing your personal data to us, you acknowledge and accept that such disclosure may occur.
3.3 Cross-Border Data Transfers
Given the international nature of our operations, your personal data may be transferred to and processed in countries other than where it was originally collected. Before any such transfer takes place, we take reasonable steps to ensure that:
- the recipient jurisdiction provides a comparable level of data protection, or
- appropriate contractual or technical safeguards are in place to protect your data, or
- your consent to the transfer has been obtained where required by applicable law.
Third parties receiving your personal data across borders are contractually required to handle it in a manner consistent with applicable data protection standards and only for the purposes authorised by us.
(4) Website and Digital Tools
4.1 Cookies and Tracking Technologies
When you visit our website, we may use cookies and similar tracking technologies to recognise your browser, remember your preferences, and improve your browsing experience. Cookies are small data files stored on your device when you connect to our web server. Through these technologies, we may collect:
- the date, time, and specific pages accessed on our website;
- the referring URL or search terms that led you to our site; and
- your browser type, device information, and IP address.
You can configure your browser to refuse cookies or to notify you when cookies are being placed. Please note that doing so may limit the functionality of certain areas of our website.
4.2 Location-Based Features
Certain features on our website or mobile applications may request access to your location. These features are strictly opt-in. You retain full control over whether to share location data and may disable such features through your device or application settings at any time. Location data, where collected, is used solely to provide the service or feature you have requested.
We may use analytics tools within our applications to better understand usage patterns and improve the user experience. Such analytics data is collected in aggregate and does not identify you personally.
4.3 Third-Party Website Links
Our website may contain links to external websites for your reference and convenience. Grand Columbia does not control, endorse, or assume responsibility for the content, accuracy, or privacy practices of any third-party website. We encourage you to read the privacy policies of any website you navigate to from ours.
(5) Your Data Rights
Subject to applicable law, you may have the following rights in respect of your personal data held by Grand Columbia:
- Right of access: to request a copy of the personal data we hold about you;
- Right of correction: to request that we correct or update any inaccurate or incomplete data;
- Right to withdraw consent: to withdraw any previously given consent to our processing of your data, subject to any lawful basis that may permit continued retention;
- Right to restrict processing: to ask us to limit how we use your data in certain circumstances;
- Right to data portability: to request that we transmit your data to another organisation in a machine-readable format, where technically feasible and required by applicable law; and
- Right to lodge a complaint: to escalate concerns to the relevant data protection authority in your jurisdiction.
To exercise any of these rights, please reach out to us using the contact details provided in Section 6 below.
(6) How to Contact Us
For any questions, access or correction requests, consent withdrawals, data complaints, or other enquiries relating to your personal data, please contact us:
Address: G-1, Menara Avenue, 189, Jln Tun Razak, 50400 Kuala Lumpur, Wilayah Persekutuan Kuala Lumpur
Telephone: +603 2166 2728
Email: customercare@planworth.com
Website: www.grandcolumbia.com/contact-us
(7) How We Protect Your Data
Grand Columbia employs a combination of physical, technical, and organisational measures to protect personal data from unauthorised access, loss, misuse, or inadvertent disclosure. Our security practices include:
- maintaining access controls, including user authentication systems and role-based permissions, and promptly revoking access upon an employee’s departure or role change;
- conducting periodic reviews of access logs and system security configurations;
- implementing technical safeguards such as data encryption, firewall protection, and anti-malware systems;
- enforcing physical security at data storage facilities, including CCTV surveillance and controlled access where appropriate;
- restricting the transfer of personal data via removable media or unapproved cloud services, and requiring management authorisation for any such transfer;
- obligating all staff who handle personal data to observe confidentiality requirements; and
- contractually binding third-party service providers to maintain security standards commensurate with applicable law.
While we take these precautions seriously, no method of transmission over the internet is entirely secure. Any personal data transmitted to us electronically is done at your own risk, and we cannot guarantee its security in transit.
(8) How Long We Keep Your Data
We retain personal data for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law or regulation. Our approach to data retention and disposal includes:
- retaining records only for the period needed to support active business relationships or to meet legal and regulatory obligations;
- maintaining a scheduled review process for inactive data;
- periodically deleting or anonymising data that is no longer required for any lawful purpose; and
- prohibiting personal data from being stored on removable devices or unapproved external platforms without written senior management authorisation.
(9) Language
This Privacy Policy is issued in the English language. In the event of any inconsistency between this English version and any translated version, the English version shall take precedence.