Personal Data Protection Agreement (PDPA)

We may collect: full name, contact details, identification where required, date of birth, nationality, education background, employment details, portfolio submissions, images/videos from programs, IP addresses, emergency contacts and any other information voluntarily provided.

Data is processed for registration, communications, judging and evaluation, event management, regulatory compliance, reporting/analytics, alumni engagement and talent recruitment collaboration with sponsors (subject to consent).

Participants consent to data processing as outlined herein. Separate consent is required for marketing communications and sponsor data sharing. Consent may be withdrawn at any time via info@kolaxus.net.

Kolaxus applies organisational and technical safeguards including access controls, confidentiality obligations, encryption where appropriate and vendor security requirements.

Program data is retained for the program duration plus 24 months. Marketing data (where consented) is kept for 36 months. Legal records are kept as required by law. Data is deleted or anonymised thereafter.

Participants have rights of access, correction, withdrawal of consent, processing restriction, portability (where feasible) and the right to lodge complaints.

With express opt-in, limited non‑sensitive data (name, email, institution, field of study, skills and project summaries) may be shared with approved sponsors or partners solely for recruitment, mentorship, scholarships or collaborative engagements. Sensitive data will never be shared. All partners are contractually bound to PDPA compliance and data deletion obligations. Consent may be withdrawn anytime.

Personal data may be disclosed to authorities if required by law or to contracted processors strictly on a need-to-know basis under PDPA agreements.

International transfers occur only where PDPA‑equivalent safeguards exist or contractual protections apply.

Participants below 18 years old require verified parent/guardian consent.

Any breach posing risk will be investigated, mitigated and reported to affected individuals and regulators as required.

Unresolved issues may be escalated to the Malaysian Department of Personal Data Protection (JPDP).

Kolaxus may amend this policy periodically with prior notice of material changes.

This policy is governed by Malaysian law with jurisdiction in Malaysian courts.

By participating in the Challenge, you acknowledge that you have read, understood, and agreed to the terms of this Personal Data Protection Agreement.