Ogos Learning
Legal · Privacy
Privacy Policy
How Ogos Learning collects, uses, shares, retains and protects personal data when you visit or use the platform.
- Version
- v1.6
- Effective date
- 1 August 2026
Issued by: Ogos Learning Resources Sdn. Bhd. (Company No. 201501025295 (1150618-P))
Applies to: ogoslearning.com and the Ogos Learning platform
1. Introduction
1.1 Who we are
Ogos Learning Resources Sdn. Bhd. (Company No. 201501025295 (1150618-P)) ("Ogos Learning", "we", "us", "our") operates the Ogos Learning platform at ogoslearning.com (the "Platform"). We are the data user in respect of the personal data described in this policy.
1.2 What this policy covers
This policy explains what personal data we collect about you, why we collect it, who we share it with, how long we keep it, and what rights you have. It applies to learners, prospective learners, instructors and visitors to the Platform.
1.3 Legal basis
We process personal data in accordance with the Personal Data Protection Act 2010 (Malaysia) ("PDPA").
1.4 Relationship to our Terms
This policy forms part of, and should be read together with, our Terms of Service.
2. What We Collect
2.1 Information you give us
When you create an Account or enrol in a Course, we collect:
| Data | Notes |
|---|---|
| First name, last name, display name | |
| Email address | Your primary account identifier |
| Password | Stored in hashed form; we never see it in plain text |
| Profile photo | Optional |
| Job title | Optional |
| Company / employer | Optional |
| Biography | Optional, learner-editable |
2.2 Identification and professional data
For certain Courses — principally those that are accredited, that lead to a professional certification, or that are funded — we also collect:
| Data | Why we need it |
|---|---|
| NRIC number | Identity verification for certification and for funded-training claims |
| Passport number | Alternative identifier for non-Malaysian learners |
| Nationality | Funding eligibility and accreditation reporting |
| FIMM number | Where a Course carries credit recognised by the Federation of Investment Managers Malaysia |
We collect these fields only where a certification, accreditation or funding requirement makes them necessary. They are the most sensitive data we hold, and Clause 8 describes how we protect them.
2.3 Enrolment and learning data
When you use a Course we record:
- Which Courses you are enrolled in, and how the Enrolment arose (self-purchase or granted);
- Your enrolment date and access-window expiry date;
- Your progress through Modules, and your current position in the Course;
- Your pre-assessment and post-assessment scores;
- Your last activity date;
- Certificates issued to you.
2.4 Payment data
Where you pay for a Course through the Platform, we record the amount paid, currency, payment provider and order reference.
Payment is processed by Stripe on a checkout page hosted by Stripe, not by us. When you proceed to payment you leave the Ogos Learning Platform. We do not receive or store your full card number, CVV, or bank credentials — those are handled by Stripe and, for FPX payments, by your bank. Stripe applies its own privacy policy to that page.
If you choose to save your payment details for faster checkout, that is a service Stripe provides to you directly under its own terms. We do not hold those saved details.
2.5 Technical data
Our hosting and security providers process standard technical data including IP address, browser and device type, and page-request logs. We also record a timestamped record of your acceptance of our Terms of Service, including your account identifier and IP address.
2.6 Communications
We keep records of emails and support correspondence between you and us, and delivery records for platform emails we send you.
2.7 Information from third parties
If you sign in using Google, Google provides us with your name and email address. If your Enrolment is arranged by an employer, training provider or funding body, that party provides us with the details needed to create your Account and Enrolment.
3. Why We Use It
We use personal data for the following purposes:
3.1 To provide the Platform
Creating and administering your Account, granting Course access, delivering Content, tracking progress, running assessments and issuing Certificates.
3.2 To process payments
Taking payment, issuing confirmations and order references, maintaining your payment history, and handling refunds.
3.3 To communicate with you
Sending account emails (password resets, access-granted notices, purchase confirmations, course reminders, certificate notifications) and responding to your enquiries. Account and transactional emails are not optional while you hold an Account.
3.4 To meet certification, accreditation and funding obligations
Verifying identity, reporting attendance and completion, and supporting claims to funding and accrediting bodies including HRD Corp and relevant professional bodies.
3.5 To operate our business
Accounting, tax, audit, record-keeping, dispute resolution and enforcement of our Terms.
3.6 To improve the Platform
Understanding how Courses are used so we can improve content and functionality. Where practicable we use aggregated data for this purpose.
3.7 Marketing
With your consent, sending information about new Courses and offers. You may withdraw that consent at any time using the unsubscribe link in any marketing email or by contacting us. Withdrawing marketing consent does not stop account and transactional emails.
4. How Long We Keep It
We keep personal data only for as long as we need it for the purposes set out in Clause 3, or for as long as the law, an accrediting body or a funder requires — whichever is longer.
What determines how long we keep something:
| Driver | What it covers | Guide |
|---|---|---|
| Legal record-keeping | Payment, invoicing and financial records | Malaysian companies and tax law require business and accounting records to be kept for at least seven years |
| Funding and accreditation audit | Enrolment, attendance, progress, assessment and certification records supporting a funded or accredited Course, together with the identification data those claims rely on | Training funders including HRD Corp require original training documentation to be retained for at least seven years for audit |
| Credential verification | Certification records | Kept for as long as we may reasonably be asked to confirm that a credential is genuine |
| Your relationship with us | Account and profile data | Kept while your Account is active, and for a reasonable period afterwards so that you can return and so that we can deal with any query or dispute |
| Evidence of your choices | Marketing consent and withdrawal records | Kept so that we can show a withdrawal was received and honoured |
| Operations and security | Technical and email delivery logs | Kept for a short period only |
Where the law, an accrediting body or a funder requires us to keep a record for longer, we will do so, and will retain only what that obligation requires.
We review the personal data we hold and delete it, or irreversibly anonymise it, once it is no longer needed for the purposes above. If you would like to know how long we expect to hold a particular record, contact us using the details in Clause 13 and we will tell you.
5. Where Your Data Is Held
5.1 Hosting
The Platform is hosted on Cloudflare's global cloud infrastructure. Cloudflare operates a distributed edge network, which means Platform content and requests may be served from data centres in a number of countries, including outside Malaysia.
5.2 Transfers outside Malaysia
Some of our service providers process data outside Malaysia:
| Provider | Function | Processing location |
|---|---|---|
| Stripe | Payment processing | Outside Malaysia |
| Vimeo | Course video hosting and delivery | Outside Malaysia |
| Resend / Amazon SES | Platform email delivery | Asia Pacific (Tokyo) |
| Cloudflare | Hosting, content delivery and security | Global edge network |
| hCaptcha | Bot and fraud protection on the Stripe checkout page | Outside Malaysia |
| Optional sign-in, and payment wallet options at checkout | Outside Malaysia |
Where personal data is transferred outside Malaysia, we take reasonable steps to ensure it is protected to a standard consistent with the PDPA, including through the contractual terms we hold with each provider.
6. Who We Share It With
We do not sell your personal data. We share it only as set out below.
6.1 Service providers
The providers listed in Clause 5.2, acting as data processors on our instructions and limited to what each needs to perform its function.
6.2 Employers, sponsors and funding bodies
Where your Enrolment is paid for, arranged or funded by another party, we share the personal data that party needs in order to administer, verify or claim against that arrangement.
With HRD Corp, in support of a funded-training claim, we submit:
| Data | Details |
|---|---|
| Your full name | |
| Your NRIC number | |
| Your employer | |
| Your job title |
With a sponsoring employer or training provider, we may in addition share your enrolment status, attendance, progress, assessment results and completion or certification status.
With a professional or accrediting body whose credit or certification the Course carries, we may share the information that body requires to recognise your completion.
This sharing is a condition of a sponsored or funded Enrolment. If you do not wish your data to be shared in this way, you should enrol as a direct individual learner instead.
6.3 Instructors
Course instructors may see the names, progress and assessment results of learners in Courses they teach.
6.4 Verification requests
We may confirm the authenticity of a Certificate you hold to an employer, professional body or funder who asks us to verify it.
6.5 Legal and regulatory
Where required by law, court order, regulator, or to establish, exercise or defend a legal claim.
6.6 Business transfer
If our business or a part of it is transferred, personal data may transfer with it, subject to the protections in this policy.
7. Cookies and Similar Technologies
7.1 What we use on the Platform
Ordinary browsing while you are signed out sets no cookies. If you choose "sign in with Google", we set four short-lived cookies that are strictly necessary to secure and complete that sign-in flow. They are HttpOnly, expire after 10 minutes, and are removed when the flow completes.
Once you are signed in, we set only the following strictly necessary session cookies:
| Name | Purpose | Duration |
|---|---|---|
| ogos_google_state | Protects the Google sign-in flow against forged requests | 10 minutes, or until sign-in completes |
| ogos_google_return_to | Returns you to the intended Platform page after sign-in | 10 minutes, or until sign-in completes |
| ogos_google_nonce | Protects the identity response against replay | 10 minutes, or until sign-in completes |
| ogos_google_legal_consent | Carries the exact legal versions you accepted, the acceptance time and originating IP address securely through the Google sign-in flow | 10 minutes, or until sign-in completes |
| ogos_session | Keeps you signed in as you move between pages, and lets your session be ended securely | Expires after a limited period, and is removed when you sign out |
These cookies cannot be switched off while you use the relevant sign-in flow or your Account. We may also use equivalent browser storage for the same purpose.
7.2 What we do not use
We do not use advertising cookies. We do not operate analytics or marketing tracking on the Platform, and we do not sell or share browsing data with advertisers. If this changes, we will update this policy and, where the law requires it, ask for your consent first.
7.3 Third parties that set their own cookies
Some parts of the service are provided by third parties which set cookies of their own. These are governed by that provider's privacy policy, not this one.
| Provider | Where | What it is for |
|---|---|---|
| Stripe | The checkout page, which is hosted by Stripe — you leave our Platform to pay | Processing your payment and securing the transaction |
| hCaptcha | The Stripe checkout page | Distinguishing genuine customers from automated fraud |
| The checkout page, and the optional "sign in with Google" flow | Payment wallet options, and sign-in if you choose it | |
| Vimeo | Course and module video players | Delivering and playing course video |
If you are already signed in to a Google account in your browser, Google may be able to read cookies it has previously set on your device when a page loads content from Google. That is a consequence of your existing Google session, not something we create, and it is governed by Google's own privacy policy.
7.4 Managing cookies
You can view, block and delete cookies through your browser settings. Blocking the sign-in cookie will prevent you from staying signed in, and blocking third-party cookies may stop course video or the checkout page from working.
8. How We Protect It
8.1 Technical measures
Encrypted connections (HTTPS), hashed password storage, single-use time-limited password-reset links, authenticated access to all learner and administrative areas, and access controls that limit administrative functions by role.
8.2 Access controls
Administrative access is restricted by role, and a restricted read-only administrative role exists under which identification fields such as NRIC and passport number are not displayed and certificate files are withheld.
8.3 Organisational measures
Access to identification data is limited to staff who need it for certification, accreditation or funding purposes. Exports containing personal data are treated as confidential.
8.4 The honest limit
No system is perfectly secure. We take reasonable steps proportionate to the sensitivity of the data we hold, but we cannot guarantee absolute security, and we do not claim to.
8.5 If something goes wrong
If a breach occurs that is likely to cause you significant harm, we will notify you and the relevant authority as required by law, and will tell you what happened and what we are doing about it.
9. Your Rights
Under the PDPA you have the right to:
| Right | What it means |
|---|---|
| Access | Ask for a copy of the personal data we hold about you |
| Correction | Ask us to correct data that is inaccurate, incomplete or out of date |
| Withdraw consent | Withdraw consent to processing that relies on it, including marketing |
| Limit processing | Ask us to limit processing for direct marketing or other specified purposes |
| Enquire | Ask how your data has been used and to whom it has been disclosed |
9.1 How to exercise them
Email legal@ogoslearning.com with your request and enough detail to identify your Account. We may ask you to verify your identity before we act.
9.2 Our response
We will respond to a valid request within 21 days of receiving it, in line with the period set under the PDPA. If we need longer, we will tell you within that period and explain why.
9.3 Where a right is limited
Some rights are limited where we are required to retain data for accreditation, funding-claim audit, tax or legal reasons. Where we cannot fully meet a request, we will tell you why.
9.4 Correcting your own record
You can update most profile fields yourself. Your account email address is not directly editable — contact us and we will transfer your records to a new address.
9.5 Complaints
If you are unhappy with how we have handled your personal data, contact us first. You may also lodge a complaint with the Personal Data Protection Commissioner (Jabatan Perlindungan Data Peribadi Malaysia).
10. What Is Required and What Is Optional
Some data is required: without your name, email address, and — for accredited, certified or funded Courses — your identification and professional reference numbers, we cannot create your Account, deliver the Course, issue a Certificate, or support a funding claim.
Some data is optional: your job title, company or employer, profile photo, biography and marketing preferences. Declining these does not affect your access to any Course.
Note that where your Enrolment is sponsored or funded, your employer is already known to us through that arrangement (Clause 6.2), whether or not you complete the employer field yourself.
11. Children
The Platform is intended for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If we become aware that we have, we will delete it.
12. Changes to This Policy
We may update this policy from time to time. Material changes will be notified by email, where an address is held on your Account, or by notice on the Platform. The version number and effective date at the top of this document indicate the current version.
13. Contact
Ogos Learning Resources Sdn. Bhd. Company No. 201501025295 (1150618-P) Privacy enquiries: legal@ogoslearning.com Registered Address: A508, Kelana Square, Jln SS7/26, Kelana Jaya, 47301 Petaling Jaya, Selangor. Business Address: 5 Jalan BK 5/11G, Bandar Kinrara, 47180 Puchong, Selangor.
v1.6 · 1 August 2026
Back to top