Your information should be treated with the same care as your trust.

Who we are

CAPAi is PCME's public community platform for preparedness, accessible learning, volunteer action and responsible partnerships. PCME determines how personal data collected through CAPAi is processed.

Questions about this policy or our handling of personal data may be directed to the Data Protection Officer listed below.

Scope of this policy

This policy applies to personal data processed through:

• the CAPAi website, public learning catalogue and participation or contact forms;
• historical learning enrolment, progress and completion records retained from the former CAPAi Site pilot;
• community events, volunteer activities and demonstration requests;
• preparedness checklists, Telegram chatbot pilots and related administrative dashboards; and
• historical MAN-isme enrolment, benefit, cohort-access and progress records retained from the former CAPAi Site pilot.

The CAPAi KSDA Learning Hub at /learn uses Supabase for Google, email/password and email-code sign-in, and for learner records. The pilot stores your verified email and learner ID, display name, preferred language, onboarding status, programme enrolment and aggregate topic progress. Topic completion is self-reported and does not certify practical competence. Optional on-page notes and reflection choices are temporary and are not sent to CAPAi. If you choose Google, Supabase receives your email and basic Google profile information for sign-in. CAPAi does not request access to your Gmail messages. CAPAi passwords are handled by Supabase Auth; they are not stored as plaintext in CAPAi learning records. The pilot does not store workbook answers, journals or After Action Review writing. CAPAi.com.my does not request banking passwords or full payment-card credentials.

Information we collect

Information you provide

• name, email address and any optional mobile or WhatsApp number you provide through CAPAi.com.my contact or participation forms;
• organisation, Rukun Tetangga, role and general location;
• participation pathway, enquiry, feedback and communications;
• historical learning enrolment, course progress, assessments and completion details retained from the former Site pilot;
• historical MAN-isme enrolment details, including first name, email address, consent records, source information and optional marketing choice;
• historical MAN-isme cohort, entitlement, Founding Reader Book Benefit, programme and mission-progress records retained for verification, audit or migration;
• preparedness checklist responses or programme participation records you choose to submit; and
• information reasonably required to manage an event, volunteer role, partnership or privacy request.

Information collected automatically

Our hosting and security providers may process IP address, device and browser information, approximate location derived from IP, referral source, pages visited, timestamps and technical logs. Analytics information is collected only where analytics is enabled and disclosed.

Please do not submit identity documents, financial credentials, health information or other sensitive data unless CAPAi specifically requests it for a necessary and stated purpose.

How we use personal data

We may use personal data to:

• assess and respond to enquiries;
• coordinate volunteers, partners, trainers, RT programmes and demonstrations;
• retain, verify, export or support migration of historical learning and MAN-isme records from the former Site pilot;
• administer any valid historical MAN-isme Founding Reader Book Benefit record;
• send essential security, verification or administration messages connected to a record or request;
• send optional programme or book-project news only where valid marketing consent has been recorded;
• provide checklist guidance, reminders and community preparedness services;
• send requested programme, course or participation updates;
• maintain accountable governance, consent and activity records;
• protect the website, prevent misuse and improve service reliability; and
• meet applicable legal, regulatory or audit requirements.

We will not use personal data for a materially different purpose without providing an appropriate notice and obtaining consent where required.

Consent, choices and children

By submitting a form, creating an account or voluntarily providing information, you consent to processing for the purposes described at the point of collection and in this policy. Optional fields may be left blank. You may withdraw consent for future processing, although this may limit our ability to provide a requested service.

The CAPAi Learning Hub presents its own required and optional choices at the point where it collects information. Historical consent records from the former CAPAi Site pilot are preserved so PCME can respect the choices already made. You may withdraw optional marketing consent at any time.

A participant under 18 should provide personal data only with the knowledge and consent of a parent, legal guardian or authorised programme organiser. CAPAi does not knowingly seek unnecessary personal data from children.

Sharing personal data

We do not sell personal data. Access may be provided only where necessary to:

• authorised PCME/CAPAi administrators;
• approved trainers, programme coordinators or delivery partners handling the relevant activity;
• service providers supporting hosting, databases, email, analytics, learning, chatbot, payment or security functions; and
• regulators, law-enforcement agencies or other parties where disclosure is required or permitted by law.

Service providers and partners are expected to protect the information they process and use it only for the agreed purpose.

Cookies and analytics

Essential cookies or similar technologies may be used for security, preferences and core website functions. The CAPAi KSDA Learning Hub at /learn uses Supabase authentication and session cookies to keep you signed in. It saves programme enrolment and aggregate topic progress as described in section 02. Historical records from the former CAPAi Site pilot are described separately in this policy. Optional analytics may be used to understand website performance and improve the visitor experience. You may restrict cookies in your browser, although some functions may not operate correctly.

Data security and breach response

We use proportionate technical and organisational safeguards, including encrypted connections, access controls, role separation, managed hosting, backups where appropriate and administrative review. No online system can be guaranteed completely secure.

If a personal data breach is likely to cause significant harm, we will assess, contain and notify affected individuals and the Personal Data Protection Commissioner where required by applicable law.

Reference ebook access / Akses ebook rujukan

When enabled, manual ebook access stores your learner ID, resource, activation and expiry dates, and access status. A restricted audit records grant, revoke, restore and renewal actions, the administrator identity, and a short order reference or reason. Payment remains in the external shop. Ebook answers and reflections stay temporarily on the open page; CAPAi does not save them or record ebook completion or reading percentages.

Apabila diaktifkan, akses ebook manual menyimpan ID pelajar, sumber, tarikh pengaktifan dan tamat tempoh serta status akses. Audit terhad merekodkan pemberian, pembatalan, pemulihan dan pembaharuan akses, identiti pentadbir serta rujukan pesanan atau sebab ringkas. Pembayaran kekal di kedai luar. Jawapan dan refleksi ebook hanya berada sementara pada halaman terbuka; CAPAi tidak menyimpannya atau merekodkan penyelesaian atau peratus bacaan ebook.

Data retention

We retain personal data only for as long as reasonably necessary for the stated purpose, an active relationship, governance or audit requirements, dispute handling, security, or applicable law. Historical learning and completion records from the former Site pilot may be retained for up to six years after closure or completion where required for verification, legal or audit purposes.

A valid MAN-isme Founding Reader Book Benefit remains attached to the registered email so it can be verified at launch. If you ask us to delete all identifying and entitlement records, we may no longer be able to verify or honour that benefit.

When information is no longer required, we will take reasonable steps to delete, anonymise or securely dispose of it.

International transfers

Some technology providers may store or process information outside Malaysia. Where this occurs, we will use providers and safeguards intended to provide a standard of protection comparable to applicable Malaysian requirements.

Your rights and requests

Subject to applicable law, you may request to:

• access personal data held about you;
• correct incomplete, inaccurate or outdated information;
• withdraw consent or stop direct marketing;
• request deletion where retention is no longer required or legally necessary;
• request data portability where the right applies; or
• raise a concern or complaint about our processing.

We may need to verify your identity before completing a request. You may also contact Malaysia's Personal Data Protection Commissioner if you remain dissatisfied.

Contact, external services and policy updates

CAPAi pages may link to third-party services. Their privacy and security practices are governed by their own notices. We may update this policy when our services, technology or legal obligations change. The updated version and date will be posted on this page.