Privacy Policy

Last updated Sep 19, 2026

The Malaysia Competition Commission (“MyCC”, “we”, “us”) operates the MyCC eLearning 2.0 System. This notice explains what personal data the system holds about you, why we hold it, who else can see it, and what you can ask us to do with it. It covers this system only, and not MyCC’s other websites or services.

1. The information we hold

Your account

Your name and email address, and — where you provide them — your phone number, city and country. We also record the role your account holds, which decides what you can reach: learner, tutor or administrator.

How you sign in

Either a password you set, which is stored only as a one-way hash and is never readable by us or by MyCC staff, or your Google account. If you sign in with Google we receive and store the account identifier Google issues for you, the email address on that account, and a link to your Google profile picture. We never receive your Google password, and we cannot use your Google account for anything beyond confirming who you are.

Records carried over from the previous system

This system replaces an earlier MyCC eLearning platform. If you held an account there, your name, email address, enrolment, completed modules, assessment results and any certificate already issued to you were transferred across so that your training record continues unbroken. Nothing new was collected about you in the process.

What you do on the course

Which modules you open and complete, how much of each video you have watched, when you enter the virtual classroom, each assessment attempt together with your answers, score and the time you sat it, and any certificate issued to you. Progress is recorded because completion and certification depend on it.

Technical and security records

The date and time you last used the system; your IP address at the moment you submit the registration form, which is passed to Google reCAPTCHA so that automated sign-ups can be told apart from real people; a log of administrative actions taken on your record, so that a change can be traced to whoever made it; and a log of the emails the system has sent you.

2. Why we hold it

To give you access to the training you are enrolled in, and to record how far through it you are.
To set and mark assessments, and to issue a certificate when you meet the requirements.
To let a certificate you have been issued be checked by somebody you show it to.
To contact you about your enrolment, your account, and the training itself.
To keep the system secure, to prevent abuse of it, and to investigate a problem when one is reported.
To report on participation in MyCC’s competition-compliance training. Reporting of this kind is produced in aggregate and does not name you.

3. What other people can see

Certificate checking is public

Every certificate carries a printed code. Anyone holding that code can enter it on our verification page without signing in, and will be shown the name of the person the certificate was issued to, the course title and the date of issue. This is deliberate: it is how an employer or a regulator confirms that a certificate they have been handed is genuine. Nothing else about you is shown, and the code cannot be guessed from your name.

If a certificate is later withdrawn, the personal details on it are erased and the code reports only that a certificate with that number was withdrawn.

MyCC administrators and tutors can see your account details and your learning record, because administering the training requires it. Their actions on your record are logged.

We do not sell, rent or trade personal data, and we do not use it for advertising or profiling.

4. Services outside this system

Some parts of the system rely on providers outside MyCC. Where they are involved, their own privacy terms apply in addition to this notice.

Google: Signing in with Google, if you choose it, and the “I am not a robot” check on the registration form. Google receives your email address in the first case and your IP address in the second.
The virtual classroom: The interactive classroom is provided by a third party and is embedded inside the course. Opening it loads content from that provider, which will see that a browser has requested it.
Email delivery and hosting: Email the system sends you passes through a delivery provider, and the system itself runs on hosted infrastructure. Both process personal data on MyCC’s instructions and for no purpose of their own.

5. How long we keep it

Training records and certificates are kept for as long as a certificate may reasonably need to be relied on or checked. An account that is deleted is held in a recoverable state for 7 days before it is removed permanently, so that a deletion made in error can be undone. Administrative and email logs are pruned on a schedule.

You can ask us to erase your personal data. Where a certificate has been issued to you we will withdraw it rather than delete the record outright, so that anybody holding the printed copy is told it is no longer valid instead of being shown nothing at all.

6. Your rights

Under the Personal Data Protection Act 2010 you may ask us for a copy of the personal data we hold about you, ask us to correct it where it is wrong, ask us to limit how it is used, and withdraw a consent you previously gave. Write to us using the contact details below and we will respond within the period the Act allows.

Some processing is necessary to run the training at all — a record of who completed what, for instance. If you withdraw consent to that, we may no longer be able to keep your account or issue you a certificate.

7. Cookies

The system sets a session cookie to keep you signed in while you use it, and a longer-lived cookie if you ask it to remember you on a device. The registration page loads Google reCAPTCHA, which sets cookies of its own. We set no advertising cookies and do no cross-site tracking.

8. Changes to this notice

We may update this notice as the system changes. The date at the top always reflects the current version, and we will tell enrolled learners by email if a change materially affects them.

9. Contact us

For anything in this notice, including a request about your own data, contact the Malaysia Competition Commission using the details published on our main website.