Privacy Notice

Effective date: 27 July 2026. Last reviewed: 27 July 2026.

Innovast Sdn Bhd (“Innovast”, “we”, “us”, “our”) is committed to protecting the personal data you entrust to us. This Privacy Notice explains what personal data we collect, why we collect it, how we use and protect it, and the rights available to you under the Personal Data Protection Act 2010 (“PDPA”) and its subsidiary legislation.

1. Who we are

Innovast Sdn Bhd is the data user in respect of the personal data described in this notice.

Company registration number: 202201012221 (1457918-M)
Registered activity: Energy Service Company (ESCO) registered with Suruhanjaya Tenaga, ESCO 327(2023)/76/2024; SEDA recognised
Address: PS-2A, Taman Evergreen, Batu 4, Jalan Klang Lama, Wilayah Persekutuan Kuala Lumpur
Email: anslem@innovast.asia
Telephone: +60 12 355 6214
Websites covered by this notice: innovast.asia and eeca2024.my

2. Personal data we collect

We collect only the personal data we need to respond to you and to deliver our services. Depending on how you interact with us, this may include:

Identity and contact data — name, job title, employer or organisation, business email address, business telephone number.
Enquiry data — the content of messages you send us through our contact form, by email, by telephone or via WhatsApp.
Professional data — where relevant to an engagement, your Registered Energy Manager (REM) registration number or other professional credentials.
Facility and operational data — information about your organisation’s energy consumption, installed equipment, utility accounts and site operations, provided by you or collected during an energy audit. This is generally corporate rather than personal data, but may be linked to a named individual.
Assessment data — answers you submit to online tools we operate, including the EECA 2024 designated consumer threshold checker at eeca2024.my.
Technical data — IP address, browser type and version, device type, operating system, referring page, and pages viewed. See section 10 on cookies and analytics.

We do not knowingly collect sensitive personal data as defined under the PDPA, and we do not require it in order to provide our services. Please do not submit sensitive personal data to us through our website forms.

Our services are directed at organisations and the professionals who work in them. We do not knowingly collect personal data from children.

3. How we collect your personal data

Directly from you — when you complete a form on our websites, subscribe to our updates, download a resource, email or call us, or engage us for a project.
In the course of delivering services — during site surveys, data logging, audits and measurement and verification work.
From your organisation — where a colleague provides your business contact details as a point of contact for a project.
From publicly available and industry sources — including public registers maintained by regulators, company websites, and professional networking platforms, where we are researching organisations that may have obligations under the Energy Efficiency and Conservation Act 2024.
Automatically — through cookies and analytics when you browse our websites.

4. Why we process your personal data

To respond to your enquiries and provide the information or quotation you have asked for.
To deliver the services you or your organisation have engaged us for, including energy audits, energy management system implementation, measurement and verification, and energy performance contracting.
To prepare, submit and support regulatory and grant documentation on your organisation’s behalf, including submissions to Suruhanjaya Tenaga and SEDA Malaysia.
To administer and maintain our client and project records.
To send you technical updates, regulatory bulletins and information about our services, where you have consented to receive them or where you are an existing client and the material is relevant to the services we provide you.
To operate and improve our websites and online tools.
To comply with our legal, regulatory, accounting and reporting obligations.

5. Whether supply of personal data is obligatory

Fields marked as required on our forms must be completed for us to respond to you. If you choose not to provide them, we may be unable to answer your enquiry, deliver a requested resource, or perform the services requested. All other information is supplied voluntarily.

6. Who we disclose your personal data to

We do not sell your personal data. We may disclose it to the following classes of third parties, and only to the extent necessary:

Our specialist consultants and subcontractors — engineers, technicians and analysts engaged by us to carry out site surveys, data logging, installation, analysis and reporting. They are bound to use your data only for the purposes we specify.
Partner ESCOs and principal contractors — where Innovast is engaged as a subcontractor, or where we work jointly on your project with a partner ESCO.
Regulators and government agencies — including Suruhanjaya Tenaga and SEDA Malaysia, where submission of information is required for compliance, registration or grant purposes relating to your organisation.
Service providers — our website hosting provider, email delivery and marketing platform, analytics provider, cloud storage and document processing providers, and professional advisers such as accountants and auditors.
Where required by law — to any authority, court or regulator where we are legally obliged to disclose, or where disclosure is necessary to protect our rights.

7. Transfers outside Malaysia

Some of the service providers we use operate servers outside Malaysia. This means your personal data may be transferred to, stored in or accessed from a place outside Malaysia. Where this occurs we take reasonable steps to satisfy ourselves that the recipient provides a standard of protection comparable to that required under the PDPA. By providing your personal data to us, you consent to such transfers for the purposes set out in this notice.

8. How long we keep your personal data

We keep personal data only for as long as it is needed for the purpose it was collected for, or for as long as we are required to keep it by law.

Enquiries that do not lead to an engagement — retained for 24 months from your last interaction with us, then deleted or anonymised.
Marketing and subscription data — retained until you withdraw your consent or unsubscribe, and for a short period afterwards to record that you have opted out.
Online tool submissions — retained for 24 months from submission.
Client and project records — retained for 7 years after the end of the engagement, in line with our statutory record-keeping, tax and professional obligations, and for longer where a regulatory submission or grant condition requires it.

9. How we protect your personal data

We apply practical technical and organisational measures appropriate to the size of our organisation and the sensitivity of the data we hold. These include encrypted connections to our websites, access controls on our systems and files, restricting access to personal data to those who need it to do their work, confidentiality obligations on our consultants and subcontractors, and periodic review of the third-party platforms we rely on.

No method of transmission or storage is completely secure. If a personal data breach occurs that causes or is likely to cause significant harm, we will notify the Personal Data Protection Commissioner and, where required, the affected individuals, within the timeframes set out in the applicable Personal Data Protection Guidelines.

10. Cookies and analytics

Our websites use cookies and similar technologies. Strictly necessary cookies keep the site working and cannot be switched off. We also use Google Analytics 4 to understand how visitors find and use our site, which sets cookies that collect information about your visit in aggregated form. We use Google Search Console to monitor how our pages appear in search results.

You can block or delete cookies through your browser settings. Doing so may affect how parts of our websites function. Google provides an opt-out browser add-on for Google Analytics.

11. Your rights

Under the PDPA you have the right to:

Access the personal data we hold about you, and be given a copy of it.
Correct personal data that is inaccurate, incomplete, misleading or out of date.
Withdraw your consent to our processing of your personal data, at any time.
Limit the processing of your personal data, including asking us to stop processing it for direct marketing purposes.
Data portability — to request that your personal data be transmitted to another data user, where this is technically feasible and the data is in a format we are able to transfer.

Withdrawing consent or limiting processing may mean we can no longer provide some or all of our services to you. We will tell you if that is the case before we act on your request.

12. How to exercise your rights, or complain

Write to us at anslem@innovast.asia with the subject line “PDPA request”, telling us what you would like us to do. We may ask you for information to verify your identity before we act. We aim to respond to all requests within 21 days.

To unsubscribe from our updates, use the unsubscribe link at the foot of any email we send you, or email us at the address above.

If you are not satisfied with how we have handled your personal data, you may lodge a complaint with the Personal Data Protection Department (Jabatan Perlindungan Data Peribadi), Ministry of Digital, Malaysia.

13. Changes to this notice

We may update this notice from time to time to reflect changes in our practices or in the law. The effective date at the top of this page shows when it was last changed. Where the change is material, we will take reasonable steps to bring it to your attention.

14. Language

This notice is issued in English. A Bahasa Malaysia version is being prepared and will be published on this page. In the event of any inconsistency between the two versions, the Bahasa Malaysia version shall prevail.