Data Protection Notice

How We Use Personal Data

The categories of information (data) that we may gather and process for our clients, partner institution representatives and suppliers include:

For clients:

  • Personal information (including, but not limited to: name, IC number, passport number, contact details, email and residential address, nationality).
  • Parents’/ appointed legal guardian’s information and contacts (including, but not limited to: IC number, passport number, contact details, email and residential address, nationality).
  • Other identifiers (including, but not limited to: ethnicity, language, religion).
  • Safeguarding information (such as court orders and professional involvement).
  • Special educational and / or dietary needs.
  • Medical and administration (such as doctors information, student health, dental health, allergies, medication and dietary requirements).
  • Attendance (previous/current schools attended/attending and exam results).
  • Assessment and attainment (such as exam results, other relevant results)
  • Ability to finance for course(s) identified

For Partner Institutions and Their Authorised Representatives:

  • Personal information (e.g. name, title, passport number, contact details, email, residential address, nationality, employing institution).

For Supplier Contacts:

  • Personal information (e.g. name, title, contact details, email, office address, employing organisation).
  • Types of goods/services supplied and pricing.  

We collect and use the above information to:

  • Provide psychometric profiling services.
  • Support applications for tertiary education and beyond   
  • Arrange for appropriate pastoral care and learning support where needed.
  • Keep clients and partner institution representatives safe (food allergies, or emergency contact details).
  • Advise clients of events that may, in Findlay’s opinion, be of interest to them.    
  • Meet the obligations placed upon us by the Brunei government and our partners and institutions.
  • Obtain goods/services at competitive rates to meet our operational needs   
  • Assess the quality of our services

Collecting Information

We collect only information required to fulfil our obligations through:

  • Registration forms
  • Email
  • Messaging applications

Whilst most of the information requested is mandatory (e.g. for applications to study overseas) some of it may be requested on a voluntary basis. In order to comply with the Personal Data Protection Order, we will advise at the point of collection, whether we need certain information or if you have a choice in this.

Storing Data:

We hold  data securely for the set amount of time shown in our data retention schedule. For more information please contact us.  

We Routinely Share Information With:

  • Higher (tertiary) education institutions and partners.
  • The Government of Brunei.
  • Ministry of Education (MoE).
  • Any party in Brunei with whom we are required to share by any written law.   

Why We Share Information:

We do not share information about our clients or partners with anyone without consent unless the laws of Brunei or the best interests of our clients and our policies allow us to do so.  For example, if we aren’t allowed to share information such as name, chosen course of study, exam results, etc with a student’s chosen university when we process their application or invoice for services rendered, the university will reject the application / invoice.

Student Support:

Once our students return to Brunei, we use this information to offer employment training (CV Writing, Interviewing, Presentation Skills) to provide support in seeking employment.  The information is limited to Findlay staff.

Ministry of Education (MoE):

The MoE collects personal data from educational institutions and agencies via various statutory data collections. We are required to share information about our students with the MoE.  All data is transferred securely and held by the MoE under a combination of software and hardware channels.

Requesting Access to Your Personal Data:

You may request for your personal information, or be given access to your records by contacting Findlay’s Data Protection Officer. 

You also have the right:

  • To be informed about the collection and use of your personal data (the “right to be informed”).
  • To ask for copies of the personal information we have about you (“right of access”).
  • To ask Findlay to change any information that you consider is not accurate or complete (“right to rectification”).
  • To ask us to delete personal information (“right to erasure”).
  • To ask Findlay to stop using your information (“right to restriction of processing”).
  • The “right to object to processing” of your information, in certain circumstances
  • Rights related to automated decision making and profiling.
  • To withdraw consent at any time (where relevant).
  • To complain to AITI if you feel we have not used your information in the right way.

When We May Refuse an Information Rights Request:

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it. For example, some rights will not apply:

  • The right to erasure does not apply when the lawful basis for processing is legal obligation or public task.
  • The right to portability does not apply when the lawful basis for processing is legal obligation, vital interests, public task or legitimate interests.
  • The right to object does not apply when the lawful basis for processing is contract, legal obligation or vital interests.
  • If the lawful basis is consent, you don’t haven’t the right to object, but you have the right to withdraw consent.

If you have a concern about the way we are collecting or using your personal data, you should raise your concern with us in the first instance.

Withdrawal of Consent and the Right to Lodge a Complaint:

We will only process data with your consent for the purpose(s) to which you have consented.  Where we are processing your personal data with your consent, you have the right to withdraw that consent. If you change your mind, or you are unhappy with our use of your personal data, please let us know by contacting your consultant or our DPO.

Last Updated

We may need to update this privacy notice periodically so we recommend that you revisit this information from time to time. This version was last updated on 01 December 2025.

 

Contact

If you would like to discuss anything in this privacy notice, please contact The Data Protection Officer:

Tel: +673 2428658

Email: dpofindlaybsb@gmail.com