Privacy Notice

1. Who we are

UniLead provides a student recruitment system to Malaysian higher-education institutions. Each institution that uses UniLead is the data user for the enquiries it receives and for its staff accounts; UniLead processes that data on the institution's instructions.

2. What we collect

• Visitors to this website: IP address, approximate location derived from the IP (city and country), device type, operating system, browser, referring site, pages viewed, elements clicked and time on page. We set one first-party cookie (unilead_visitor, one year) to recognise repeat visits. We do not use advertising trackers or third-party analytics.
• Institutions requesting a demo (unilead.my): name, work email, institution, role, phone and message, used only to arrange and follow up the demo.
• Prospective students who submit an enquiry: name, mobile number, email, nationality, state or country, qualification and results, programmes and intake of interest, how you heard about the institution, your message, the advertising campaign that brought you (UTM codes) and the time you gave consent.
• Account holders: name, email, role, institution, password hash, two-factor settings, session and device details, and a log of actions you take in the system.
• Records kept by counsellors: notes of calls, WhatsApp messages, emails and meetings, follow-up tasks and the stage of your application.

3. Why we process it

To let the institution respond to your enquiry and guide you through applying, to operate and secure the service, to detect misuse, to measure which recruitment channels work, and to meet legal obligations. Visitor statistics are reported only to the UniLead Super Admin.

4. Where data is stored

Data is stored on servers operated for UniLead and the institution. Uploaded files are stored in Cloudflare R2 object storage. Email is sent through an SMTP provider. We do not sell personal data.

5. Retention

System logs and visit records are kept for 365 days by default (configurable by the institution's Super Admin). Account data is kept while the account is active and removed on request subject to the institution's record-keeping obligations.

6. Your rights

Under the PDPA you may request access to and correction of your personal data, and withdraw consent for processing that relies on consent. Prospective students should contact the admissions office of the institution they enquired with; it can correct, export or permanently erase your record.

7. Changes

We will post changes to this notice on this page with a new "last updated" date.