Privacy Policy

Scout360 Sdn Bhd (company registration 202501032514), of Kuala Lumpur, Malaysia, referred to below as “Scout360”, “we”, “us” and “our”, operates this website and the Scout360 ESG Management Platform.

We handle personal data in accordance with the Malaysian Personal Data Protection Act 2010 (PDPA).

This policy is in three parts, because the website and the platform are separate things that collect very different amounts of information, and blending them would tell you almost nothing about either.

• Part one covers this website: the pages you are reading now, which anyone can browse without identifying themselves.
• Part two covers the Scout360 platform: the software your organisation logs in to and uploads sustainability data into, under a service agreement. Nothing in part two applies to you if you are only reading the website.
• Part three covers the commitments that apply to both.

We set no cookies on this website. There is no analytics package, no advertising pixel, no session recording and no third-party tracking script of any kind. Typefaces are served from our own domain rather than a font network, so simply reading these pages reports your visit to nobody.

Two ordinary exceptions are worth naming rather than glossing over:

• Our hosting provider keeps standard web server logs, which include IP addresses, request times and the pages requested. These exist to keep the site running and secure, and we do not use them to build a profile of anyone.
• A small number of images are delivered from Sanity’s content network at cdn.sanity.io. Your browser requests those files directly, so Sanity receives your IP address as part of that request, in the way any image host does.

Because nothing on this website identifies you, there is no consent banner to click through. You are not being asked to agree to tracking, because there is none to agree to.

The enquiry form asks for your name, work email address, organisation and job title, the type of enquiry you are making, and your message. You may also choose to add a phone number, your organisation’s website and how you would prefer to be contacted. Depending on the enquiry type, the form asks a few follow-up questions about your reporting situation, such as the number of sites in scope or the framework you report against. Those follow-ups are there so a specialist can answer you properly first time.

Where a form sits in front of a downloadable template, it collects your name, email address, organisation and role.

This website has no server of its own, so submissions travel from your browser to Web3Forms, which delivers them to our inbox as email. If that request fails for any reason, the form falls back to opening your own mail application with the message ready to send, in which case it reaches us as an ordinary email and Web3Forms is not involved at all.

We use what you send to answer your enquiry and, where you have asked about our services, to follow up about them. We do not sell it, rent it, or pass it to advertisers.

Browsing these pages or sending us an enquiry involves these providers, and no others:

The platform’s providers are listed separately in part two. A visitor to this website never touches them.

This part applies only to organisations that have an account. The platform is used under an agreement with your organisation, and collects considerably more than this website does:

• Account data: name, email address, organisation and role, handled through Kinde, our identity provider.
• Transactional and ESG data: uploaded receipts, environmental readings, supplier records and the operational metrics that feed your reporting.
• Usage data: log files, browser type, IP address, timestamps and device identifiers.

We use this data to operate and authenticate your account, calculate ESG metrics and analytics, improve the platform, and meet our legal and audit obligations.

We require every provider we use to offer data protection safeguards equivalent to those the PDPA expects. By using the platform, you consent to the cross-border transfer of data where that is necessary to deliver the service.

The platform is protected by encryption in transit and at rest, access control on least-privilege principles, and regular vulnerability scanning and monitoring.

Platform data is retained for as long as your account is active, or for as long as the law or our contract with your organisation requires. You may ask us to delete your account and its data at any time.

Enquiries and correspondence from this website are kept while we are dealing with them and for as long as we need a record of the discussion, then deleted. If you would rather we removed your enquiry sooner, ask and we will.

We share personal data only with:

• The service providers listed in parts one and two, and only so far as they need it to do their job.
• Legal or regulatory authorities, where the law requires it of us.
• Partners your organisation has explicitly authorised.

We do not sell or share personal data for advertising purposes, and we do not pass it to unrelated third parties.

Under the PDPA you have the right to access the personal data we hold about you, correct it where it is wrong, withdraw consent you have given, and ask us to delete it.

To exercise any of these, write to admin@scout360.io. We will ask you to confirm your identity before acting on a request, so that nobody else can make one in your name.

We update this policy when what we actually do changes. The current version is always the one published here, and the date at the top of this page tells you when it last changed. This version replaces the policy dated 16 October 2025.

Questions about this policy, or about any personal data we hold, go to admin@scout360.io.

Scout360 Sdn Bhd (202501032514), Kuala Lumpur, Malaysia.