BIACC Sdn Bhd (“The Company”, “we”, “us” or “our””) collects, uses, discloses, processes and cares for (collectively as “processes”) personal data in accordance with the Personal Data Protection Order 2025 (“PDPO”). This Privacy Notice (“Notice”) explains how we process personal data while meeting the requirements of the PDPO.
Queries, requests for access to or correction of personal data, notices (e.g., for withdrawal of consent) and complaints relating to your personal data may be sent in writing to us in the following manner (and, if applicable, with the information specified in this Notice):
| Attention to | : | The Data Protection Officer |
| via Email | : | dpo@biacc.com.bn |
| by post | : | BIACC Sdn Bhd Air Cargo Terminal, Brunei International Airport, Berakas, BB2513, Brunei Darussalam |
2.1. The term “personal data” means data, whether true or not, about an individual who can be identified either (a) from the data, or (b) from the data and other information which we have or to which we are likely to have access. Refer Annex 2 for Definitions and Glossary.
2.2. Source of Personal Data
We collect personal data directly from you through the following sources:
2.2.1. Directly from you: this information you provide to us directly through your interactions, such as when you:
a. use our services and/or websites;
b. contact us with inquiries, feedback or complaints;
c. apply for employment or attend our events; or
d. participate in our surveys, studies or promotional activities.
2.2.2. From third parties: We may also receive your personal data from other sources, where permitted by law. These may include:
a. government agencies and public registries;
b. your employer or organisation (where you engage with us in a professional capacity;
c. business partners and service providers (e.g., for fraud prevention or service enhancement).
2.3. Categories of Personal Data We Collect
We collect the following categories of personal data that are reasonably necessary for the purposes outlined in this Notice:
2.3.1. Identity and Contact Data: This includes your full name, NRIC number, passport or other identification details, telephone number, mailing address, email address and photographic or video images (such as from CCTV for security purposes).
2.3.2. Professional and Background Data: In the context of employment applications or business engagements, this may include your employment history, educational background, income level and references from former employers, educational institutions or business partners.
2.3.3. Data Concerning Third Parties: Where you provide us with personal data about other individuals (e.g., your spouse, children, or dependents for emergency contact or benefit purposes), we will assume that you have obtained their consent for the disclosure and for us to collect, use and disclose their personal data for the relevant purpose.
3.1. Purpose for Collecting, Using and Disclosing Personal Data
3.1.1. We will collect and use your personal data for specified and legitimate purposes. The primary purposes for which we process your personal data include the following:
| Purpose of Use | Lawful Basis |
|---|---|
| a. Service Delivery and Operations To provide and administer the services you request from us. This includes the necessary uploading and retrieval of your data from authorised third-party systems, such as the Brunei Darussalam National Single Window (BDNSW) for customs clearance or Darussalam Asset Sdn Bhd’s SAP and Procure.bn application systems for accounting and procurement. |
Performance of a Contract |
| b. Legal and Regulatory Compliance To comply with our legal, regulatory, and governmental obligations, both within Brunei Darussalam and internationally. |
Legal Obligation |
| c. Communication and Support To respond to your enquiries, feedback, complaints and requests, and to manage our ongoing relationship with you. |
Legitimate Interests/ Performance of a Contract |
| d. Employment Applications If you apply for a position with us, to process and evaluate your application, validate your references and conduct necessary due diligence. |
Legitimate Interests (to recruit suitable personnel) |
| e. Sharing with Government and Authorised Parties To share your data with Brunei government agencies or other authorised third parties where necessary to fulfil a legal requirement, deliver a public service or as required by law. |
Legal Obligation / Vital Interests / Public Interest |
| f. Protection and Enforcement To protect the security of our services, systems and restricted zones; to enforce our contractual or legal rights; and to protect ourselves against legal liability. |
Legitimate Interests |
| g. Other Purposes We will not use your personal data for purposes materially different from those specified in this notice without first notifying you and, where required by law, obtaining your separate consent. |
Consent (where applicable) |
3.1.2. We will only disclose your personal data to third parties where reasonably necessary and for the purposes outlined in section 3.1.1. The categories of recipients are as follows:
| Category of Recipient | Purpose of Disclosure | Lawful Basis |
|---|---|---|
| a. Service and Logistics Partners Including domestic and international airlines, carriers, freight forwarders and origin/destination handlers. |
To fulfil your service requests (e.g., shipping, logistics) and complete necessary operational transactions. |
Performance of a Contract |
| b. Third-Party Service Providers Including IT vendors, data hosting companies and consultants. |
To support our business operations and service delivery under strict contractual data protection obligations. |
Legitimate Interests |
| c. Government Authorities and Regulators Including Brunei Darussalam government agencies and international regulatory bodies. |
To comply with legal and regulatory obligations, such as customs, security and tax reporting. |
Legal Obligation |
| d. Our Parent Company Darussalam Asset (DA) Sdn Bhd. |
For centralised corporate functions such as financial reporting, audit and strategic planning, under a shared commitment to data protection. |
Legitimate Interests |
| e. Our Directors and Employees Internal personnel on a need-to know basis. |
For the effective performance of their duties in providing you with services and ensuring operational continuity. |
Legitimate Interests / Performance of a Contract |
4.1. We collect, use and disclose your personal data based on specific lawful bases as outlined in Section 3.1 of this Notice. These bases include the performance of a contract, compliance with a legal obligation, our legitimate interests and in specific cases, your consent. Where we process your data based on your consent, you have the right to withdraw it as described in Section 4.2 below.
4.2. You may withdraw your consent for any processing activity where consent is the lawful basis (as specified in Section 3.1) by giving us not less than 15 working days prior written notice in the manner stated under the Statement of Commitment of this Notice. Your notice for withdrawal of consent must be clearly state the following:
a. your full name (as specified in NRIC/Passport);
b. your current correspondence address;
c. the personal data affected by your notice; and
d. the purpose/s or activity/s for which you are withdrawing the consent.
4.3. We may contact you in relation to your withdrawal of consent should we require additional information to process your withdrawal of consent or to inform you of the consequences of your withdrawal of consent.
5.1. You may make a request for access to, or correction of, your personal data which is in our possession or under our control in accordance with (and subject to) the PDPO and its regulations.
5.2. A request under paragraph 5.1 shall be made in writing and sent to us in the manner stated in this Notice (in the Statement of Commitment). Your request must state the following:
a. your full name (as specified in NRIC/Passport);
b. your address, telephone number, email address (so that we may contact you in relation to your request);
c. that you are making the request under the PDPO;
d. whether you are requesting for access to your personal data or for a correction to be made to an error or omission in your personal data; and
e. the specific personal data or correction you are requesting.
5.3. We may contact you in relation to your request should we require additional information to process your request.
6.1. Accuracy of Personal Data
6.1.1. We shall take reasonable steps to ensure personal data collected by us or on our behalf is accurate and complete, it is likely to be:
a. used to make decision that affects you; or
b. disclosed to another organisation.
6.1.2. Where you provide your personal data directly to us, we shall be entitled to assume that it is
accurate and complete.
6.2. Protection of Personal Data and Notification of Data Breach
6.2.1. We shall protect personal data in our possession or under our control by making reasonable security arrangements to prevent loss, unauthorised access, collection, use, disclosure, copying, modification, disposal or similar risks.
6.2.2. We shall notify you (in accordance with and subject to the PDPO) in the event of a data breach affecting your personal data which may cause significant harm.
6.3. Retention of Personal Data
We retain your personal data in accordance with defined retention periods set out in our internal data retention policy. These periods are determined based on the specific purpose for which the data was collected es outlined in Section 3.1 of this Notice, or the nature of the data and to comply with our legal, regulatory and business obligations.
6.4. Transfer of Personal Data Outside Brunei Darussalam
If we transfer personal data to a country or territory outside Brunei Darussalam, we shall ensure that it is protected to a standard of protection that is comparable to the protection under the PDPO in the manner prescribed in the relevant regulations under the PDPO.
7.1. We may amend or update this Notice from time to time.
7.2. Please refer our website at https://www.biacc.com.bn/ for the latest version.
Approval Date: 20 March 2026 / Version: 1.0 / Date of Publish: 02 April 2026