Personal Data Protection Policy

Version 2026-10-03

1. Who we are and what this policy covers

The Embassy of the Republic of the Sudan in Malaysia (the "Embassy", "we") is responsible for the personal data you give through the Citizen Portal and the Citizen Portal mobile app (the "Service"). This policy explains what we collect, why, who may see it, how we protect it, and your rights over it.

The Embassy handles personal data in accordance with the applicable laws of the Republic of the Sudan and with this policy. Under this policy, your data is used only for the purposes described here; you are told what is collected and why, and you choose what to give beyond what is required; it is disclosed only as set out in section 7; it is kept secure; it is kept only as long as needed; it is kept accurate; and you can see it and ask for it to be corrected. Consular records are also protected as consular archives under the Vienna Convention on Consular Relations of 1963. All of this is without prejudice to the privileges and immunities of the Embassy under international law.

2. The personal data we collect

• Identity: your full name in Latin and Arabic letters, date of birth, sex, nationality, national ID number, passport number, passport issue and expiry dates, and an image of your passport's biodata (photo) page.
• Contact: phone number, email address, address in Malaysia and address in the Sudan.
• Account: your username, your password (stored only in a scrambled, one-way form that cannot be read back), the dates you signed in, the internet address you used, and the version of the app.
• Services: appointments, document requests, messages and feedback you send, and emergency contacts you add.
• Location (optional): only if you switch on location sharing in your profile, so the Embassy can reach you in an emergency. You can switch it off at any time.
• Consent record: which version of these documents you accepted, when, and from which internet address.

3. How we collect it

• From you, when you register, complete your profile and use the Service.
• From your passport: the photo you take is read automatically on the Embassy's own server to fill in your details. The image is kept with your consular record once you finish registering; if you do not finish, it is deleted within two hours.
• From records the Embassy already holds about you, which your account is linked to when your national ID matches.

4. Why we use it

• To confirm your identity and create and maintain your consular registration.
• To provide consular services: appointments, documents, certificates and replies to your requests.
• To protect and assist citizens, including contacting you or your emergency contacts in a crisis.
• To send you service notices, announcements for citizens, and news of new and upcoming features.
• To understand and act on your feedback, so the Service and our work improve.
• To keep the Service secure and prevent misuse, fraud and impersonation.
• To meet the record-keeping and legal obligations of the Republic of the Sudan.

We do not sell your data and do not use it for commercial marketing.

5. Matching with records we already hold

When you register, your national ID number is compared with the Embassy's existing records using its digits only, ignoring spaces, hyphens and any other characters, so that the same number written in different ways is recognised. If a record matches, your account is linked to it and the details you confirm are used to fill in what is missing and update what has changed. Embassy officers may review these changes. If no record matches, a new record is created and reviewed by an officer.

6. Your choice

The fields marked as required are needed to register you and provide the Service; without them we cannot open an account. Other fields are optional. By accepting this policy you consent to the use of your data as described here. You may withdraw your consent at any time by asking the Embassy to close your account, although this may mean we can no longer provide services to you through the Service.

7. Who may see your data

• Authorised Embassy staff, each only to the extent their duties require.
• The competent authorities of the Republic of the Sudan, such as the Ministry of Foreign Affairs and the civil registry and passport authorities, where this is needed to carry out a consular function or is required by law.
• Technical service providers who host or maintain the system for the Embassy, under a duty of confidentiality.
• Authorities of Malaysia only where required by law, or where necessary to protect your life, health or safety in an emergency.

8. Where your data is kept

Your data is stored on servers operated for the Government of the Republic of the Sudan, which may be located outside Malaysia, including in the Sudan. The same protections described in this policy apply wherever it is kept.

9. How we protect it

• Encrypted connections (HTTPS) between your device and the Embassy's server.
• Passwords stored only in a one-way scrambled form.
• Role-based access for staff, and an audit log of changes made to records.
• In the app, an optional fingerprint or PIN lock, and sign-in details held in your device's secure storage.

No system can be guaranteed completely secure. If a breach of your data is likely to cause you significant harm, we will tell you and explain what you can do.

10. How long we keep it

We keep your account data for as long as your account is open. Your consular record is kept for as long as the consular record-keeping rules of the Republic of the Sudan require, even after your account is closed. Passport images from registrations that were not completed are deleted within two hours.

11. Keeping it accurate

Please keep your details up to date through your profile. If something we hold is wrong and you cannot correct it yourself, tell the Embassy.

12. Your rights

• To ask what personal data the Embassy holds about you, and for a copy of it.
• To ask for inaccurate or incomplete data to be corrected.
• To withdraw your consent and ask for your account to be closed.
• To raise a concern about how your data has been handled.

The Embassy may need to confirm your identity before acting on a request, and will reply within a reasonable time.

13. Children

Accounts may only be opened by adults. Children's records are created by a parent or guardian at the Embassy, and their data is handled under this same policy.

14. Changes to this policy

We may update this policy. Each version is dated, and when it changes in substance you will be asked to read and accept the new version before continuing to use the Service.

15. Contact

To exercise your rights or ask about this policy, contact the Consular Section of the Embassy, or visit the Embassy during its public opening hours.

This policy is published in Arabic and English. If the two versions differ, the Arabic version prevails.