Privacy Policy

1. Information We Collect

When you interact with our website or enquire about our services, we may collect the following personal data:

• Contact information: name, email address, phone number (if provided)
• Business information: business name, industry, nature of the issue you'd like to discuss — shared voluntarily in enquiry messages
• Engagement data: notes, documents, and information shared during advisory sessions
• Website data: cookies and analytics information (see Section 5)

Legal basis: Data is collected on the basis of your consent (when you submit an enquiry form), performance of a contract (when you engage our services), and our legitimate interest in operating our business professionally.

Retention: Contact enquiry data is retained for up to 24 months. Engagement records are retained for up to 5 years in line with standard business record-keeping practice, then securely deleted.

2. How We Use Your Information

We use the personal data we collect for the following purposes:

• Responding to your enquiries and scheduling conversations
• Delivering our consulting services and producing written reports or summaries
• Maintaining records of our engagement for continuity of advisory support
• Sending service-related communications (session reminders, document delivery)
• Improving our website and services through anonymised analytics data
• Complying with legal obligations under Malaysian law

We do not sell personal data to third parties. We do not use client data for marketing to unrelated third parties. We do not share business information disclosed during engagements with any outside party without explicit written consent.

3. How We Protect Your Data

• Engagement documents are stored on password-protected systems with restricted access
• Email communications are conducted via encrypted channels where possible
• Only team members directly involved in your engagement have access to your data
• Physical documents (if any) are stored in secured, locked premises
• In the event of a data breach affecting your personal data, we will notify you within a reasonable timeframe and take immediate steps to address the incident

4. Third-Party Services

Our website may use the following third-party services, each of which may process limited data in connection with our site:

• Google Analytics: anonymised usage statistics — pages visited, session duration. No personally identifiable data is shared.
• Google Maps: used for the embedded map on our homepage to display our office location. Subject to Google's own privacy policy.
• Web hosting provider: server logs may include IP addresses and browser information for security and performance monitoring.

Our website may contain links to external websites. We are not responsible for the privacy practices of those sites and encourage you to review their policies independently.

5. Cookies

Our website uses cookies to improve your browsing experience and understand how visitors use our site. Cookies we use include:

• Essential cookies: necessary for basic site functionality. Cannot be disabled.
• Analytics cookies: help us understand how visitors interact with our site. Used only with your consent.
• Preference cookies: remember your cookie consent choice.

You can manage your cookie preferences at any time on our Cookie Policy page.

6. Your Rights Under the PDPA (Malaysia)

Under the Personal Data Protection Act 2010, you have the following rights in respect of personal data we hold about you:

• Right of access: request a copy of the personal data we hold about you
• Right to correction: request that inaccurate or incomplete data be corrected
• Right to withdraw consent: withdraw consent to processing at any time, where processing is based on consent
• Right to limit processing: request that we restrict the use of your data in certain circumstances
• Right to complain: lodge a complaint with the Department of Personal Data Protection Malaysia (JPDP) if you believe your rights have been violated

To exercise any of these rights, contact us at [email protected]. We will respond within 21 days.

7. Children's Privacy

Our services are intended for business owners and are not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently done so, please contact us and we will delete the data promptly.

8. Changes to This Policy

We may update this policy from time to time to reflect changes in our practices or legal requirements. When we do, we will update the "Last Updated" date at the top of this page. For significant changes, we will make a reasonable effort to notify active clients directly. Continued use of our website after a policy update constitutes acceptance of the revised terms.