Privacy Policy

1. Data Controller

The data controller responsible for your personal information is:

2. Information We Collect

We collect personal information in the following ways:

• Contact enquiries: When you submit our website contact form, we collect your name, email address, and telephone number if provided, along with the content of your message.
• Session bookings: When booking a workshop or programme, we collect name, contact details, and information about the materials to be brought or the scope of the project.
• Heritage Documentation programme: During home visits, we collect interview notes and photographs. We do not retain copies of your family's personal documents without your explicit written consent.
• Website analytics: We use analytics tools (subject to cookie consent) to understand how visitors use our site. This data is aggregated and does not identify individuals by default.
• Cookies: We use essential, analytics, and preference cookies. See our Cookie Policy for details.

Legal basis for processing: We process personal data on the basis of your consent (for enquiries submitted through our form), the performance of a contract (for session bookings), and our legitimate interests in operating our business and improving our services.

3. How We Use Your Information

• To respond to your enquiry and discuss which session is appropriate for your needs.
• To arrange, confirm, and carry out bookings for workshops and programmes.
• To produce and deliver the written outputs of the programme you have booked (inventory sheets, bound heritage records, reading cards).
• To send you a post-session feedback request. You may decline this by letting us know.
• To improve our website and services using aggregated analytics data.
• To comply with applicable Malaysian legal obligations.

We do not use your personal data for unsolicited marketing communications. If you would like to receive occasional updates from us, you may opt in at the point of enquiry.

4. Data Sharing and Third Parties

We do not sell personal data. We share data only in the following limited circumstances:

• Service providers: We use a small number of third-party tools to operate our website and manage communications (e.g., email service providers, website hosting). These providers act as data processors on our behalf and are bound by confidentiality obligations.
• Analytics: Aggregated, anonymised usage data may be processed by analytics providers (e.g., Google Analytics), subject to your cookie consent.
• Legal obligations: We may disclose information where required by Malaysian law or a lawful order from a competent authority.

5. How We Protect Your Data

• Our website uses HTTPS encryption for all data in transit.
• Access to personal data is restricted to staff members who need it to carry out their work.
• We review our data-handling procedures annually.
• In the event of a data breach that affects your rights, we will notify you and the relevant authorities in accordance with Malaysian PDPA requirements.

Retention: Contact enquiry data is held for 24 months from the date of the last communication. Programme booking records are held for five years for business administration purposes. Heritage Documentation programme interview notes and photographs are held for the duration of the programme and then deleted unless you have consented to retention for a longer period.

6. Cookies

We use essential cookies to operate our website and optional analytics and preference cookies subject to your consent. You can manage your cookie preferences at any time via our Cookie Policy page.

7. Your Rights

Under the Personal Data Protection Act 2010 (Malaysia), you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete personal data.
• Withdraw consent for processing based on consent, at any time.
• Request deletion of your data, subject to our legal retention obligations.
• Object to processing for direct marketing purposes.
• Lodge a complaint with the Department of Personal Data Protection Malaysia (PDPD) if you believe your data has been mishandled.

To exercise any of these rights, please contact us at [email protected]. We will respond within 21 days.

8. Links to Other Websites

Our website may contain links to external sites. We are not responsible for the privacy practices of those sites. Please review the privacy policy of any site you visit.

9. Children's Privacy

Our services are directed at adults aged 18 and over. We do not knowingly collect personal data from individuals under 18. If you believe a minor has submitted information to us, please contact us and we will delete it promptly.

10. Changes to This Policy

We may update this policy from time to time. When we do, we will update the date at the top of this page. For significant changes, we will notify active clients by email. Your continued use of our website following any update constitutes acceptance of the revised policy.

11. Contact for Privacy Matters