Privacy Policy

1. Data We Collect

We collect personal data in the following circumstances:

• Contact form submissions: name, email address, and optionally phone number and a message.
• Consulting engagements: business name, contact details, and financial or operational information shared during advisory sessions. This information is collected and used solely to deliver the agreed service.
• Website analytics: anonymised data about how visitors use the site (pages visited, session duration, device type) collected via cookies where consent is given.
• Communications: email correspondence and any attachments you send to us.

Legal basis: Processing of contact form and engagement data is based on your consent or the performance of a contract. Analytics are based on consent. Legitimate interest applies where we retain records for service continuity.

Retention: Contact enquiries are kept for up to 24 months. Engagement files are retained for five years following the close of the engagement, then securely deleted. Analytics data is retained for up to 26 months.

2. How We Use Your Data

• Service delivery: To respond to your enquiries, conduct consulting sessions, and produce the written outputs that form part of our service scope.
• Communication: To send session notes, direction papers, follow-up correspondence, and any administrative communications relating to an active or recent engagement.
• Website improvement: To understand how visitors use our site and make it more useful. This is done using anonymised analytics data only.
• Legal compliance: To meet obligations under Malaysian law, including the Personal Data Protection Act 2010 (PDPA).

We do not sell personal data. We do not share it with third parties for marketing purposes. Data is shared only where required to deliver the service (e.g. cloud storage providers operating under appropriate data agreements) or where required by law.

3. Data Protection Measures

• Data transmitted to our website is encrypted using TLS (HTTPS).
• Engagement files and notes are stored on access-controlled cloud infrastructure.
• Access to client data is restricted to the consulting team members working on that engagement.
• In the event of a data breach that poses a risk to individuals, we will notify affected parties promptly and in accordance with PDPA requirements.
• We review our data handling practices periodically and adjust them where gaps are identified.

4. Cookies

Our website uses cookies to function and, with your consent, to collect anonymised analytics data. Essential cookies (required for the site to work) are always active. Analytics and preference cookies are only set if you accept them via the cookie banner on our homepage.

For a full description of the cookies we use and controls to manage your preferences, see our Cookie Policy.

5. Your Rights

Under the Personal Data Protection Act 2010 (Malaysia) and, where applicable, other data protection legislation, you have the following rights:

• Access: Request a copy of the personal data we hold about you.
• Correction: Ask us to correct inaccurate or incomplete data.
• Erasure: Request deletion of your data where there is no longer a lawful basis for us to hold it.
• Objection: Object to processing based on legitimate interest.
• Portability: Receive a copy of data you have provided to us in a structured, machine-readable format.
• Withdraw consent: Where processing is based on consent, withdraw it at any time. This does not affect the lawfulness of processing before withdrawal.

To exercise any of these rights, write to [email protected]. We will respond within 21 days. If you believe your rights have not been respected, you may raise a complaint with the Department of Personal Data Protection Malaysia (JPDP).

6. Third-Party Links

Our website may include links to external sites. We are not responsible for the privacy practices of those sites and recommend reviewing their own policies before submitting personal data to them.

7. Children's Privacy

Our services are directed at business owners and professionals. We do not knowingly collect data from individuals under 18 years of age. If you believe a minor has submitted personal data to us, please contact us and we will delete it promptly.

8. Changes to This Policy

We may update this policy from time to time. The date at the top of this page reflects when it was last revised. Significant changes will be communicated via a notice on the website homepage. Continued use of our site after changes are posted constitutes acceptance of the revised policy.

9. Contact for Data Enquiries

For any questions or requests relating to this policy or the personal data we hold:

• Data Controller: Cempaka
• Address: Lebuh Pantai 27, 10300 George Town, Penang, Malaysia
• Email: [email protected]
• Phone: +60 4-263 9071