Privacy Policy

1. Data Controller

Kasturi ("we", "us", "our") is the data controller for personal information collected through this website and through our consulting engagements. Our principal office is located at No. 12, Jalan Kia Peng, 50450 Kuala Lumpur, Malaysia. For privacy-related enquiries, contact us at [email protected].

2. What Data We Collect

We collect the following categories of personal data:

• Contact information: name, email address, phone number
• Business information: company name, industry, business stage (shared voluntarily during consultations)
• Communication records: emails, session notes, and correspondence related to your engagement
• Website usage data: pages visited, browser type, device type, IP address (collected via analytics cookies where consent is given)

We do not collect sensitive personal data (such as national identity numbers, financial account details, or health information) through this website.

3. How We Collect Data

• Contact form submissions on this website
• Email correspondence initiated by you
• Phone enquiries and consultation sessions
• Cookies and analytics tools (where you have given consent)

4. Legal Basis for Processing

We process your personal data on the following legal bases:

• Consent: where you have explicitly agreed to receive communications or to the use of optional cookies
• Contractual necessity: to carry out a consulting engagement you have engaged us for
• Legitimate interests: to respond to enquiries, manage our business records, and maintain the security of our systems
• Legal obligation: to comply with applicable Malaysian law

5. How We Use Your Data

• To respond to enquiries submitted through our contact form or by phone
• To carry out and document consulting engagements
• To send engagement-related documents and session notes
• To send service updates or policy changes (where you have given consent)
• To improve our website and understand how it is used (analytics, where consent applies)

We do not use your data for automated decision-making or profiling. We do not sell your personal data to third parties.

6. Data Sharing

We do not share your personal data with third parties except in the following limited circumstances:

• Service providers: third-party tools used to operate our website (hosting, email delivery) who are bound by data processing agreements
• Legal requirements: where disclosure is required by Malaysian law or a court order
• With your consent: where you have specifically agreed to a disclosure

7. Data Retention

We retain your personal data for the following periods:

• Enquiry data (no engagement follows): 12 months from the date of last contact
• Engagement records: 7 years from the end of the engagement, in line with standard Malaysian business record-keeping requirements
• Analytics data: up to 26 months (where analytics cookies are enabled)

After these periods, data is securely deleted or anonymised.

8. Cookies

This website uses cookies to function correctly and, where you consent, to help us understand how visitors use the site. For full details on which cookies we use and how to manage them, please read our Cookie Policy.

9. Data Security

We take reasonable technical and organisational measures to protect your personal data from unauthorised access, loss, or disclosure. These include:

• HTTPS encryption for all web communications
• Password-protected access to client records
• Restricted access — only staff involved in your engagement access your data
• Regular review of our data handling practices

In the event of a data breach that is likely to result in risk to your rights, we will notify you and the relevant authority in accordance with our legal obligations under the PDPA.

10. Your Rights Under the PDPA (Malaysia)

Under the Personal Data Protection Act 2010, you have the following rights:

• Right of access: to request a copy of the personal data we hold about you
• Right of correction: to request correction of inaccurate or incomplete data
• Right to withdraw consent: to withdraw consent to processing at any time (this does not affect lawfulness of processing prior to withdrawal)
• Right to limit processing: to request that we restrict how we use your data in certain circumstances

To exercise any of these rights, please email [email protected]. We will respond within 21 days.

11. Third-Party Links

This website may contain links to external websites. We are not responsible for the privacy practices of those sites and encourage you to read their privacy policies before providing any personal data.

12. Children's Privacy

Our services are intended for business owners and adults aged 18 and above. We do not knowingly collect personal data from minors. If we become aware that we have done so, we will delete it promptly.

13. Changes to This Policy

We may update this policy from time to time. When we do, we will revise the "Last updated" date above. For significant changes, we will notify you by email if you are an active client. Continued use of our website or services after a policy update constitutes acceptance of the revised terms.

14. Contact for Privacy Enquiries

For any questions about this policy or about how we handle your personal data, please contact:

Kasturi
No. 12, Jalan Kia Peng, 50450 Kuala Lumpur, Malaysia
Email: [email protected]
Phone: +60 3-6203 8174