Privacy Policy

1. Scope of this Policy

This policy applies to all personal data collected through our website at https://hearthwa.biz, through our contact form, by email, by telephone and in the course of delivering our services to clients. It covers how we handle data for enquiry purposes and for active service engagements.

2. Data We Collect

We collect only the data necessary to respond to enquiries and to deliver the services requested.

• Contact data: name, email address, telephone number — provided when you submit an enquiry form or contact us directly.
• Service data: documents, correspondence and administrative materials provided by clients in the course of service delivery.
• Website usage data: anonymised analytics data about how visitors interact with the website (pages visited, session duration). This does not identify individual users.
• Cookie data: your cookie consent preference, stored locally in your browser. See our Cookie Policy for details.

3. Legal Basis for Processing

Under the PDPA 2010, we process personal data on the following bases:

• Consent: when you submit a contact form or communicate with us voluntarily.
• Contract performance: when data is required to deliver a service you have engaged us for.
• Legitimate interest: for general website analytics used to improve the site — conducted without identifying individual users.

4. How We Use Personal Data

• To respond to enquiries and assess service fit.
• To deliver the specific service you have engaged (briefing, preparation, or coordination).
• To manage appointment scheduling and correspondence within an active engagement.
• To maintain accurate records of the scope and delivery of each engagement.
• To meet legal or regulatory obligations applicable in Malaysia.

We do not use personal data for unsolicited marketing, profiling or any purpose unconnected to the service for which it was provided.

5. Data Retention

Contact enquiry data (name, email, message) is retained for up to 12 months from the date of enquiry or the end of the relevant engagement, whichever is later. Client documents and service materials are retained for the duration of the engagement plus 12 months, after which they are deleted or returned to the client as agreed. Anonymised analytics data does not have a fixed retention period as it does not contain personal identifiers.

6. Data Sharing

We do not sell, rent or share personal data with third parties for marketing purposes. Data is shared with third parties only in the following circumstances:

• With service providers who support our website hosting and email infrastructure, under data processing agreements requiring equivalent protection.
• Where required by Malaysian law or a lawful court order.
• With professionals the client has independently engaged, where the client has explicitly asked us to coordinate with them.

7. Data Security

We take reasonable technical and organisational measures to protect personal data from unauthorised access, loss or misuse. These include:

• Encrypted storage and transfer for digital files.
• Access controls limiting data access to team members directly involved in a service engagement.
• Secure disposal of physical documents when no longer needed.

If a data breach occurs that is likely to affect your rights, we will notify you and the relevant authority in accordance with our obligations under the PDPA 2010.

8. Cookies

We use cookies for essential website functionality and, with your consent, for anonymised usage analytics. Your cookie preferences are stored in your browser and can be changed at any time. See our Cookie Policy for a full breakdown of cookies used and how to manage them.

9. Your Rights Under Malaysian Law

Under the Personal Data Protection Act 2010, you have the right to:

• Request access to the personal data we hold about you.
• Request correction of inaccurate or incomplete personal data.
• Withdraw consent to processing at any time (where consent is the legal basis).
• Request that we cease processing your data in certain circumstances.
• Lodge a complaint with the Department of Personal Data Protection Malaysia (JPDP) if you believe your rights have been infringed.

To exercise any of these rights, contact us at [email protected]. We will respond within 21 days.

10. Third-Party Links

Our website may contain links to external sites, including official Malaysian government and public information resources. We are not responsible for the privacy practices of those sites. We encourage you to read their privacy policies before submitting personal data.

11. Children's Privacy

Our services are intended for adults aged 18 and above. We do not knowingly collect personal data from individuals under the age of 18. If you believe a minor has submitted personal data to us, please contact us at [email protected] and we will delete it promptly.

12. Policy Updates

We may update this policy from time to time to reflect changes in our practices or applicable law. Updates will be posted on this page with a revised "Last updated" date. Continued use of our services after a policy update constitutes acceptance of the revised terms.

13. Contact for Data-Related Enquiries

For any questions about this Privacy Policy or how we handle your personal data, please contact us: