Privacy Policy

1. Data We Collect

We collect personal data in the following circumstances:

• Enquiry form submissions: name, email address, telephone number (optional) and message content.
• Programme bookings: name, email address, telephone number, billing address and payment information (processed by our payment provider; we do not store card details).
• Website analytics: anonymised usage data including pages visited, time on page, browser type and approximate location (country level). This is collected via analytics cookies if you have consented.
• Cookie data: preferences stored locally in your browser via localStorage. See our Cookie Policy.

Legal basis for processing: We process data on the basis of (a) your consent, where applicable; (b) the performance of a contract — your programme booking; and (c) our legitimate interest in responding to enquiries and improving our services.

Retention: Enquiry data is retained for twelve months. Booking records are retained for seven years for accounting purposes. Analytics data is retained for twenty-six months before deletion.

2. How We Use Your Data

• To respond to your enquiry via email or telephone.
• To confirm and administer your programme booking.
• To send programme-related communications (session reminders, materials).
• To improve our website and programmes using anonymised analytics.
• To comply with legal and regulatory obligations under Malaysian law.

We do not use your data for automated decision-making. We do not sell your personal data to third parties. We do not send marketing communications without your explicit opt-in.

3. Data Sharing

We share personal data only in the following circumstances:

• Payment processors: billing data is passed to our payment service provider to process transactions. They are contractually bound to handle data securely.
• Analytics providers: anonymised website usage data is shared with our analytics provider if you have consented to analytics cookies.
• Legal requirements: we may disclose data where required by Malaysian law or court order.
• Professional referrals: if you have explicitly requested a referral to an outside professional, we may share your name and contact details with that professional for the sole purpose of the referral.

4. Data Protection Measures

• This website is served over HTTPS (TLS encryption).
• Enquiry data is stored in access-controlled systems accessible only to Heirloom Atlas staff.
• Payment data is handled by our payment provider under PCI-DSS standards; we do not store card numbers.
• Staff access to personal data is limited to those who need it for their role.
• In the event of a data breach that may affect your rights and freedoms, we will notify you and the relevant authority within seventy-two hours of becoming aware of it.

5. Cookies

We use cookies and localStorage to store your consent preferences, enable basic website functionality and, where you have consented, collect anonymised usage analytics. You can manage your cookie preferences at any time via our Cookie Policy page.

6. Your Rights Under the PDPA

Under Malaysia's Personal Data Protection Act 2010 and general privacy principles, you have the following rights:

• Right of access: to request a copy of the personal data we hold about you.
• Right of correction: to request correction of inaccurate or incomplete data.
• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time.
• Right to object: to processing for direct marketing purposes.
• Right to limit processing: to request that we restrict use of your data in certain circumstances.

To exercise any of these rights, write to us at [email protected]. We will respond within fourteen working days. You may also lodge a complaint with the Personal Data Protection Department of Malaysia (JPDP) at www.pdp.gov.my.

7. Third-Party Links

Our website may contain links to external websites — including referral professionals and resource organisations. We are not responsible for the privacy practices of third-party sites. We encourage you to review the privacy policy of any site you visit through a link from our pages.

8. Children's Privacy

Our programmes and website are intended for adults aged 18 and over. We do not knowingly collect personal data from persons under 18. If we become aware that data from a minor has been submitted, we will delete it promptly. If you believe a minor has submitted data to us, please notify us at [email protected].

9. Changes to This Policy

We may update this policy from time to time. Where changes are material, we will notify you by email (if you are a registered participant) or by a notice on this website. The date at the top of this page reflects the most recent revision. Continued use of the website after a revision constitutes acceptance of the updated policy.

10. Contact

For all privacy-related enquiries:

• Email: [email protected]
• Address: Heirloom Atlas, 54 Jalan Sultan Ismail, 50250 Kuala Lumpur, Malaysia
• Telephone: +60 3 2072 6431