Privacy Policy

We collect personal data in the following ways:

Contact form submissions: When you submit an enquiry through our website, we collect your name, email address, and phone number (if provided), and any information you include in the message field.

Engagement process: During an advisory engagement, we may collect organizational information and documents provided by your institution, as well as notes from structured conversations with staff and stakeholders. This information is used solely to conduct the engagement.

Website analytics: We may collect non-personal browsing data through analytics cookies, including page visits, session duration, and device type. This data cannot identify you individually.

Retention periods: Contact form data is retained for up to 24 months. Engagement documents and notes are retained for 36 months following engagement completion, after which they are deleted or returned to the client upon request.

We use personal data for the following purposes:

• —To respond to enquiries submitted through our contact form
• —To conduct advisory engagements where a formal arrangement has been agreed
• —To communicate with clients about engagement progress and deliverables
• —To improve our website based on aggregate, anonymised analytics data
• —To comply with applicable legal obligations in Malaysia

We do not use personal data for marketing purposes without explicit consent. We do not sell personal data to third parties.

Legal basis: Processing is based on consent (where given), the performance of an engagement agreement, and legitimate business interests in responding to enquiries and improving our service.

We do not share personal data with third parties except in the following limited circumstances:

• —Service providers: We use a small number of third-party services to operate our website and communicate with clients (including hosting and email services). These providers process data only on our behalf and under confidentiality obligations.
• —Legal requirements: We may disclose data if required by Malaysian law, court order, or regulatory authority.

We never share client engagement information, findings, or documents with any third party without the explicit written permission of the client organization.

We take reasonable measures to protect personal data from unauthorized access, disclosure, or loss. These measures include:

• —Use of HTTPS encryption on our website
• —Password-protected storage for engagement documents
• —Access to personal data limited to Pelita Counsel advisors directly involved in an engagement
• —Secure deletion of data at the end of retention periods

In the event of a personal data breach that may affect your rights, we will notify affected individuals in accordance with our obligations under the PDPA 2010.

Under the Personal Data Protection Act 2010 (PDPA), you have the following rights in relation to personal data we hold about you:

• —Right of access: You may request a copy of personal data we hold about you.
• —Right of correction: You may request that inaccurate or incomplete data be corrected.
• —Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time. Withdrawal does not affect processing that occurred before the withdrawal.
• —Right to limit processing: You may request that we stop using your data for certain purposes.
• —Right to make a complaint: You may lodge a complaint with the Department of Personal Data Protection Malaysia (JPDP).

To exercise any of these rights, please contact us at [email protected]. We will respond within 21 days.

Data Controller: Pelita Counsel Sdn. Bhd.

Address: 16-3 Menara Hap Seng, Jalan P. Ramlee, 50250 Kuala Lumpur, Malaysia

Privacy enquiries: [email protected]

General enquiries: [email protected]

Phone: +60 3 2078 9436