Privacy Policy

1. Introduction

Permata ("we", "us", "our") is a business consulting practice registered and operating in Melaka, Malaysia. We are committed to handling the personal data of our clients, prospective clients and website visitors with care, transparency and respect for applicable Malaysian data protection law — in particular, the Personal Data Protection Act 2010 (PDPA).

This Privacy Policy explains what personal data we collect, why we collect it, how we use it and what rights you have regarding it. If you have questions, please contact us at [email protected].

2. Data We Collect

We collect personal data in the following circumstances:

• Contact enquiries: When you use the contact form on our website, we collect your name, email address and, if provided, your phone number and message content.
• Engagement intake: When you begin a consulting engagement with Permata, we collect additional information relevant to your business — financial data, operational details and other information you share in sessions.
• Website usage: We may collect anonymised data about how you use our website through analytics cookies, where you have consented to their use.

Legal basis for processing

We process personal data on the following bases under the PDPA:

• Consent: for marketing communications and analytics cookies
• Contractual necessity: to deliver consulting services you have engaged us for
• Legitimate interests: to respond to enquiries and maintain records of our advisory work

Retention periods

Contact enquiry data is retained for 12 months. Client engagement data is retained for 7 years following the conclusion of an engagement, in accordance with standard Malaysian commercial practice. After these periods, data is securely deleted or anonymised.

3. How We Use Your Data

• To respond to enquiries and determine whether our services are appropriate for your situation
• To deliver consulting sessions and produce agreed written outputs
• To maintain records of our advisory work and agreed commitments
• To send occasional follow-up correspondence related to your engagement (not marketing)
• To improve our website through anonymised analytics (where consent has been given)
• To comply with applicable Malaysian law and regulatory requirements

We do not sell, rent or trade your personal data to third parties. We do not use your data for automated decision-making or profiling.

4. Data Sharing

We share personal data only in the following limited circumstances:

• Service providers: We use a small number of technology providers (email hosting, website hosting) who may process data on our behalf under confidentiality agreements.
• Legal obligations: We may disclose data where required by Malaysian law or by a court of competent jurisdiction.
• In no other circumstances do we share your personal data.

5. Data Protection Measures

• Data transmitted via our website is protected by TLS encryption (HTTPS)
• Access to client data is restricted to advisors directly involved in your engagement
• Client session notes and documents are stored in password-protected environments
• Physical documents containing personal data are kept in secured, locked storage
• In the event of a data breach affecting your personal data, we will notify you within a reasonable timeframe and take prompt remedial action

6. Cookies

Our website uses cookies. Essential cookies are necessary for the site to function and are always active. Optional cookies — including analytics cookies — are only set with your consent, which you may provide or withdraw via the cookie banner on our homepage.

For full details of the cookies we use, please refer to our Cookie Policy.

7. Your Rights

Under the PDPA and applicable Malaysian data protection law, you have the following rights with respect to your personal data:

• Right of access: to request a copy of the personal data we hold about you
• Right of correction: to request correction of inaccurate or incomplete data
• Right to withdraw consent: where processing is based on your consent, to withdraw it at any time
• Right to object: to object to processing based on our legitimate interests
• Right to lodge a complaint: with the Department of Personal Data Protection Malaysia (JPDP), which oversees PDPA compliance

To exercise any of these rights, please contact us at [email protected]. We will respond within 21 days.

8. Third-Party Links

Our website may contain links to external websites. We are not responsible for the privacy practices of those sites and encourage you to review their privacy policies independently. This policy applies only to data collected through our own website and consulting services.

9. Children's Privacy

Our consulting services are intended for business owners and are not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected data from a person under 18, please contact us and we will take prompt steps to delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the Last Updated date at the top of this page. For significant changes, we will notify current clients by email. Continued use of our website or services after a change constitutes your acceptance of the revised policy.

11. Contact Us

For any privacy-related enquiries or to exercise your rights, please contact: