1. Who We Are (Data Controller)
The data controller for your personal information is:
As a small consultancy, we do not have a formally appointed Data Protection Officer, but the person responsible for data protection enquiries can be reached at the email address above.
2. What Personal Data We Collect
Information you provide directly
- Contact details — your name, email address, and phone number when you complete our enquiry form.
- Message content — the text of any message you send us through the contact form.
- Business information — the name and nature of your business if you share it voluntarily during an enquiry.
Information collected automatically
- Usage data — pages visited, time spent, and links clicked, collected through analytics cookies (only if you consent).
- Technical data — your IP address, browser type, and device type, retained in server logs for up to 90 days.
- Cookie data — see Section 6 and our Cookie Policy for full details.
What we do not collect
We do not collect payment card details, government identification numbers, sensitive personal data (as defined under the PDPA), or any data from persons under the age of 18.
3. Legal Basis for Processing
Under the Personal Data Protection Act 2010, we process your data on the following grounds:
- Your consent — when you submit the contact form, you agree to us using your details to respond to your enquiry. You may withdraw consent at any time by writing to us.
- Legitimate interest — to maintain server security and monitor for abuse, in a manner that does not override your rights.
- Contractual necessity — when you become a client, we process data necessary to deliver the agreed services.
4. How We Use Your Personal Data
- To respond to your enquiry and discuss whether our services may be helpful to you.
- To schedule and conduct consultation sessions if you proceed.
- To send you service-related communications (session notes, summaries, follow-up reminders).
- To improve our website based on aggregated, anonymised usage data.
- To comply with any legal obligation or lawful request from Malaysian authorities.
We do not use your personal data for automated decision-making or profiling.
Marketing communications
We will not send you promotional messages unless you explicitly ask to be kept informed of updates. You may unsubscribe from any such communications at any time by replying to the message or writing to us directly.
5. Sharing Your Data with Third Parties
We do not sell, rent, or trade your personal data. We share it only in the following limited circumstances:
- Service providers — we use Google Analytics (analytics cookies, only with your consent) and a Malaysian web hosting provider. Both are bound by data processing agreements.
- Legal obligations — we may disclose data if required by Malaysian law, a court order, or a government authority acting within its lawful powers.
- Business transfer — if Bestari were ever acquired or merged, we would notify you and you would have the opportunity to request deletion before any transfer.
No personal data is transferred outside Malaysia except where it is stored with cloud service providers whose data centres may be located in other countries. Where such transfers occur, we rely on standard contractual clauses or equivalent safeguards.
6. Cookies and Tracking Technologies
Our website uses cookies to help it function correctly and, with your consent, to understand how visitors use it. We use four categories:
- Essential cookies — required for basic site operation. These cannot be disabled.
- Analytics cookies — used to count page visits and understand navigation patterns (Google Analytics). Only placed with your consent.
- Marketing cookies — used to measure the reach of any online advertising we may run. Only placed with your consent.
- Preference cookies — used to remember your cookie choices. Only placed after you interact with the cookie notice.
Full details, including how to change your preferences at any time, are in our Cookie Policy.
7. How Long We Keep Your Data
- Enquiry messages — retained for 12 months after the last communication, then deleted.
- Client records — retained for 7 years after the end of the engagement, as required by Malaysian accounting and tax regulations, then securely deleted.
- Server logs — automatically deleted after 90 days.
- Analytics data — retained for 14 months in Google Analytics, after which it is anonymised and aggregated.
8. How We Protect Your Data
- Our website is served over HTTPS with TLS encryption.
- Access to client records is restricted to the members of the Bestari team directly involved in your engagement.
- Our hosting provider operates secure, access-controlled data centres.
- We review our security practices periodically.
No method of transmission over the internet is entirely without risk. In the unlikely event of a data breach that is likely to affect your rights or freedoms, we will notify the relevant Malaysian authority and, where required, inform you directly without undue delay.
9. Your Rights
Under the Personal Data Protection Act 2010, you have the following rights regarding the personal data we hold about you:
- Right of access — you may request a copy of the personal data we hold about you.
- Right of correction — you may ask us to correct inaccurate or incomplete data.
- Right to withdraw consent — where we process data on the basis of your consent, you may withdraw it at any time; this does not affect the lawfulness of processing before withdrawal.
- Right to cease processing — you may ask us to stop using your data for direct marketing purposes at any time.
- Right to erasure — you may request deletion of your data where there is no longer a lawful basis for us to hold it.
To exercise any of these rights, write to us at privacy@{{DOMAIN}}. We will respond within 21 days. We may ask you to verify your identity before acting on a request.
If you are not satisfied with how we handle your data or respond to a request, you may contact the Department of Personal Data Protection Malaysia (JPDP) at pdp.gov.my.
10. Links to Other Websites
Our website may contain links to third-party websites for reference. We are not responsible for the privacy practices of those sites and encourage you to read their privacy policies before sharing any personal information with them.
11. Children's Privacy
Our services are intended for business owners and are not directed at persons under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has submitted information to us, please contact us and we will delete it promptly.
12. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal obligations. When we make material changes, we will post the updated policy on this page with a revised "Last Updated" date. We encourage you to review this page periodically. Continued use of our website after any changes constitutes acceptance of the updated policy.
13. Contact Us
If you have questions, concerns, or requests relating to your personal data, please reach us through any of the following: