Privacy Policy

1. Introduction

Warisan Studio takes the handling of personal data seriously. This policy explains what information we collect from people who contact us or use our services, how we use it, and what rights you have in relation to it.

This policy applies to personal data collected through our website, through email correspondence, and through the delivery of our services — record digitisation, booking enquiry desk setup, and staff training sessions.

Our data handling practices are governed by the Personal Data Protection Act 2010 (PDPA) of Malaysia. If you have questions about this policy, write to us at [email protected].

2. Data We Collect and How

From the contact form and direct correspondence:

• Name and email address (required for us to respond)
• Phone number (optional, if provided)
• The content of your message

During service delivery:

• For record digitisation: document metadata only (dates, party names, document types as they appear on the documents you submit). We do not retain copies of your physical documents.
• For booking desk setup: your business's availability information, seasonal calendar, pricing, and the questions and answers you provide. We do not collect your end customers' personal data unless you explicitly provide it for a specific purpose.
• For staff sessions: we may see examples of your customer communications if you provide them as training materials. These are not retained after the session.

From website cookies and analytics: Basic usage data (page visits, device type) via cookies. See our Cookie Policy for details.

Legal basis for processing: Consent (for website contact forms and cookies), contract performance (for service delivery), and legitimate interest (for business correspondence and operational records).

Data retention: Enquiry correspondence is retained for 12 months. Engagement scope notes and delivery records are retained for 7 years for legal and audit purposes. Cookie preferences are stored in your browser until cleared.

3. How We Use Your Data

• To respond to your enquiries and discuss your service needs
• To deliver the service you have engaged us for
• To issue invoices and maintain engagement records
• To communicate updates relevant to an active engagement
• To comply with legal obligations under Malaysian law

We do not use your personal data for marketing communications without your express consent. We do not sell, rent, or trade personal data to third parties.

Third parties we use: We may use third-party AI tools and platforms in the course of service delivery. Before each engagement begins, we disclose which tools are involved. These tools have their own data handling policies, which we review before selecting them. Where a tool is not appropriate for the type of information involved, we use an alternative or decline the work.

4. Data Protection Measures

• Correspondence and engagement records are stored on password-protected systems with access restricted to team members involved in the relevant engagement.
• Physical documents received for digitisation are handled only on our premises and returned to you after the engagement is completed.
• We review the data policies of any third-party tool before using it for client work.
• In the event of a data breach affecting your personal information, we will notify you within a reasonable timeframe and take steps to contain the incident.

5. Cookies

Our website uses cookies for basic functionality and to understand how visitors use the site. You can manage your cookie preferences at any time. For a full explanation of the cookies we use and how to control them, see our Cookie Policy.

6. Your Rights Under PDPA 2010

Under Malaysia's Personal Data Protection Act 2010, you have the right to:

• Access — request a copy of the personal data we hold about you
• Correction — request that we correct inaccurate or incomplete data
• Withdrawal of consent — withdraw consent for processing where consent was the legal basis
• Objection — object to processing for direct marketing purposes
• Inquiry — ask questions about how your data is being used

To exercise any of these rights, write to us at [email protected]. We will respond within 21 days.

If you believe your rights have not been respected, you may contact the Personal Data Protection Department (PDPD) Malaysia at www.pdp.gov.my.

7. Third-Party Links

Our website may contain links to external sites. We are not responsible for the privacy practices of those sites and encourage you to read their policies before providing any personal information.

8. Children's Privacy

Our services are directed at businesses and are not intended for individuals under 18 years of age. We do not knowingly collect personal data from minors. If you believe we have received data from a minor in error, please contact us so we can remove it.

9. Changes to This Policy

We may update this policy from time to time. Where changes are material, we will note the revised effective date at the top of this page. Continued use of our website or services after a policy change constitutes acceptance of the updated terms.

10. Contact for Data Inquiries

Data Controller: Warisan Studio

47 Jalan Pryer, 90000 Sandakan, Sabah, Malaysia

Email: [email protected]

Phone: +60 89 217 463

We respond to privacy inquiries within 21 calendar days.