Privacy Policy

1. Personal Data We Collect

We collect personal data in the following ways:

Through our contact form and email enquiries:

• Full name
• Email address
• Phone number (if provided)
• Business name and role (if provided in the message)
• Content of your message or enquiry

Through website usage (automatically collected):

• Browser type and device information
• Pages visited and time spent
• Referring URL
• Cookie preferences you have set

During advisory engagements:

• Contact details of client representatives
• Business operational information provided during scoping and delivery
• Staff information where relevant to a service quality review or observation process (handled under a separate confidentiality agreement)

Legal basis: We process personal data on the basis of your consent (website enquiries), contract performance (advisory engagement), and our legitimate interest in operating and improving our services.

Retention: Enquiry data is retained for up to 24 months after initial contact. Client engagement data is retained for 36 months from engagement close unless a shorter period is agreed. Website analytics data is retained in aggregate form.

2. How We Use Your Data

• To respond to your enquiry and discuss whether an engagement would be appropriate
• To deliver and manage the advisory services you have engaged us for
• To send administrative communications relating to your engagement (scheduling, documents, invoicing)
• To understand how our website is used and improve it (analytics only, using aggregated data)
• To comply with legal obligations applicable in Malaysia

We do not send marketing emails without your explicit consent. We do not sell, rent, or share your personal data with third parties for their own marketing purposes.

Third-party services: We may use Google Analytics for website usage data (collected in aggregate), and standard email and scheduling tools for client communication. These services process data in accordance with their own privacy policies.

3. How We Protect Your Data

• Our website uses HTTPS encryption for all data transmissions
• Client materials are stored in access-controlled environments with limited internal access
• Advisory deliverables are transferred to clients via secure channels
• In the event of a data breach affecting your personal information, we will notify affected individuals and the relevant authority in accordance with the PDPA 2010
• We review our data handling practices periodically

4. Cookies

We use cookies to understand how our website is used and to remember your preferences. When you first visit our site, you are asked whether you consent to optional cookies. Essential cookies are required for the site to function and cannot be disabled.

For full details on the cookies we use and how to manage your preferences, please see our Cookie Policy.

5. Your Rights Under the PDPA 2010

Under Malaysia's Personal Data Protection Act 2010, you have the following rights in relation to your personal data held by Cobalt Mynah:

• Right of access: You may request a copy of the personal data we hold about you.
• Right of correction: You may ask us to correct inaccurate or incomplete personal data.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw it at any time. This does not affect processing carried out before withdrawal.
• Right to prevent processing for direct marketing: You may ask us to stop using your data for direct marketing at any time.
• Right to lodge a complaint: You may lodge a complaint with the Department of Personal Data Protection (PDPD) Malaysia if you believe we have not handled your data appropriately.

To exercise any of these rights, contact us at [email protected]. We will respond within 21 days.

6. Third-Party Links

Our website may contain links to external sites or resources. We are not responsible for the privacy practices of those sites. We encourage you to read their privacy policies before providing any personal information.

7. Children's Privacy

Our services are directed at businesses and business professionals. We do not knowingly collect personal data from individuals under the age of 18. If you believe we have received data from a minor, please contact us so we can remove it promptly.

8. Changes to This Policy

We may update this Privacy Policy from time to time. Where changes are material, we will update the "Last Updated" date at the top of this page. We encourage you to review this page periodically. Continued use of our website or services following an update constitutes acceptance of the revised policy.