Privacy Policy

1. Introduction

Serambi Studio is committed to handling your personal data with care. This policy explains what data we collect, why we collect it, how we use it, and what your rights are under Malaysia's Personal Data Protection Act 2010 (PDPA). We operate under the principles of the PDPA: consent, notice, disclosure, security, retention, data integrity, and access.

If you have questions about how we handle your data, please contact us at [email protected].

2. Data We Collect

We collect personal data in the following circumstances:

• Contact form submissions: name, email address, phone number (optional), and message content
• Service engagements: business name, contact person details, and document samples required to carry out the agreed service scope
• Website analytics: anonymised usage data such as pages visited, session duration, and referral source (collected via analytics cookies, where consented)
• Communications: emails and messages exchanged during enquiries or active engagements

We do not collect sensitive personal data (as defined under the PDPA) unless specifically required to carry out a service and with your explicit consent.

3. How We Use Your Data

Personal data is used for the following purposes:

• Responding to enquiries submitted through our contact form or by email
• Delivering services within the scope of an agreed engagement
• Sending information directly relevant to an active or upcoming engagement
• Improving the quality of our website and services using anonymised analytics data
• Complying with legal obligations under Malaysian law

We do not use your personal data for marketing purposes without your explicit consent. We do not share or sell your data to third parties for advertising.

4. Legal Basis for Processing

Under the PDPA, we process personal data on the following bases:

• Consent: for optional cookies and marketing communications
• Contract: for data required to deliver a service you have engaged us for
• Legitimate interest: for responding to enquiries and improving our services
• Legal obligation: where required by Malaysian law

5. Data Retention

We retain personal data only for as long as necessary for the purpose for which it was collected:

• Enquiry and contact form data: up to 12 months from last communication
• Engagement-related data (documents, correspondence): up to 24 months from engagement close, unless you request earlier deletion
• Analytics data: anonymised and retained for up to 26 months (Google Analytics standard)
• Financial records required for tax compliance: 7 years, as required under Malaysian law

Document samples provided for setup engagements are deleted within 30 days of handover, unless retention is explicitly agreed for support purposes.

6. Data Sharing

We do not sell or transfer your personal data to third parties for commercial purposes. We may share data with:

• Service providers who support our operations (e.g., cloud storage, email service) — under data processing agreements
• Analytics providers (e.g., Google Analytics) — using anonymised data only, where analytics cookies are consented to
• Accounting software providers as part of service engagements — under your authorisation and within your control
• Regulatory authorities — if required by law

7. Data Security

We apply reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. These include:

• HTTPS encryption for all data transmitted through our website
• Access controls limiting who within our team can access client data
• Secure deletion of document samples within 30 days of engagement handover
• No retention of accounting credentials — integrations use OAuth or token-based access where available

In the event of a data breach affecting your personal data, we will notify you and the Personal Data Protection Commissioner as required under the PDPA.

8. Cookies

Our website uses cookies. Essential cookies are required for the site to function and cannot be disabled. Optional analytics and preference cookies are only set if you consent via the cookie banner. You can manage your preferences at any time on our Cookie Policy page.

9. Your Rights Under the PDPA

As a data subject under the Malaysian PDPA, you have the following rights:

• Right to access: request a copy of the personal data we hold about you
• Right to correction: request that inaccurate or incomplete data be corrected
• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time
• Right to limit processing: request that we stop processing your data in certain circumstances

To exercise any of these rights, email us at [email protected]. We will respond within 21 days as required under the PDPA. There is no charge for reasonable access requests.

If you believe we have not handled your data properly, you have the right to lodge a complaint with the Department of Personal Data Protection Malaysia (JPDP).

10. Third-Party Links

Our website may include links to external websites. We are not responsible for the privacy practices of those sites. We recommend reviewing their privacy policies before submitting any personal information.

11. Children's Privacy

Our services are intended for business operators and their staff. We do not knowingly collect data from individuals under 18 years of age. If you believe a minor has submitted data through our website, please contact us so we can delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be noted at the top of this page with a revised effective date. Continued use of our website after an update constitutes acceptance of the revised policy.

13. Contact

For any data protection enquiries:

• Email: [email protected]
• Address: Serambi Studio, 41 Jalan Dhoby, 80000 Johor Bahru, Johor, Malaysia
• Phone: +60 7 224 8163