Privacy Policy

1. Introduction

Kapok Compass ("we", "us", "our") operates a citizen assistance centre at Level 25, Menara Takaful Malaysia, No. 4, Jalan Sultan Sulaiman, 50000 Kuala Lumpur, Malaysia. This Privacy Policy explains how we collect, use, store and protect personal information provided to us through our website at https://kapokucompas.sbs and through our in-person service sessions.

This policy is governed by the Personal Data Protection Act 2010 (PDPA) of Malaysia. By using our website or engaging our services, you confirm that you have read and understood this policy.

Questions about this policy may be directed to [email protected].

2. What Personal Data We Collect

We collect personal data only for the purposes of providing our services and maintaining contact with clients. The data we may collect includes:

• ◆Contact details: Name, email address, telephone number
• ◆Enquiry content: The message or question you submit via our contact form
• ◆Session notes: Notes taken during or in preparation for your service session (held only as long as the session is active unless you request otherwise)
• ◆Website usage data: Pages visited, time spent, referring pages — collected through analytics cookies if consent is given

We do not collect sensitive personal data (financial records, identification document numbers, health information) through our website. Any such data discussed during a session is handled solely within the session context and is not stored by us.

Legal Basis for Processing

We process your personal data on the following legal bases under the PDPA 2010:

• ◆Your consent — provided when you submit our contact form or accept cookies
• ◆Contractual necessity — to deliver the session or service you have booked
• ◆Legitimate interest — to respond to enquiries and improve our services

Data Retention

Contact form submissions and email correspondence are retained for up to 24 months from the date of last contact. Session notes are deleted within 30 days of the final session unless you request otherwise in writing. Website analytics data is retained for 14 months.

3. How We Use Your Data

Personal data collected is used for the following purposes:

• ◆Responding to enquiries and booking requests
• ◆Delivering and following up on booked services
• ◆Sending service-related communications (confirmations, reminders, session notes)
• ◆Understanding how visitors use our website so we can improve it
• ◆Complying with legal obligations

We do not use your personal data for direct marketing without your explicit consent. We do not sell, rent or trade your personal data to third parties.

Third-Party Service Providers

We may share limited data with service providers that support our operations, including email delivery services and website analytics providers. These parties are contractually bound to handle your data securely and only for the purposes we specify. We do not share data with advertising networks.

4. How We Protect Your Data

• ◆Our website uses HTTPS encryption for all data transmitted between your browser and our server
• ◆Access to stored personal data is limited to staff members who need it to deliver services
• ◆Paper session notes are stored in locked cabinets at our office and disposed of securely
• ◆We conduct periodic internal reviews of our data handling practices
• ◆In the event of a data breach that is likely to affect your rights, we will notify you and, where required, the relevant authority as promptly as possible

5. Cookies

Our website uses cookies to function correctly and, with your consent, to understand how it is used. Essential cookies are placed automatically; analytics and preference cookies are placed only if you accept them via the cookie notice on our homepage.

For full details of the cookies we use and how to manage them, please see our Cookie Policy.

6. Your Rights

Under Malaysia's Personal Data Protection Act 2010, you have the following rights with respect to your personal data that we hold:

• ◆Right to access: You may request a copy of the personal data we hold about you
• ◆Right to correction: You may request correction of inaccurate or incomplete data
• ◆Right to withdraw consent: You may withdraw consent for processing at any time, where processing is based on consent
• ◆Right to limit processing: You may request that we limit how we use your data in certain circumstances
• ◆Right to erasure: You may request deletion of your data, subject to our legal retention obligations

To exercise any of these rights, email us at [email protected]. We will respond within 21 days. If you have a concern about how we handle your data that we do not resolve to your satisfaction, you may raise a complaint with the Personal Data Protection Department (JPDP) of Malaysia.

7. Third-Party Links

Our website may contain links to external websites — government portals, utility providers, or other resources relevant to our services. We are not responsible for the privacy practices of those sites. We recommend reading the privacy policy of any external site you visit.

8. Children's Privacy

Our services are intended for individuals aged 18 and above. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided personal data to us, please contact us at [email protected] and we will delete it promptly.

9. Updates to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last Updated" date at the top of this page. For significant changes, we will display a notice on our homepage for a period of at least 30 days. Continued use of our website or services after a policy update constitutes acceptance of the revised terms.

10. Contact for Privacy Matters