Privacy Policy

1. Introduction

Bramblewick ("we", "us", "our") is an advisory practice based in Kuala Lumpur, Malaysia. We are committed to handling personal information responsibly and in accordance with the Personal Data Protection Act 2010 (PDPA) of Malaysia.

This policy explains what personal data we collect, why we collect it, how we use it, and your rights in relation to it. It applies to information collected through our website, enquiry forms, and in connection with our advisory services.

Questions about this policy should be directed to: [email protected]

2. Personal Data We Collect

We collect personal data in the following ways:

2.1 Information you provide to us

• Name and job title or role
• Email address
• Phone number (optional)
• Organisation name and description
• Any other information you include in enquiry messages or during engagements

2.2 Automatically collected information

• IP address and browser type (via analytics tools, if enabled)
• Pages visited and time on site
• Cookie preferences (stored locally in your browser)

2.3 Legal basis for processing

We process your personal data on the following legal bases under the PDPA 2010:

• Consent — where you have provided it (e.g. submitting an enquiry form)
• Legitimate interest — to respond to enquiries and manage existing advisory engagements
• Contractual necessity — where processing is needed to deliver a service you have engaged us for

2.4 Retention

Enquiry data is retained for 12 months. Data related to completed engagements is retained for 3 years for administrative and legal purposes, then securely deleted.

3. How We Use Your Data

• To respond to your enquiry and determine whether our services are a good fit
• To deliver advisory services you have engaged us for
• To communicate about the status of an engagement
• To send occasional relevant updates, only where you have opted in
• To improve our website based on aggregated usage data
• To comply with legal obligations

We do not sell, rent, or trade personal data with third parties. We do not use personal data for advertising or profiling purposes.

3.1 Third-party services

We may use the following third-party services that process data on our behalf: website analytics (e.g. Google Analytics, subject to cookie consent), and email communication tools. These processors are contractually bound to handle data appropriately and may not use it for their own purposes.

4. How We Protect Your Data

• Our website uses HTTPS encryption for all data transmission
• Access to personal data is restricted to team members who need it
• Electronic records are stored on password-protected, access-controlled systems
• In the event of a data breach that may affect your rights, we will notify affected individuals within 72 hours of becoming aware, in accordance with applicable requirements

5. Cookies

We use cookies to understand how our site is used and to remember your preferences. You can accept or decline non-essential cookies through the cookie banner when you first visit the site, and adjust preferences at any time via our Cookie Policy page.

Essential cookies are always active as they are required for the site to function. Analytics and marketing cookies are only set with your consent.

6. Your Rights

Under the Personal Data Protection Act 2010 (Malaysia), you have the right to:

• Access — request a copy of the personal data we hold about you
• Correction — request that inaccurate or incomplete data be corrected
• Withdraw consent — where processing is based on consent, withdraw it at any time
• Object to processing — object to use of your data for direct marketing
• Erasure — request deletion of data we no longer have a legal basis to hold

To exercise any of these rights, contact us at [email protected]. We will respond within 21 days. You also have the right to lodge a complaint with the Department of Personal Data Protection Malaysia (JPDP) if you believe your rights have been infringed.

7. External Links

Our website may contain links to external sites. We are not responsible for the privacy practices of those sites and recommend reviewing their privacy policies before providing any personal information.

8. Children's Privacy

Our services are intended for organisations and individuals aged 18 and over. We do not knowingly collect personal data from individuals under 18. If we become aware that we have done so, we will delete that data promptly.

9. Policy Changes

We may update this policy from time to time. Material changes will be communicated by updating the "Last updated" date at the top of this page. We encourage you to review this policy periodically. Continued use of our website or services after changes are published constitutes acceptance of the updated policy.

10. Contact

Data Controller: Bramblewick

Address: 2nd Floor, Wisma Central, Jalan Ampang, 50450 Kuala Lumpur, Malaysia

Email: [email protected]