Privacy Policy
1. Introduction
Hearthnest ("we", "us", "our") is committed to protecting the personal data of the people who engage with our programmes and our website. This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and the rights you have in relation to it.
This policy applies to all personal data collected through our website at hearthnestit.pro, through our enquiry and registration forms, and in the course of delivering our programmes at our Bangsar Baru premises.
We are the data controller for the personal data described in this policy. Our contact address is 22A Jalan Telawi, Bangsar Baru, 59100 Kuala Lumpur, Malaysia. For privacy-related questions, please write to [email protected].
This policy is governed by and prepared in reference to the Personal Data Protection Act 2010 (PDPA) of Malaysia.
2. What Personal Data We Collect
We collect personal data in the following circumstances:
2.1 Enquiries and Registrations
- Full name
- Email address
- Phone number (where provided)
- Programme or service enquired about
- Any additional information you include in your message
2.2 Programme Participation
- Attendance records
- Session notes (anonymised in group settings)
- Coaching session materials (where prepared by or for the participant)
2.3 Website Usage
- Cookie data (where consent is given — see Section 5)
- Analytics data such as page visits and session duration (anonymised)
3. Legal Basis for Processing
We process your personal data on the following grounds:
- Consent: Where you have submitted a form or enquiry, or accepted cookies on our site.
- Contractual necessity: To deliver the programme or service you have enrolled in.
- Legitimate interest: To manage our business operations, respond to communications, and improve our services.
- Legal obligation: Where required by applicable Malaysian law.
4. How We Use Your Personal Data
- To respond to enquiries submitted through our contact form
- To enrol participants in programmes and manage session logistics
- To send follow-up notes and written summaries related to coaching sessions
- To communicate programme updates and scheduling changes
- To improve our website and programmes through anonymised analytics
- To comply with applicable Malaysian legal requirements
We do not sell, rent, or share your personal data with third parties for marketing purposes. We do not receive commission from any external provider, and we have no data-sharing arrangements with financial services, insurance, or investment companies.
5. Cookies
Our website uses cookies to understand how visitors use the site. We use only essential cookies (required for the site to function) and, where consent is given, analytics cookies. We do not use advertising or tracking cookies.
You may manage your cookie preferences at any time via our Cookie Policy page.
6. Data Retention
We retain personal data for the following periods:
- Enquiry data (not converted to a programme): 12 months from the date of enquiry.
- Programme participant data: 3 years from the completion of the last programme session.
- Financial records (if applicable): 7 years in line with Malaysian tax requirements.
- Website analytics data: 26 months (anonymised).
After the relevant retention period, personal data is securely deleted or anonymised.
7. Data Security
We take reasonable technical and organisational measures to protect your personal data from loss, misuse, or unauthorised access. These include:
- Secure HTTPS connections for all web-based data transmission
- Access controls limiting who within our team can view personal data
- Physical security at our Bangsar Baru premises for any paper records
- Regular review of data handling practices
In the event of a personal data breach that is likely to affect your rights, we will notify you and the relevant authorities as required under Malaysian law.
8. Your Rights Under Malaysian PDPA
Under the Personal Data Protection Act 2010, you have the following rights in relation to your personal data held by us:
- Right of access: To request a copy of the personal data we hold about you.
- Right of correction: To request that inaccurate or incomplete data is corrected.
- Right to withdraw consent: To withdraw consent to processing at any time (this does not affect processing already carried out).
- Right to cease processing: To request that we stop processing your data for specific purposes.
To exercise any of these rights, please contact us at [email protected]. We will respond within 21 days of receiving your request.
If you are dissatisfied with our response, you may lodge a complaint with the Personal Data Protection Commissioner of Malaysia via the Ministry of Communications and Digital.
9. Third-Party Links
Our website may contain links to external publications or publicly available resources. These links are provided for reference only. We are not responsible for the privacy practices or content of third-party websites. We recommend reading the privacy policy of any external site before submitting personal data to it.
10. Children's Privacy
Our programmes are designed for adults aged 18 and over. We do not knowingly collect personal data from minors. If we become aware that personal data has been provided by a person under 18 without parental consent, we will delete it promptly.
11. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. When we do, we will update the "Last updated" date at the top of this page. Significant changes will be communicated to programme participants directly by email where possible.
Continued use of our website or services after changes have been posted constitutes acceptance of the updated policy.
12. Contact
For any questions about this Privacy Policy or how we handle your personal data:
- Email: [email protected]
- Address: Hearthnest, 22A Jalan Telawi, Bangsar Baru, 59100 Kuala Lumpur, Malaysia
- Phone: +60 3-2287 4915