Privacy Policy

1. Data we collect

When you interact with Quillstone, we may collect the following personal data:

• Contact information — your name, email address and phone number when submitted via our enquiry form or by direct email.
• Enquiry details — information you include in messages to us, such as descriptions of your business processes or operational questions.
• Technical data — IP address, browser type, pages visited and session duration collected automatically when you visit our website. This data does not identify you personally unless combined with other information.
• Cookie preferences — your responses to our cookie consent notice, stored in your browser's local storage.

2. How we use your data

We use personal data only for the purposes described below:

• To respond to enquiries and provide information about our services.
• To deliver consulting services under the terms agreed with you.
• To maintain records of correspondence and engagements for service continuity.
• To understand how visitors use our website and improve its usability, using anonymised analytics data only.
• To comply with legal obligations under Malaysian law.

We do not use your data for automated decision-making or profiling, and we do not sell or share personal data with third parties for marketing purposes.

3. Legal basis for processing

We process personal data on the following grounds under the Personal Data Protection Act 2010 (PDPA) of Malaysia:

• Consent — where you have voluntarily submitted information via our enquiry form or directly contacted us.
• Contract — where processing is necessary to deliver services you have engaged us for.
• Legitimate interest — to understand how our website is used and to improve it, in a way that does not override your rights.

4. Data retention

We retain personal data only as long as reasonably necessary for the purposes described in this policy. Enquiry records are kept for up to twenty-four months. Engagement records may be retained for up to seven years to comply with legal and accounting requirements. Technical analytics data is held for no longer than twelve months. You may request deletion of your data at any time — see Section 7 below.

5. Data protection measures

We take reasonable steps to protect the personal data we hold:

• Access to personal data is limited to team members who need it for their work.
• Our website uses HTTPS encryption for data transmitted online.
• Physical and digital records are stored securely with access controls.
• In the event of a data breach, we will notify affected individuals and relevant authorities as required by Malaysian law.

6. Cookies

Our website uses cookies to function and to gather basic analytics information. We ask for your preference when you first visit. Essential cookies are necessary for the site to work and cannot be declined. Analytics and marketing cookies are optional and only used if you consent. For full details, see our Cookie Policy.

7. Your rights

Under the PDPA and, where applicable, broader data protection principles, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Request deletion of your data, subject to any legal retention obligations.
• Withdraw consent for processing based on consent, at any time.
• Object to processing based on legitimate interest.

To exercise any of these rights, contact us at [email protected]. We will respond within thirty days.

8. Third-party links

Our website may contain links to external sites. We are not responsible for the privacy practices of those sites and recommend reviewing their individual policies. The embedded Google Maps element on our home page is subject to Google's privacy policy.

9. Children's data

Our services are directed at businesses and professionals. We do not knowingly collect personal data from individuals under the age of 18. If you believe we have received data from a minor, please contact us and we will delete it promptly.

10. Changes to this policy

We may update this policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. Continued use of our website after changes have been posted constitutes acceptance of the updated policy.

11. Contact for data enquiries