Privacy Policy

1. What personal data we collect

We collect the following categories of personal data:

• Contact information: name, email address, phone number — collected via our website contact form or booking enquiry.
• Session intake information: information you share during programme intake conversations to help us understand your situation and scope the session appropriately.
• Communications: messages exchanged by email or our contact form.
• Website usage data: technical information collected via cookies — including browser type, pages visited and approximate location — where you have consented.

Legal basis for processing:

• Contract performance — to deliver the session or programme you have booked.
• Consent — for cookies and optional communications where we ask for your agreement.
• Legitimate interest — to respond to enquiries, maintain session records, and improve our service quality.

Retention periods: Contact and session records are retained for 24 months from the date of your last interaction, after which they are deleted or anonymised. Website usage data collected via analytics cookies is retained for 14 months.

2. How we use your data

We use the personal data we collect to:

• Respond to enquiries and confirm session bookings.
• Deliver sessions and maintain relevant notes during programme delivery.
• Send follow-up communications included in your programme package (for example, the follow-up email included in the Navigation Session).
• Send administrative communications about your session — scheduling, changes, or confirmations.
• Analyse website usage patterns to improve our website (where analytics cookies are consented to).
• Comply with our legal obligations under Malaysian law.

We do not use your data for direct marketing unless you have explicitly opted in to receive such communications. You may withdraw consent at any time by contacting us at [email protected].

Data sharing: We do not sell personal data to third parties. We may share data with the following parties in limited circumstances:

• IT service providers who host our website and email, subject to data processing agreements.
• Analytics providers (such as Google Analytics) where you have consented to analytics cookies.
• Legal or regulatory authorities if required by law.

3. How we protect your data

We implement reasonable technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure or destruction. These include:

• Encrypted transmission of data between your browser and our website (HTTPS).
• Access controls limiting who within Civic Loom can view personal data.
• Regular internal review of data-handling practices.
• Session notes stored in password-protected systems accessible only to the assigned support officer and management.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant parties as required by applicable law.

4. Cookies

We use cookies on our website. Essential cookies are necessary for the site to function and are always active. Optional cookies — including analytics and preference cookies — are used only with your consent, which you can give or withdraw via our cookie banner or the Cookie Policy page.

For full details about which cookies we use and how to manage them, please read our Cookie Policy.

5. Your rights

Under Malaysia's Personal Data Protection Act 2010 (PDPA), you have the following rights in relation to your personal data:

• Right of access: You may request a copy of the personal data we hold about you.
• Right of correction: You may request correction of inaccurate or incomplete data.
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
• Right to limit processing: You may request that we limit how we process your data in certain circumstances.

To exercise any of these rights, contact us in writing at [email protected]. We will respond within 21 days. We may need to verify your identity before processing the request.

If you believe your data has been mishandled, you may lodge a complaint with the Department of Personal Data Protection (JPDP) Malaysia: www.pdp.gov.my.

6. Third-party links

Our website may include links to external websites — government portals, community directories or other resources. Once you leave our site, this policy no longer applies. We are not responsible for the privacy practices of third-party websites and encourage you to review their policies before sharing any personal data.

7. Minors

Our website and services are intended for adults aged 18 and above. We do not knowingly collect personal data from persons under 18 without parental or guardian consent. If you believe we have inadvertently collected data from a minor, please contact us at [email protected] and we will delete it promptly.

8. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or in applicable law. The "Last Updated" date at the top of this page will be revised accordingly. Continued use of our website or services after an update constitutes acceptance of the revised policy. For material changes, we will make reasonable efforts to notify affected individuals.