Privacy Policy

Suria Stream ("we", "us", "our") is committed to handling personal data with care and transparency. This policy explains what personal data we collect, why we collect it, how we use it, and what rights you have in relation to it. It applies to visitors to our website and to individuals who engage with our services.

This policy is prepared in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA). If you have questions, contact us at [email protected].

1. Data We Collect

We collect personal data in the following ways:

• Contact form submissions: name, email address, phone number (optional), and any information you include in your message.
• Service engagements: business name, contact details, operational information shared during assessment or pilot work, and any documents provided for integration purposes.
• Website analytics: anonymised usage data such as pages visited, session duration, and browser type, collected via analytics cookies if you have consented.

We do not collect sensitive personal data (such as identification numbers, financial account information, or health data) through standard website interactions.

2. How We Use Personal Data

Personal data collected is used for the following purposes:

• To respond to enquiries submitted through our contact form.
• To carry out service engagements agreed with clients — including assessments, integrations, and review cycles.
• To communicate about ongoing or completed engagements.
• To understand how our website is used so we can improve it (analytics, only with consent).
• To meet legal obligations if required.

We do not use personal data for unsolicited marketing and do not sell personal data to third parties.

3. Legal Basis for Processing

Under Malaysia's PDPA, we process personal data on the following grounds:

• Consent: where you have submitted information voluntarily through our contact form or consented to analytics cookies.
• Contractual necessity: where processing is required to carry out services agreed with you.
• Legitimate interests: for website security and to respond to direct enquiries.

4. Data Retention

We retain personal data only for as long as necessary:

• Contact form enquiries: up to 12 months from the date of submission, unless an engagement follows.
• Engagement-related data: retained for the duration of the engagement and up to 24 months following its conclusion, then deleted or anonymised.
• Analytics data: retained in anonymised form for up to 14 months.

5. Data Protection Measures

We take reasonable steps to protect personal data from unauthorised access, loss, or disclosure:

• Client data shared during engagements is stored in encrypted form on local systems with restricted access.
• Confidentiality agreements are in place before any client data is reviewed.
• We limit access to personal data to staff who require it for the specific engagement.
• In the event of a data breach affecting your personal data, we will notify affected parties in line with PDPA requirements.

6. Cookies

Our website uses cookies. Essential cookies are necessary for the site to function. Optional analytics and preference cookies are only used with your consent, which you can manage at any time via the cookie banner or our Cookie Policy.

7. Sharing With Third Parties

We do not share personal data with third-party companies for marketing purposes. Data may be processed by the following categories of service provider:

• Website hosting providers (for site operation).
• Analytics providers (only with your cookie consent, and using anonymised data).

We do not transfer personal data outside Malaysia unless required by the engagement scope and agreed with you in writing.

8. Your Rights

Under Malaysia's PDPA, you have the following rights in relation to your personal data:

• Right to access: to request a copy of personal data we hold about you.
• Right to correction: to request that inaccurate or incomplete data is corrected.
• Right to withdraw consent: where processing is based on consent, to withdraw it at any time without affecting prior processing.
• Right to limit processing: to request that we limit how we use your data in certain circumstances.

To exercise any of these rights, email [email protected]. We will respond within 21 calendar days.

9. Third-Party Links

Our website may link to external sites. We are not responsible for the privacy practices of those sites and recommend reviewing their policies directly.

10. Children's Privacy

Our services are directed at businesses and their representatives. We do not knowingly collect personal data from individuals under 18. If we become aware of such collection, we will delete it promptly.

11. Changes to This Policy

We may update this policy from time to time to reflect changes in our practices or legal requirements. The date at the top of this page will be updated accordingly. Where changes are material, we will make reasonable efforts to notify affected parties.

12. Contact

Questions or requests relating to this policy should be directed to:

• Email: [email protected]
• Address: Suria Stream, Lebuh Light 24, 10200 George Town, Penang, Malaysia