Privacy Policy

1. What personal data we collect

We collect the following categories of personal data, only where you provide them voluntarily:

• Contact details: name, email address, phone number (where provided in enquiry forms)
• Enquiry content: any information you include in the message field of the enquiry form
• Programme participation records: which programme you enrolled in and the dates of attendance
• Website usage data: pages visited, browser type, approximate location (via analytics cookies, where consented)

We do not collect written content produced in workshops. Workbooks are the property of participants and are not retained or copied by the studio.

Legal basis for processing

• Consent: when you submit an enquiry form or agree to cookie use
• Legitimate interests: for programme administration and studio communications
• Contract performance: when processing enrolment for a paid programme

Data retention

Enquiry data is retained for up to 24 months. Participation records (name, programme, date) are retained for up to 5 years for administrative purposes. Website analytics data is retained for up to 14 months, in line with standard analytics provider settings.

2. How we use your data

Personal data submitted through our website or collected during programme enrolment is used for the following purposes:

• Responding to workshop and programme enquiries
• Confirming and managing programme enrolments
• Sending follow-up notes where these are part of a programme (e.g. the Family Records Series)
• Sending occasional studio updates, where you have consented to receive them
• Improving our website and workshop materials through aggregated analytics

We do not use your personal data for automated decision-making. We do not sell, rent, or share your personal data with third parties for marketing purposes.

Third-party services

We may use the following categories of third-party services that may process data on our behalf:

• Website analytics (e.g. Google Analytics — where consent is given for analytics cookies)
• Email delivery services — for programme confirmation messages

All third-party processors are required to handle data in accordance with applicable data protection obligations.

3. How we protect your data

• Website transmission secured via HTTPS/TLS encryption
• Enquiry data stored on access-controlled systems; not stored in shared or public locations
• Studio participant records kept in a physically secured environment; accessible only to authorised staff
• In the event of a data breach affecting your personal information, we will notify affected individuals within 72 hours of becoming aware, where required by law

4. Cookies

Our website uses cookies. Essential cookies are necessary for the site to function and are set automatically. Analytics and preference cookies are set only with your consent, which you can give or withdraw at any time.

For full details on the cookies we use and how to manage your preferences, please see our Cookie Policy.

5. Your rights

Under the Personal Data Protection Act 2010 (Malaysia) and where applicable, you have the following rights in relation to your personal data:

• Right of access: to request a copy of the personal data we hold about you
• Right of correction: to request correction of inaccurate or incomplete data
• Right to withdraw consent: to withdraw consent for processing at any time (this does not affect processing carried out before withdrawal)
• Right to limit processing: to request that we limit how we use your data in certain circumstances

To exercise any of these rights, contact us at [email protected]. We will respond within 21 days. If you are not satisfied with our response, you may contact the Department of Personal Data Protection Malaysia (PDPD) at www.pdp.gov.my.

6. Third-party links

Our website may include links to external websites. We are not responsible for the privacy practices of those sites and encourage you to read their privacy policies separately.

7. Children's privacy

Our programmes and website are intended for adults aged 18 and above. We do not knowingly collect personal data from individuals under 18. If you believe a minor has submitted data to us, please contact us and we will remove it promptly.

8. Updates to this policy

We may update this privacy policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. We encourage you to review this policy periodically. Continued use of our website after changes are posted constitutes acceptance of the updated policy.