Privacy Policy

1. About This Policy

This Privacy Policy applies to personal data collected through the Marrowdale website at marrowdales.live and through any direct communications with our team. It covers enquiries submitted via our contact form, correspondence by email or telephone, and data collected automatically when you browse the site.

If you have questions about this policy or wish to exercise any of your rights, please contact us using the details at the end of this document.

2. Personal Data We Collect

Information you provide directly

• Your name and organisation name
• Email address and telephone number
• The content of messages you send through our contact form
• Any additional details you share during an initial consultation or correspondence

Information collected automatically

• Browser type, device type, and operating system
• Pages visited and time spent on each page
• Referring website (if you arrived from another site)
• IP address (used for general analytics purposes only)

Cookies

We use cookies to support basic site functionality and understand how visitors use our site. For full details, please see our Cookie Policy.

3. How We Use Your Data

We use personal data only for the purposes described below. We do not sell personal data to third parties, and we do not use it for unsolicited marketing without your agreement.

• Responding to enquiries — to understand your needs and follow up on contact form submissions
• Delivering advisory services — to carry out work you have engaged us for, including preparing session notes, templates, and playbooks
• Scheduling and administration — to arrange sessions, send confirmations, and manage our working relationship
• Improving our website — to understand which content is most useful and identify any technical issues
• Legal compliance — to meet any obligations under Malaysian law or respond to lawful requests from authorities

Legal basis for processing

We process personal data on the basis of your consent (where you have provided information voluntarily), legitimate interest (for analytics and service improvement), and contractual necessity (where we are delivering a service you have engaged us for).

4. Data Retention

We keep personal data only for as long as necessary for the purpose for which it was collected:

• Enquiry records — up to 12 months after the last contact, unless an engagement begins
• Client engagement records — up to 7 years following completion of the engagement, in line with standard business record-keeping practice
• Analytics data — aggregated and anonymised on a rolling 26-month basis
• Cookie consent records — retained for 12 months from the date of consent

When data is no longer needed, it is securely deleted or anonymised.

5. Sharing Your Data

We share personal data only in limited circumstances:

• Service providers — trusted third parties who assist us with hosting, email delivery, and analytics. These providers are bound by confidentiality obligations and are not permitted to use your data for their own purposes.
• Analytics platforms — we may use tools such as Google Analytics to understand site usage. Data shared with these services is anonymised where possible.
• Legal requirements — where disclosure is required by Malaysian law or a competent authority.

We do not share personal data with advertisers or data brokers.

6. Data Security

We take reasonable technical and organisational measures to protect personal data against accidental loss, unauthorised access, and misuse. These include:

• Encrypted transmission (HTTPS) for all web traffic
• Access controls limiting who within our organisation can view personal data
• Secure storage with access logging
• Regular review of data handling practices

In the event of a data breach that poses a risk to individuals, we will take prompt remedial action and notify affected parties as required by applicable law.

7. Your Rights

Under the Personal Data Protection Act 2010 (Malaysia) and general data protection principles, you have the following rights in relation to your personal data:

To exercise any of these rights, please write to us at [email protected]. We will respond within 21 calendar days. We may ask you to verify your identity before acting on a request.

If you are unsatisfied with our response, you may direct a complaint to the Department of Personal Data Protection Malaysia (JPDP).

8. Third-Party Links

Our website may contain links to third-party websites for reference purposes. We are not responsible for the privacy practices of those websites and encourage you to read their privacy policies before providing any personal data to them.

9. Children

Our services are directed at organisations and professionals, and we do not knowingly collect personal data from individuals under the age of 18. If you believe a minor has submitted data to us, please contact us and we will remove it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. When we do, we will update the "Last Updated" date at the top of this page. If changes are material, we will make reasonable efforts to bring them to your attention. Continued use of our website after changes are posted constitutes acceptance of the updated policy.

11. Contact