Privacy Policy

1. Introduction

Merbau ("we", "us", "our") is a business consulting practice registered in Malaysia and operating from No. 4, Jalan Laksamana, 75000 Melaka. We are committed to handling personal data with care, transparency and respect for the people who share it with us.

This policy describes what personal information we collect, why we collect it, how we use and protect it, and what rights you have in relation to it. It applies to all personal data collected through our website and through the direct provision of our services.

We operate under Malaysian law, including the Personal Data Protection Act 2010 (PDPA). We process personal data lawfully, fairly and transparently.

2. What Data We Collect

We collect personal data in the following ways:

• Contact form submissions: Name, email address and phone number when you submit an enquiry through our website.
• Direct engagement: Business and personal information you share during consulting sessions, including financial details, business history and personal circumstances relevant to the advisory work.
• Correspondence: Email and other written communications you send to us.
• Website analytics: Aggregated, anonymised information about how our website is used, via analytics cookies (where you have consented).

Legal basis for processing: We process data under three lawful bases under the PDPA: (a) your consent, given when you submit our contact form; (b) contractual necessity, when we need your data to deliver the service you have engaged; and (c) legitimate interests, such as keeping records of completed engagements.

Retention: Contact enquiry data is retained for up to 24 months. Engagement records are retained for up to 7 years for legal and business purposes. Analytics data is aggregated and not retained in identifiable form.

3. How We Use Your Data

We use personal data for the following purposes:

• Responding to your enquiries and arranging consulting engagements
• Delivering agreed consulting services and producing written engagement documents
• Maintaining records of completed engagements
• Communicating about your engagement, including scheduling and follow-up
• Improving our website and services using aggregated analytics

Third-party sharing: We do not sell personal data. We do not share your personal information with third parties except where required by Malaysian law or where you have expressly consented. We use a secure email provider and cloud storage for document handling; these providers are bound by appropriate data processing terms.

Marketing: We do not send unsolicited marketing communications. If you have engaged with us and wish to receive occasional updates, you may request this. You can withdraw consent at any time by emailing [email protected].

4. How We Protect Your Data

• Access to client records is restricted to staff directly involved in your engagement
• Written engagement documents are stored in password-protected cloud storage with encrypted transmission
• Our website uses HTTPS throughout
• In the event of a data breach that may affect your rights, we will notify you without undue delay
• We review our data practices periodically and update them as needed

5. Cookies

Our website uses cookies. Essential cookies are required for basic site function and cannot be disabled. Analytics and preference cookies are only placed with your consent, which you can manage via the cookie banner on the homepage or our Cookie Policy page.

6. Your Rights

Under the Malaysian Personal Data Protection Act 2010, you have the following rights in relation to your personal data:

• Access: You may request a copy of the personal data we hold about you.
• Correction: You may request that inaccurate data is corrected.
• Withdrawal of consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
• Objection to direct marketing: You may object to your data being used for direct marketing purposes.
• Deletion: You may request deletion of your data where there is no legitimate ongoing reason to retain it.

To exercise any of these rights, email us at [email protected]. We will respond within 21 days. If you are dissatisfied with our handling of your request, you may contact the Department of Personal Data Protection Malaysia (JPDP).

7. Third-Party Links

Our website may contain links to external websites. We are not responsible for the privacy practices of those sites and encourage you to review their policies independently.

8. Children's Privacy

Our services are intended for business owners aged 18 and above. We do not knowingly collect data from persons under 18. If we become aware that we have inadvertently done so, we will delete the data promptly.

9. Policy Updates

We may update this policy from time to time. Where changes are material, we will note the updated date at the top of this page. Continued use of our services after an update constitutes acceptance of the revised policy.