Privacy Policy

1. Introduction

Kithbureau ("the bureau", "we", "us") is committed to handling personal data with care and within the requirements of the Personal Data Protection Act 2010 (PDPA) of Malaysia. This policy describes what personal data we collect in connection with our family documentation and records support services, how we use it, and the rights available to you in relation to it.

This policy applies to all individuals who contact us, use our website, or engage the bureau for any of our three service engagements. For questions about this policy, contact us at [email protected].

2. Data We Collect

We collect only the personal data necessary to provide our services and respond to enquiries. This includes:

• Contact data: name, email address, phone number (optional) — collected via the enquiry form on our website or by telephone.
• Communication records: records of correspondence between you and the bureau, for service delivery and follow-up purposes.
• Engagement records: details of the scope agreed for any engagement, invoices, and written deliverables (inventories, registers, orientation notes). These are administrative records of the bureau's work — not copies of household documents.
• Website usage data: standard server logs and, where you consent, analytics data relating to how our website is used.

We do not collect copies of the household documents we handle during engagements. Those remain with the household and on household-owned storage. The bureau retains no household document data after an engagement closes.

3. Legal Basis for Processing

Under the PDPA 2010, we process personal data on the following grounds:

• Contract performance: processing necessary to carry out engagement work, issue invoices, and deliver written outputs.
• Legitimate interests: responding to enquiries, maintaining records of completed engagements for our own administrative purposes.
• Consent: for marketing communications and non-essential website analytics (given via the cookie consent mechanism on our website).

4. How We Use Personal Data

• To respond to enquiries and schedule engagements.
• To carry out and document the agreed scope of an engagement.
• To issue invoices and maintain financial records as required by law.
• To communicate about the status of an engagement or follow-up items.
• To improve our website based on aggregated, anonymised usage data (where consent is given).

We do not sell personal data to any third party. We do not use personal data for automated decision-making or profiling.

5. Data Retention

We retain contact and engagement records for seven years from the close of an engagement, in line with standard Malaysian record-keeping requirements for administrative businesses. Website enquiry data from contacts who do not proceed to an engagement is retained for twelve months, after which it is deleted. You may request earlier deletion — see section 8 below.

6. Third-Party Services

Our website uses the following third-party services:

• Google Analytics (where consent is given) — anonymised website traffic data.
• Tailwind CSS CDN and Google Fonts CDN — for website display; these services may log your IP address in the ordinary course of content delivery.
• Google Maps — embedded map on our homepage; subject to Google's own privacy policy.

We do not share personal data with any third party for their own marketing purposes.

7. Cookies

We use cookies on this website for essential functionality (remembering your cookie consent preference) and, where you agree, for analytics. Full details are in our Cookie Policy. You can change your cookie preferences at any time via the cookie policy page.

8. Your Rights

Under the PDPA 2010 and applicable principles, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Request deletion of data we are not required to retain by law.
• Object to processing where we rely on legitimate interests as the basis.
• Withdraw consent at any time for processing based on consent (including marketing and non-essential analytics).
• Lodge a complaint with the Department of Personal Data Protection (JPDP) Malaysia if you believe we have not handled your data in accordance with the PDPA 2010.

To exercise any of these rights, contact us at [email protected]. We will respond within 21 days.

9. Data Security

We take reasonable steps to protect personal data from unauthorised access, including access controls on bureau email and file systems, and use of encrypted connections (HTTPS) for our website. In the event of a data breach affecting your personal data, we will notify you without undue delay and take steps to contain and remedy the breach.

10. Third-Party Links

Our website may contain links to external sites. We are not responsible for the privacy practices of those sites and encourage you to review their policies directly.

11. Children

Our services are directed at adults aged 18 and above. We do not knowingly collect personal data from persons under 18. If you believe a person under 18 has provided us with personal data, please contact us and we will delete it promptly.

12. Changes to This Policy

If we make material changes to this policy, we will update the "Last updated" date at the top of the page. Continued use of our website or services after changes are published constitutes acceptance of the updated policy.

13. Contact

Data controller: Kithbureau, 26 Jalan Sultan Idris Shah, 30000 Ipoh, Perak, Malaysia.

For privacy-related enquiries: [email protected]

For the Department of Personal Data Protection (JPDP) Malaysia: www.pdp.gov.my