Privacy Policy

Sirincou ("the Practice", "we", "us", "our") is an advisory practice based at 14A, Jalan Burhanuddin Helmi, Taman Tun Dr Ismail, 60000 Kuala Lumpur, Malaysia. We take the handling of personal information as seriously as we take any other aspect of our advisory work — with care, without excess, and with full regard for the individuals concerned.

This Privacy Policy describes what personal data we collect when you contact us or engage our services, why we hold it, how long we keep it, and what rights you have over it. It applies to all data processing carried out by the Practice in connection with its website at sirincou.top and its professional engagements.

This Policy is written in compliance with Malaysia's Personal Data Protection Act 2010 (PDPA). Where our work touches clients in other jurisdictions, we observe the applicable standards of those regions as a matter of professional practice.

Questions regarding this Policy may be directed at any time to [email protected].

We collect only what the matter requires. The categories below describe the personal data that may pass through our hands in the ordinary course of an enquiry or engagement.

Information you provide directly

• Your name and the name of your organisation
• Your telephone number and email address
• A description of the matter you wish to discuss
• Any further information shared in the course of an engagement

Information collected automatically

When you visit our website, standard server and analytics processes may record your browser type, operating system, approximate geographic location, referring URL, and the pages you visit. This data is not linked to your identity unless you contact us.

Legal bases for processing

• Consent — when you submit an enquiry form or accept analytical cookies
• Legitimate interest — when we process minimal data to operate our website and respond to professional correspondence
• Contractual necessity — when an engagement is underway and the handling of information is necessary to deliver the work

Retention periods

Enquiry correspondence is retained for up to 12 months from the date of last contact. Engagement records, including written observations and meeting notes produced during an engagement, are retained for seven years from the engagement's close, in keeping with standard professional practice. Website analytics data is retained for a maximum of 26 months.

We use personal data for the following purposes only:

• To respond to enquiries and arrange initial conversations
• To carry out the work described in an engagement agreement
• To prepare and deliver written observations and reports
• To maintain proper professional records of the work
• To send occasional correspondence directly relevant to an engagement or its aftermath
• To understand how our website is used and to improve its performance

We do not use personal data for marketing purposes. We do not send newsletters, promotional material, or unsolicited communications of any kind. We do not share personal data with third parties for advertising purposes. We do not sell, rent, or trade personal information.

Data sharing

We may share data with a small number of service providers who assist with the operation of our website and communications infrastructure — analytics platforms, hosting services, and email delivery providers. Each is engaged under appropriate data processing terms. We do not share engagement-related information with any third party without explicit agreement.

We apply technical and organisational measures appropriate to the sensitivity of the information handled:

• Our website is served over HTTPS with current TLS encryption
• Access to engagement records and correspondence is restricted to the advising practitioner
• Written deliverables are transmitted via encrypted channels
• Physical materials, where retained, are stored securely

In the unlikely event of a personal data breach that may affect your rights, we will notify you and the relevant authority without undue delay, and within the timeframes required by applicable law.

We conduct periodic reviews of our data handling practices. Where a third-party provider is used, we verify that adequate protections are in place before engaging them.

Our website uses cookies — small text files placed on your device — to distinguish visits, support basic functionality, and, where you consent, to collect aggregate usage data. We use the following categories:

• Essential cookies — required for the site to function. These cannot be declined.
• Analytics cookies — used to understand how pages are used, which pages are visited, and where visitors come from. These are activated only with your consent.
• Marketing cookies — used for audience measurement across platforms. Activated only with consent.
• Preference cookies — used to remember your cookie choices. Activated only with consent.

You may review and adjust your cookie preferences at any time on our Cookie Policy page. Withdrawing consent for optional cookies does not affect any engagement in progress.

Under Malaysia's Personal Data Protection Act 2010 and general principles of fair dealing, you have the following rights in relation to your personal data:

• Right of access — to request a copy of the personal data we hold about you
• Right of correction — to ask that inaccurate or incomplete data be updated
• Right to withdraw consent — to withdraw consent for processing at any time, without affecting anything done prior to withdrawal
• Right to cease processing — to request that we stop using your data for specified purposes
• Right of erasure — to ask for deletion of data we hold, subject to our legitimate need to retain engagement records
• Right of data portability — to receive your data in a structured, machine-readable format where technically practicable

To exercise any of these rights, write to us at [email protected]. We will respond within 21 days. There is no charge for a request made in good faith.

If you are dissatisfied with our handling of a data concern, you may raise a complaint with Malaysia's Department of Personal Data Protection (JPDP) through the official channels at pdp.gov.my.

Our website may contain links to external sites and resources. Once you leave our pages, this Privacy Policy no longer applies. We are not responsible for the privacy practices of any external site, and we encourage you to read the relevant policy before sharing personal information elsewhere.

Our services are directed at business owners, leaders, and organisations. We do not knowingly collect personal data from individuals under the age of 18. If you believe a minor has submitted information to us, please contact us at [email protected] and we will remove it promptly.

We may update this Privacy Policy from time to time, in particular when our data handling practices change, when we engage new service providers, or when applicable law is amended. The revised policy will be published on this page, with the date of the most recent update noted at the top.

If you are in an active engagement with us at the time of a material change, we will notify you directly by email.

For any question, request, or concern relating to the handling of your personal data, please write to us. We prefer correspondence in writing so that we may respond carefully and keep a proper record.