LEGAL

Privacy Policy

Elvaron Consulting  |  Last Updated: 14 April 2025

Elvaron Consulting is committed to handling personal data responsibly. This policy explains what information we collect, how we use it, and your rights in relation to it. It applies to data collected through this website and in the course of our consulting engagements. Our practice is governed by Malaysia's Personal Data Protection Act 2010 (PDPA).

1. Data Controller

Elvaron Consulting is the data controller for personal data collected through this website and our engagement activities. Our registered address is 8-04 Menara Pelangi, Jalan Kuning, Taman Pelangi, 80400 Johor Bahru, Johor, Malaysia. For data-related enquiries, contact us at [email protected].

2. Data We Collect

Contact form submissions

When you submit an enquiry via our website contact form, we collect your name, email address, and any information you include in the message field. Phone number is optional. We do not collect this information automatically — it is provided by you voluntarily.

Analytics and cookies

We may collect non-identifiable technical data about how visitors use our website, including pages visited, browser type, and approximate location. See our Cookie Policy for details.

Engagement data

During consulting engagements, we may receive production records, staffing information, and other operational data from clients. This data is used solely for the purpose of the engagement and is held under confidentiality obligations.

3. Legal Basis for Processing

• Consent: For marketing communications, where applicable.
• Contract performance: To respond to enquiries and fulfil consulting engagements.
• Legitimate interests: To improve our website and understand how visitors engage with our content.
• Legal obligation: Where processing is required by Malaysian law.

4. How We Use Your Data

• To respond to enquiries submitted through the website contact form
• To communicate with clients regarding active or proposed engagements
• To issue invoices and maintain engagement records
• To analyse and improve our website (anonymised, aggregated data only)
• To comply with legal or regulatory requirements

We do not sell personal data to third parties. We do not use your data for automated decision-making or profiling.

5. Data Sharing

We do not share personal data with third parties except in the following circumstances:

• Service providers: Hosting and website maintenance providers who process data on our behalf under contractual obligations.
• Legal requirements: Where disclosure is required by Malaysian law, court order, or regulatory authority.
• Business transfer: If the practice is sold or transferred, personal data may be transferred subject to equivalent protections.

6. Data Retention

• Contact form enquiries: retained for 24 months from the date of submission, or for the duration of any resulting engagement relationship.
• Engagement records and client data: retained for seven years from engagement close in accordance with standard business record-keeping requirements under Malaysian law.
• Website analytics data: retained for 13 months on a rolling basis.

Client operational data provided during engagements is destroyed or returned at engagement close unless otherwise agreed in writing.

7. Data Protection Measures

We maintain appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, or loss. These include:

• Encrypted storage for digital records containing personal data
• Access limited to authorised personnel only
• Secure destruction of physical documents containing personal data
• Regular review of data handling practices

In the event of a data breach that is likely to result in risk to affected individuals, we will notify the relevant parties as required under applicable law.

8. Cookies

Our website uses cookies to support basic functionality and to understand how visitors use the site. You can manage your cookie preferences at any time via our Cookie Policy page.

9. Your Rights Under Malaysia's PDPA 2010

Under Malaysia's Personal Data Protection Act 2010, you have the following rights in relation to personal data we hold about you:

• Right of access: Request a copy of the personal data we hold about you.
• Right of correction: Request that inaccurate or incomplete data be corrected.
• Right to withdraw consent: Withdraw consent for processing where consent is the legal basis.
• Right to limit processing: Request that we limit how we use your data in certain circumstances.

To exercise any of these rights, write to us at [email protected] or by post to our registered address. We will respond within 21 days. If you are unsatisfied with our response, you may lodge a complaint with the Personal Data Protection Department of Malaysia.

10. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices of those websites and encourage you to review their respective policies.

11. Children's Privacy

Our services are directed at businesses and professionals. We do not knowingly collect personal data from individuals under the age of 18. If we become aware that we have inadvertently collected such data, we will delete it promptly.

12. Changes to This Policy

We may update this policy from time to time to reflect changes in our practices or applicable law. The updated policy will be published on this page with a revised date. Continued use of the website after changes are published constitutes acceptance of the updated policy.

13. Contact for Data Enquiries

For questions about this policy or requests relating to your personal data, contact us at:

• Email: [email protected]
• Address: 8-04 Menara Pelangi, Jalan Kuning, Taman Pelangi, 80400 Johor Bahru, Johor, Malaysia
• Phone: +60 7-331 8475