Privacy Policy

1. Data Controller

The data controller for personal data collected through this website and our services is:

2. Data We Collect

We collect personal data in the following circumstances:

Information you provide directly

• Full name (required for enquiry processing)
• Work email address (required)
• Phone number (optional)
• Company name and your role (optional, to help us tailor programme recommendations)
• Content of enquiry messages you submit through our contact form

Information collected automatically

• Browser type and version
• Device type and operating system
• Pages visited and time spent on each page
• Referring website or search term
• Cookie-based identifiers (see section 5)

Legal basis for processing

• Consent — when you submit a contact form or accept cookies
• Legitimate interest — for website analytics and service improvement
• Contract — when processing is necessary to deliver an agreed programme

3. How We Use Personal Data

• To respond to enquiries submitted through the contact form
• To prepare and deliver programme proposals, quotes and agreements
• To coordinate programme scheduling and logistics with HR contacts
• To send programme-related communications (not marketing without consent)
• To produce and deliver HR summary reports following programme delivery
• To improve the content and usability of this website using anonymised analytics data
• To comply with legal obligations under Malaysian law

We do not use personal data submitted through the contact form for unsolicited marketing. If you receive communications from us, they will relate directly to your enquiry or an agreed programme engagement.

4. Data Retention

5. Cookies

This website uses cookies to understand how visitors use the site and to remember your cookie preferences. We use the following categories:

• Essential cookies — required for basic site functionality; always active
• Analytics cookies — help us understand how visitors use the site (optional)
• Preference cookies — remember your cookie consent choice (optional)

You can manage your cookie preferences at any time via our Cookie Policy page.

6. Third-Party Services

We may use the following third-party services in connection with this website:

• Google Analytics — anonymised website traffic analysis
• Google Maps — embedded map on our homepage (subject to Google's Privacy Policy)
• Web hosting provider — servers located in Malaysia or Singapore

We do not sell personal data to third parties. We do not share personal data with third parties for their own marketing purposes.

7. Data Protection Measures

• Data transmitted between your browser and this website is encrypted via HTTPS/TLS
• Access to personal data is restricted to authorised Nilaya staff on a need-to-know basis
• Contact form submissions are stored on secured servers with access controls
• In the event of a data breach that may affect your rights, we will notify you and the relevant authority within the timeframe required by the PDPA

8. Your Rights Under the PDPA

As a data subject under Malaysia's Personal Data Protection Act 2010, you have the following rights:

• Right of access — to request a copy of the personal data we hold about you
• Right of correction — to request that inaccurate or incomplete data be corrected
• Right to withdraw consent — at any time, where processing is based on consent
• Right to limit processing — to request that we restrict how we use your data in certain circumstances
• Right to complain — to the Department of Personal Data Protection (JPDP) if you believe your data has been handled improperly

To exercise any of these rights, write to us at [email protected]. We will respond within 21 days.

9. Third-Party Links

This website may contain links to external websites or services. We are not responsible for the privacy practices or content of those websites. We recommend reviewing the privacy policy of any third-party site you visit.

10. Children's Privacy

Our services are designed for corporate HR teams and are not directed at individuals under 18 years of age. We do not knowingly collect personal data from minors. If you believe we have received data from a person under 18, please contact us at [email protected] and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we do, we will update the "Last Updated" date at the top of this page. Continued use of this website following a policy update constitutes acceptance of the revised policy.

12. Contact for Privacy Enquiries