Privacy Policy

1. Data Controller

arahxad Collective is the data controller responsible for the personal information you provide to us. Our registered address is 56, Jalan Sultan Ahmad Shah, 10050 George Town, Penang, Malaysia. You can contact us regarding data matters at [email protected].

2. What We Collect

We may collect and process the following personal data:

• Name, job title, and organisation name
• Email address and telephone number
• Business address, if provided during engagement discussions
• Message content submitted through our contact form
• Technical data such as IP address, browser type, and pages visited (via analytics tools)
• Cookie preferences and consent status

We do not collect sensitive personal data such as identity card numbers, financial account details, or health information through our website.

3. How We Collect Data

• Directly from you when you complete our contact form or email us
• Through your use of our website, including cookies and analytics tools
• During engagement scoping calls or meetings
• From publicly available sources during competitive research (for our intelligence programme clients)

4. Legal Basis and How We Use Your Data

We process your data under the following bases:

• Consent: When you submit our contact form, you consent to us using your information to respond to your enquiry.
• Legitimate interest: We may use your information to improve our services and to conduct business development.
• Contractual necessity: If we enter an engagement with you, we use your data to fulfil our consulting obligations.
• Legal compliance: Where applicable, we retain data to meet regulatory or legal obligations.

Specifically, we use your information to respond to enquiries, manage client engagements, send relevant updates about our services (only if you have consented), improve our website based on usage data, and comply with applicable Malaysian laws.

5. Data Retention

We retain enquiry data for up to 24 months after last contact. Engagement-related data is retained for five years after engagement closure to comply with business record-keeping obligations. Analytics data is typically retained for 14 months. You may request deletion at any time, subject to legal retention requirements.

6. Data Sharing

We do not sell personal data. We may share it with:

• Service providers who assist with website hosting, analytics, and communications (under data processing agreements)
• Professional advisors such as legal counsel, where necessary
• Government bodies or regulators if required by Malaysian law

We do not disclose client data or engagement details to third parties without written consent.

7. Data Protection Measures

• Data transmitted to and from our site uses SSL/TLS encryption
• Access to personal data within our organisation is limited to staff who need it
• We use reputable third-party platforms that maintain their own security standards
• In the event of a data breach affecting your rights or freedoms, we will notify you and relevant authorities as required by Malaysian law

8. Cookies

We use cookies on our website to support basic functionality, understand how visitors use the site, and remember preferences. You can manage your cookie preferences at any time via our Cookie Policy page.

9. Your Rights

Under the PDPA and applicable data protection principles, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate or incomplete data
• Request deletion of your data where there is no legal basis for continued processing
• Withdraw consent at any time, where processing is based on consent
• Object to processing for marketing purposes
• Lodge a complaint with the Department of Personal Data Protection Malaysia

To exercise any of these rights, contact us at [email protected]. We will respond within 21 business days.

10. Third-Party Links

Our website may contain links to external sites. We are not responsible for the privacy practices of those sites and recommend reviewing their policies before sharing personal information.

11. Children's Privacy

Our website and services are directed at individuals aged 18 and above. We do not knowingly collect personal data from minors. If we become aware that we have done so, we will delete it promptly.

12. Policy Updates

We may update this policy from time to time. Material changes will be noted on this page with a revised "Last Updated" date. Continued use of our website following any changes constitutes acceptance of the updated policy.

13. Contact for Data Enquiries

For any questions about this policy or your personal data, please contact us at [email protected] or write to us at 56, Jalan Sultan Ahmad Shah, 10050 George Town, Penang, Malaysia.