Privacy Policy

1. Introduction

Willowvault ("we", "us", "our") is a records organisation and administrative coordination service based at 9 Jalan Merdeka, 75000 Melaka, Malaysia. This Privacy Policy explains how we collect, use and protect personal information when you use our website at willowv.blog or when you engage with our services.

We take the handling of personal information seriously. The information we collect is used only to respond to enquiries, arrange and conduct our programmes, and maintain the records necessary for our business. We do not sell personal data or share it with third parties for marketing purposes.

This policy applies to residents of Malaysia and is prepared with reference to the Personal Data Protection Act 2010 (PDPA) of Malaysia.

Questions about this policy may be directed to: [email protected]

2. Personal Data We Collect

We collect the following categories of personal data:

• Contact information: name, email address, telephone number, provided when you submit an enquiry through our website or contact us directly.
• Communication records: the content of email and written exchanges between you and Willowvault, maintained to support the continuity of our service.
• Session notes: written records of what was discussed and agreed during programme sessions, prepared for the household's use and retained briefly by Willowvault for continuity purposes.
• Website usage data: browser type, pages visited and approximate location (country level), collected via cookies and web analytics if you have given consent. See our Cookie Policy for details.

We do not collect or retain copies of client documents, photographs or household records. Any material accessed during a session remains in the household's possession.

Legal basis for processing

• Performance of a contract: processing necessary to arrange and deliver the programme you have engaged.
• Legitimate interests: maintaining communication records and session notes to provide a coherent service.
• Consent: website analytics cookies, where you have explicitly accepted them.

Retention periods

• Enquiry data: retained for 12 months from the date of the enquiry if no engagement follows.
• Client communication records: retained for 3 years from the conclusion of the final programme session.
• Financial records: retained for 7 years in accordance with Malaysian accounting requirements.
• Analytics data: retained for 14 months from collection, then deleted.

3. How We Use Personal Data

• To respond to enquiries and arrange programme sessions.
• To prepare session notes and written programme outputs addressed to the household.
• To issue invoices and maintain financial records.
• To improve our website using anonymised analytics data (where consent is given).
• To comply with legal obligations under Malaysian law.

We do not use personal data for automated decision-making or profiling. We do not send marketing communications unless you have specifically requested information about our programmes.

4. Data Sharing

We do not sell, trade or transfer personal data to third parties for their own purposes. We may share personal data in the following limited circumstances:

• Service providers: email hosting and website infrastructure providers who process data on our behalf under data processing agreements. These providers are not permitted to use your data for their own purposes.
• Legal compliance: if required to do so by applicable law or a valid court order.

All third-party providers used by Willowvault are assessed for adequate data protection practices before engagement.

5. Data Protection Measures

• Email communications are transmitted over encrypted connections (TLS).
• Access to client records within Willowvault is limited to coordinators directly involved in the relevant engagement.
• Physical session notes are stored securely and destroyed at the end of the applicable retention period.
• In the event of a data breach that may affect your rights, we will notify affected individuals and the relevant Malaysian authority within the timeframe required by the PDPA.

6. Cookies

Our website uses cookies to maintain basic site functionality and, where consent is given, to collect anonymised analytics data. Essential cookies are necessary for the site to operate and cannot be disabled. All other cookie categories require your consent. Please see our Cookie Policy for full details and to manage your preferences.

7. Your Rights

Under the Personal Data Protection Act 2010 (Malaysia), you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete personal data.
• Withdraw consent for processing based on consent (this does not affect processing carried out before withdrawal).
• Request erasure of your personal data where there is no legitimate reason for us to continue holding it.
• Object to processing where we rely on legitimate interests as the legal basis.
• Request restriction of processing in certain circumstances.

To exercise any of these rights, write to us at [email protected]. We will respond within 21 days. We may need to verify your identity before acting on a request.

If you have concerns about how we handle your personal data, you may contact the Department of Personal Data Protection Malaysia (Jabatan Perlindungan Data Peribadi).

8. Third-Party Links

Our website may contain links to external websites. We are not responsible for the privacy practices of those websites. We encourage you to read the privacy policy of any website you visit.

9. Children's Privacy

Our services are directed at adults (18 years and over) managing household records. We do not knowingly collect personal data from individuals under 18. If we become aware that personal data has been collected from a minor without appropriate consent, we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. The "last updated" date at the top of this page will reflect any changes. Where changes are material, we will notify active clients by email. Continued use of our website or services after changes take effect constitutes acceptance of the updated policy.

11. Contact

For any questions about this policy or about the personal data we hold: