Privacy Policy

1. Introduction

Gravel Reed (the "Practice") is committed to protecting the personal data of individuals who contact us or attend our educational engagements. This policy describes how we collect, hold, use, and protect personal data, and explains the rights available to individuals under applicable law.

This policy is written in accordance with the Personal Data Protection Act 2010 (PDPA) of Malaysia. The data controller is Gravel Reed, 7 Jalan Hang Tuah, 75300 Melaka, Malaysia.

If you have questions about this policy or about how your personal data is handled, please contact us at [email protected].

2. What Personal Data We Collect

We collect only the information needed to arrange and conduct our educational engagements. This includes:

• Full name
• Email address
• Telephone number (if provided)
• General notes about the engagement enquired about (if provided in a contact form message)
• Organisation name (for community body enquiries)

We do not collect identity document numbers, financial information, pension account details, or any administrative document contents at any stage of an enquiry or engagement. Participant documents are not copied, scanned, or stored by the Practice.

3. How Data Is Collected

Personal data is collected through the following means:

• Contact forms submitted on this website
• Telephone calls made to our office number
• Email correspondence addressed to our office
• In-person engagement registration at our premises

We do not collect personal data through social media platforms or third-party lead generation services.

4. Legal Basis and Purpose

Personal data is processed on the following grounds:

• Consent — where you submit a contact form or make an enquiry, you consent to us using that information to respond.
• Contractual necessity — where an engagement has been agreed, we hold contact information to confirm appointments and deliver the engagement.
• Legitimate interest — to maintain records of engagement completions for our own administrative purposes.

We use personal data for the following purposes only:

• Responding to enquiries
• Scheduling and confirming session appointments
• Sending follow-up responses within the agreed seven-day window
• Issuing engagement invoices

5. Data Retention

Contact details provided through an enquiry that does not lead to an engagement are deleted within 90 days of the last communication.

Contact details for completed engagements are retained for seven years to satisfy general administrative record-keeping practice, after which they are deleted.

Follow-up written question records are deleted after 12 months.

6. Data Sharing

We do not sell, rent, or share personal data with third parties for marketing purposes. Personal data may be shared in the following limited circumstances:

• With service providers who support our website and email infrastructure, under contractual data processing agreements
• Where required by Malaysian law or lawful authority

We do not transfer personal data outside Malaysia.

7. Data Security

Personal data held digitally is stored on password-protected systems with access limited to Practice staff. Paper-based records are held in locked storage at our premises. We review our security practices annually and in response to any identified risk.

In the event of a data breach that creates a risk to your rights, we will notify you as required under applicable law.

8. Cookies

This website uses cookies to understand how visitors use the site. Please see our Cookie Policy for full details, including how to manage your preferences.

9. Your Rights

Under the PDPA 2010, you have the following rights in relation to your personal data:

• Right to access — you may request a copy of the personal data we hold about you.
• Right to correction — you may request that inaccurate or incomplete data be corrected.
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time.
• Right to limit processing — you may request that we stop using your data for certain purposes.

To exercise any of these rights, please contact us at [email protected]. We will respond within 21 days.

If you are dissatisfied with our response, you may contact the Department of Personal Data Protection (JPDP), Ministry of Communications and Multimedia Malaysia.

10. Children's Privacy

Our services are directed at adults aged 18 and over. We do not knowingly collect personal data from individuals under 18. If we become aware that data belonging to a minor has been submitted, we will delete it promptly.

11. Third-Party Links

This website may contain links to external websites, including public-body guidance documents. Gravel Reed is not responsible for the privacy practices of those sites and recommends reviewing their privacy policies independently.

12. Changes to This Policy

We may update this policy from time to time. The date at the top of this page reflects the most recent revision. Continuing to use this website or our services after a policy change constitutes acceptance of the revised terms.

13. Contact Us

For any privacy-related enquiry or request:

Gravel Reed
7 Jalan Hang Tuah, 75300 Melaka, Malaysia
[email protected]
+60 6 2847 3519