Privacy Policy

1. Introduction

Embun Echo ("we", "us", "our") is committed to protecting the personal data of individuals who interact with our services and website. This Privacy Policy explains what data we collect, how we use it, how we protect it, and what rights you have in relation to it.

This policy applies to data collected through our website at embunechos.live, through our contact forms, and in the course of delivering our advisory services. It is prepared in compliance with the Personal Data Protection Act 2010 (PDPA) of Malaysia.

For questions about this policy, please contact us at [email protected].

2. Data We Collect

We may collect the following categories of personal data:

• Identity data: full name, job title, organisation name
• Contact data: email address, phone number, business address
• Enquiry data: content of messages submitted through our contact form
• Technical data: IP address, browser type, pages visited, time on site (collected via analytics cookies, subject to consent)
• Communication data: records of correspondence during and after an engagement
• Engagement data: organisational information shared during survey, build, or review work

We collect personal data through: our website contact form; direct email or telephone enquiries; and in the course of delivering contracted services.

3. Legal Basis for Processing

We process personal data on the following bases under the PDPA 2010:

• Consent: for analytics cookies and marketing communications (where you have opted in)
• Contractual necessity: to deliver services you have engaged us to perform
• Legitimate interests: to respond to enquiries, maintain engagement records, and improve our services
• Legal obligation: where required by Malaysian law

4. How We Use Your Data

• To respond to enquiries and provide information about our services
• To deliver survey, build, or review engagements as contracted
• To maintain records of engagements and communications
• To improve our website and services (using aggregated, anonymised analytics data)
• To comply with legal and regulatory obligations

We do not use your personal data for automated decision-making or profiling. We do not sell personal data to third parties.

5. Data Retention

We retain personal data for the following periods:

• Enquiry data (no engagement entered): 12 months from last contact
• Engagement records: 7 years from engagement completion (in accordance with standard business record-keeping practice)
• Analytics data: 26 months, in aggregated form
• Legal compliance records: as required by applicable Malaysian law

6. Data Sharing

We do not share personal data with third parties for marketing or commercial purposes. We may share data with:

• Technology service providers (hosting, email infrastructure) under appropriate data processing agreements
• Professional advisors (legal, accounting) under confidentiality obligations
• Regulatory authorities, where required by law

7. Data Protection Measures

• Data in transit is encrypted using TLS/HTTPS
• Access to client data is restricted to practitioners directly involved in the engagement
• Engagement records are stored in secured systems with access controls
• In the event of a data breach affecting personal data, we will notify affected individuals and the relevant authority within the timeframes required by Malaysian law

8. Cookies

We use cookies on our website. Essential cookies are required for site function and cannot be disabled. Analytics and marketing cookies are only placed with your consent. You can manage your cookie preferences at any time through our Cookie Policy page.

9. Your Rights

Under the Personal Data Protection Act 2010 (Malaysia), you have the right to:

• Access personal data we hold about you
• Correct inaccurate or incomplete personal data
• Withdraw consent to processing (where consent is the legal basis)
• Request erasure of your data (subject to our legal retention obligations)
• Object to processing for direct marketing purposes
• Lodge a complaint with the Department of Personal Data Protection Malaysia

To exercise any of these rights, please contact us at [email protected]. We will respond within 21 days.

10. Third-Party Links

Our website may contain links to external sites. We are not responsible for the privacy practices of those sites and recommend you review their policies independently.

11. Children's Privacy

Our services are directed at business organisations and their representatives. We do not knowingly collect personal data from individuals under 18 years of age. If you believe we have received data from a minor, please contact us immediately.

12. Policy Updates

We may update this policy from time to time. Changes will be published on this page with a revised "Last Updated" date. For material changes affecting how we use data collected prior to the change, we will take reasonable steps to notify affected individuals.

13. Contact Us

Data Controller: Embun Echo
Address: Jalan Raja Chulan 27, 50200 Kuala Lumpur, Malaysia
Email: [email protected]
Phone: +60 3 2786 5184