Privacy Policy

1. Introduction

Gemilang ("we", "us", "our") is committed to handling personal data responsibly. This policy explains what information we collect through our website and during service delivery, how we use it, and the rights you have in relation to it.

This policy applies to all personal data we process in connection with our AI integration consulting services and our website at {{DOMAIN}}. It is governed by the Personal Data Protection Act 2010 (PDPA) of Malaysia.

2. Data We Collect

We collect only what is necessary for the purpose at hand:

• Contact form submissions: name, email address, phone number (optional), and message content.
• Service delivery: business details, workflow descriptions, and other information you share during an assessment or ongoing engagement. This is held strictly in confidence.
• Website usage: if analytics cookies are accepted, aggregated data on page visits and session duration via third-party analytics tools.
• Communication: the content of emails and messages sent to us directly.

Legal basis for processing: Consent (for analytics and marketing), Contract (for service delivery), and Legitimate Interest (for responding to enquiries and improving our services).

Retention: Contact enquiry data is held for 24 months. Client service records are retained for 5 years after the end of an engagement in line with standard business record-keeping requirements. Analytics data is retained in aggregated form only and not linked to individuals.

3. How We Use Your Data

• To respond to enquiries and requests submitted through our contact form.
• To deliver services you have engaged us for, including assessments, setup work, and advisory calls.
• To send relevant updates where you have given consent to receive them.
• To understand how our website is used and improve it accordingly (analytics, if consented).
• To meet any legal or regulatory obligations that apply to us as a Malaysian business.

We do not sell personal data to third parties. We do not use personal data for automated decision-making or profiling.

4. Data Sharing

We share data only in the following limited circumstances:

• Service providers: Third-party tools used in our operations (e.g. email, scheduling, analytics) that are bound by appropriate data processing agreements.
• Legal compliance: When required to do so by Malaysian law, court order, or regulatory authority.
• Business transfer: In the event of a sale or transfer of the business, subject to equivalent confidentiality commitments being maintained.

Any third-party tool we use for client-facing work is reviewed for its data handling practices before we recommend or deploy it.

5. Data Protection Measures

• Our website uses HTTPS for all data transmission.
• Access to client files and records is limited to the team members who need it.
• We do not store sensitive financial or health data.
• In the event of a data breach affecting your personal data, we will notify you without undue delay.

6. Cookies

We use cookies on this website. Essential cookies are necessary for the site to function. Optional cookies (analytics, preferences) are set only with your consent, which you can manage via the cookie banner or our Cookie Policy.

7. Your Rights

Under the Personal Data Protection Act 2010 (Malaysia), you have the following rights:

• Access: Request a copy of the personal data we hold about you.
• Correction: Ask us to correct inaccurate or incomplete data.
• Withdrawal of consent: Withdraw consent for marketing or analytics processing at any time, without affecting lawfulness of prior processing.
• Objection: Object to processing based on legitimate interest.
• Deletion: Request erasure of personal data we hold, where no overriding legal obligation applies.

To exercise any of these rights, contact us at privacy@{{DOMAIN}}. We will respond within 30 days.

If you believe your data has been handled improperly, you may lodge a complaint with the Department of Personal Data Protection Malaysia (JPDP).

8. Third-Party Links

Our website may contain links to external sites. We are not responsible for the privacy practices of those sites and recommend you review their policies independently.

9. Children's Privacy

Our services are directed at business owners and professionals aged 18 and above. We do not knowingly collect data from individuals under 18. If we become aware of such data, we will delete it promptly.

10. Updates to This Policy

We may update this policy from time to time. Material changes will be noted at the top of this page with a revised date. Continued use of our website or services after a change constitutes acceptance of the updated policy.