Privacy Policy

1. About This Policy & Data Controller

This Privacy Policy applies to all personal data collected by Sejahtera Hub ("we", "us", "our") through our website at https://{{DOMAIN}}, our programmes, and any related communications.

Data Controller: Sejahtera Hub
53 Jalan Wong Ah Fook, 80000 Johor Bahru, Johor, Malaysia
Email: privacy@{{DOMAIN}}
Phone: +60 7-364 8271

As a data controller, we determine the purposes and means by which personal data is processed and are responsible for compliance with Malaysia's PDPA 2010.

2. What Personal Data We Collect

Depending on how you interact with us, we may collect the following categories of personal data:

• Identity data: full name, date of birth (where provided)
• Contact data: email address, phone number, postal address
• Enrolment data: programme preferences, payment records, attendance records
• Communication data: messages sent via our contact form or email, enquiry history
• Technical data: IP address, browser type, pages visited, session duration (collected via cookies and analytics tools)
• Preference data: your cookie consent choices stored in your browser

We do not collect sensitive personal data such as financial account numbers, national identification beyond what is necessary for registration, or health information.

3. How We Collect Your Data

• Directly from you: when you complete our contact form, enrol in a programme, call us, or email us
• Automatically: through cookies and analytics tools when you visit our website
• From third parties: if you are referred by a partner organisation, we may receive your name and contact details with your consent

4. Legal Basis for Processing

Under the PDPA 2010, we process your personal data based on one or more of the following grounds:

• Your consent: when you submit a contact form, opt into our communications, or accept cookies
• Contractual necessity: to deliver programme sessions you have enrolled in and process associated payments
• Legitimate interest: to improve our website, respond to general enquiries, and maintain business records — where these interests do not override your rights
• Legal obligation: where we are required by Malaysian law to retain or disclose information

5. How We Use Your Data

• Responding to your enquiries and scheduling consultations
• Processing programme enrolments and managing participant records
• Sending appointment reminders, session materials, and follow-up communications
• Providing bi-monthly check-in support for eligible programme participants
• Sending relevant educational updates or programme announcements (only where you have consented)
• Improving our website and service offerings through aggregated, anonymised analytics
• Meeting legal and regulatory obligations under Malaysian law

We do not use your personal data for automated decision-making that produces legal or similarly significant effects.

6. Data Sharing & Third Parties

We do not sell your personal data. We may share your data with the following parties only where necessary:

• Payment processors: to handle enrolment transactions securely
• Email service providers: to send programme materials and communications
• Analytics providers (e.g. Google Analytics): for anonymised website usage data only
• Legal authorities: if required by Malaysian law, court order, or regulatory obligation

All third parties we engage are required to handle your data in accordance with applicable data protection laws and to use it solely for the purposes we specify.

7. Data Retention Periods

• Contact enquiries: retained for up to 24 months after your last interaction
• Programme enrolment records: retained for 7 years for accounting and legal purposes
• Marketing consent records: retained until consent is withdrawn
• Website analytics data: aggregated, anonymised — retained for up to 26 months

After the applicable retention period, personal data is securely deleted or anonymised.

8. Data Security Measures

We take reasonable technical and organisational steps to protect your personal data from unauthorised access, disclosure, or loss:

• Website communications are encrypted via HTTPS (TLS/SSL)
• Access to personal data is restricted to authorised staff who need it to perform their duties
• Data stored on our servers is subject to access controls and regular security reviews
• Staff handling personal data receive guidance on PDPA obligations

In the event of a data breach that is likely to result in harm, we will notify affected individuals and the relevant authorities as required under Malaysian law.

9. Cookies & Tracking Technologies

Our website uses cookies — small text files stored on your device — to support core functionality, analyse usage patterns, and remember your preferences. You can manage your cookie preferences at any time via our Cookie Policy page.

We use the following categories:

• Essential cookies: required for the site to function — always active
• Analytics cookies: help us understand how visitors use the site — optional
• Marketing cookies: support relevant advertising — optional
• Preference cookies: remember your settings — optional

10. Your Rights Under PDPA

Under Malaysia's Personal Data Protection Act 2010, you have the following rights:

• Right of access: request a copy of the personal data we hold about you
• Right of correction: request correction of inaccurate or incomplete data
• Right to withdraw consent: withdraw consent to processing where consent is the legal basis — this does not affect processing carried out before withdrawal
• Right to limit processing: request that we limit how we use your data in certain circumstances
• Right to complain: lodge a complaint with the Personal Data Protection Commissioner, Department of Personal Data Protection Malaysia (JPDP)

To exercise any of these rights, please write to us at privacy@{{DOMAIN}}. We will respond within 21 days.

11. Children's Privacy

Our programmes and website are intended for adults aged 18 and above. We do not knowingly collect personal data from individuals under 18. If you believe we have inadvertently collected such data, please contact us and we will delete it promptly.

12. Third-Party Links

Our website may include links to external sites — for example, official regulatory websites or partner organisations. Once you leave our site, this privacy policy no longer applies. We are not responsible for the privacy practices of external websites and encourage you to review their policies directly.

13. Policy Updates

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we make material changes, we will update the "Last Updated" date at the top of this page. If changes are significant, we will communicate them via email to participants where appropriate. Continued use of our website after any update constitutes acceptance of the revised policy.

14. Contact & Enquiries

For any questions about this Privacy Policy, how we handle your data, or to exercise your rights, please contact us: