Privacy Policy

1. Introduction

Heirmark ("we", "us", "our") is committed to handling personal data responsibly. This policy describes what personal information we collect, how we use it, and what rights you have in relation to it. This policy applies to all individuals who contact us, book a session, or use our website at heirmarked.biz.

This policy is prepared in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA 2010). If you have questions about this policy, please contact us at [email protected].

2. Data We Collect

Information You Provide Directly

• Name, email address, and phone number when you submit an enquiry form or contact us
• Details about your session requirements that you share in correspondence
• Billing information if a payment arrangement is made

Information Collected Automatically

• Browser type, approximate location, and pages visited via anonymised analytics cookies
• IP address logged by web server infrastructure for security purposes

We do not retain copies of documents, photographs, or materials you bring to sessions. All session worksheets and notes are returned to you at the close of each appointment.

3. How We Use Your Data

• To respond to your enquiry and discuss suitable session options
• To schedule, confirm, and administer your booking
• To send a pre-session preparation checklist and related correspondence
• To process payment arrangements for the Heritage Records Programme
• To improve the website and our service offerings using aggregated, anonymised analytics

We do not use your personal data for direct marketing without your explicit consent. We do not sell, rent, or transfer your data to third parties for their marketing purposes.

4. Legal Basis for Processing

• Contract: Processing necessary to fulfil a booking or respond to an enquiry
• Consent: Analytics cookies, which you can decline via our cookie settings
• Legitimate interests: Security logging and fraud prevention

5. Data Retention

Enquiry and booking records are retained for up to 24 months from the date of last contact, unless an ongoing relationship with the family requires a longer retention for administrative continuity. Payment records are retained for 7 years in compliance with Malaysian financial record-keeping requirements. You may request deletion of your records at any time by writing to us at [email protected].

6. Data Security

• Enquiry data is stored on access-controlled systems
• Email communications are handled through encrypted channels
• No paper records of client personal data are retained in our office beyond active bookings
• Staff with access to client data are made aware of their confidentiality obligations

In the event of a data breach that could affect your rights or freedoms, we will notify you and the relevant supervisory authority within 72 hours of becoming aware of the incident.

7. Cookies

Our website uses cookies. Please see our Cookie Policy for a full explanation of the cookies we use and how to manage your preferences.

8. Third-Party Services

Our website may use the following third-party services:

• Google Analytics (if analytics cookies are accepted) — for anonymised website usage data
• Google Maps — embedded map on our homepage; subject to Google's own privacy policy
• Font providers (Google Fonts, Cloudflare CDN) — for website typography and script delivery

We have no control over third-party privacy practices. We encourage you to review their respective policies if you have concerns.

9. Your Rights Under the PDPA 2010

• Right of access: Request a copy of the personal data we hold about you
• Right of correction: Request correction of inaccurate or incomplete data
• Right to prevent processing: Object to processing for direct marketing or where processing is causing distress
• Right of withdrawal: Withdraw consent for analytics cookies at any time via our cookie settings

To exercise any of these rights, contact us at [email protected]. We will respond within 21 days. For concerns that cannot be resolved with us directly, you may refer the matter to the Department of Personal Data Protection Malaysia (JPDP).

10. Children's Privacy

Our services are directed at adults aged 18 and above. We do not knowingly collect personal data from individuals under 18. If you believe a minor has submitted personal data to us, please contact us so we can remove it.

11. External Links

Our website may contain links to external resources. We are not responsible for the privacy practices of those sites and recommend reviewing their policies independently.

12. Changes to This Policy

We may update this policy from time to time. The revised policy will be published on this page with an updated date. Continued use of our website after changes are posted constitutes acceptance of the updated terms.

13. Contact

For all privacy-related matters:

• Email: [email protected]
• Address: 18 Jalan Bukit Bintang, 55100 Kuala Lumpur, Wilayah Persekutuan, Malaysia