Privacy Policy

What personal data we collect

When you make an enquiry, book a service or use our website contact form, we may collect the following:

• Full name
• Email address
• Telephone number (where provided voluntarily)
• Message content submitted via the contact form
• General location information (city or district, where provided)

For clients who engage us to handle physical documents, we also hold the names and description of document owners appearing on the items processed. We do not retain copies of personal identification documents unless explicitly instructed to do so in writing.

We collect data directly from you — we do not purchase or acquire personal data from third parties. Our website may collect standard server log data (IP address, browser type, page visited, time of visit) through our hosting provider for security and performance purposes.

Legal basis and purpose of processing

We process personal data on the following grounds under the PDPA:

• Contractual necessity — to respond to your enquiry, confirm a booking, deliver the agreed service and communicate about its progress.
• Legitimate interest — to maintain records of completed engagements, manage our business operations and improve service quality.
• Consent — for any marketing or follow-up communications beyond the direct scope of a specific engagement, where you have opted in.

How we use your data

• To respond to enquiries and confirm service arrangements
• To deliver the Process Orientation Seminar, Digitisation or Stewardship Plan services
• To communicate updates, appointment reminders and year-end summaries
• To maintain internal business records as required
• To improve our website and service delivery processes

We do not use your personal data for automated decision-making or profiling. We do not sell, rent or share your personal data with third parties for marketing purposes.

Data sharing

We do not share personal data with third parties except in the following limited circumstances:

• Service providers — our website hosting and email providers may process data on our behalf under written agreements. They do not use your data for their own purposes.
• Legal requirements — we may disclose data to comply with a court order, legal obligation or lawful request from a Malaysian authority.
• At your direction — for Stewardship Plan clients, we may share your scheduling details with professionals you have engaged (lawyers, accountants, valuers) solely to arrange appointments on your behalf.

Data retention

We retain contact and enquiry data for a maximum of 24 months from the date of last contact. For completed service engagements, we retain the engagement record (excluding any document copies returned to you) for five years for business accounting and regulatory purposes. Physical document copies or digital scans created during a digitisation project are returned to or destroyed for the client at handover and are not retained by Willowmark beyond that point unless a Stewardship Plan continues.

Data protection measures

• Access to client data is restricted to Willowmark personnel involved in delivering the relevant service
• Digital records are stored on password-protected systems with access logging
• Physical documents in our care are held in locked storage and are never left unsupervised
• In the event of a data breach that may affect your rights, we will notify you and, where required, the relevant Malaysian authority within the timeframe required by law

Cookies

Our website uses cookies to maintain basic functionality and to understand how the site is used. We do not use advertising or cross-site tracking cookies. For full details of the cookies used, how to manage your preferences and how to disable them, please see our Cookie Policy.

Your rights

Under Malaysia's Personal Data Protection Act 2010 and general data protection principles, you have the right to:

• Access — request a copy of the personal data we hold about you
• Correction — ask us to correct inaccurate or incomplete data
• Erasure — ask us to delete your data where it is no longer necessary for the purpose for which it was collected
• Withdrawal of consent — withdraw consent for any processing based on consent, at any time
• Object to processing — object to processing carried out on the basis of legitimate interest

To exercise any of these rights, contact us at [email protected]. We will respond within 21 days. If you are not satisfied with our response, you may contact Malaysia's Department of Personal Data Protection (JPDP) at www.pdp.gov.my.

Third-party links

Our website may contain links to external websites, including official Malaysian government and statutory body publications. We are not responsible for the privacy practices of those sites and encourage you to read their privacy policies before providing any personal information.

Children's privacy

Our services are intended for adults aged 18 and over. We do not knowingly collect personal data from individuals under 18. If you believe a minor has provided us with personal information, please contact us at [email protected] and we will remove it promptly.

Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will post the revised version on this page with an updated effective date. For significant changes affecting how we use your data, we will notify you by email if you are an active client.

Contact for privacy matters

For any questions about this Privacy Policy or about your personal data, please contact: