Privacy Policy

1. Data Controller

The data controller for personal data collected through this website and through engagement enquiries is Estara Ledger, 17 Jalan Chung Thye Phin, 30250 Ipoh, Perak, Malaysia. For data-related enquiries, write to [email protected].

2. What Personal Data We Collect

We collect personal data in the following circumstances:

• Enquiry form: Name, email address, and telephone number (telephone is optional). We also collect the content of any message submitted.
• During engagements: Name, contact details, and any personal information shared in the course of the engagement. For oral history recordings, this includes audio recordings of the elder family member and the transcript derived from them.
• Website usage: If analytics cookies are accepted, we receive anonymised data on page visits and session duration from Google Analytics.

We do not collect sensitive personal data (such as health information, financial account numbers, or identification document numbers) through this website. If sensitive data is shared in the course of an engagement, a separate data handling agreement is signed before any work begins.

3. Legal Basis for Processing

• Consent: Where you submit an enquiry form or accept analytics cookies, processing is based on your consent.
• Contract: Where we enter an engagement with you, processing of contact and engagement data is necessary to fulfil that engagement.
• Legitimate interest: We may retain records of completed engagements (in anonymised form) for quality review purposes.

4. How We Use Personal Data

• To respond to enquiries submitted through the website contact form
• To arrange and conduct the engagement you have requested
• To deliver the agreed deliverables (templates, transcripts, assessments)
• To communicate about the progress of an engagement
• To maintain records of engagements for our own administrative purposes
• To improve this website using anonymised analytics data (with your consent)

We do not use personal data for marketing communications without your explicit consent. We do not sell personal data to third parties.

5. Data Sharing

We do not share personal data with third parties except in the following circumstances:

• Service providers: We use Google Analytics for website analytics. Google's privacy policy governs the handling of data transmitted to Google through this service. If you reject analytics cookies, no data is transmitted.
• Legal obligation: We may disclose personal data if required to do so by law or in response to a valid legal request from an authority in Malaysia.
• With your consent: We do not share engagement outputs (recordings, transcripts, assessments) with any person or organisation outside the engagement without your explicit written consent.

6. Data Retention

• Enquiry data: Retained for 12 months after the last communication, then deleted.
• Engagement records: Retained for 7 years following the close of the engagement for administrative and quality purposes, in anonymised form after the first year.
• Working copies of documents: Returned or destroyed at the close of the engagement as specified in the handling statement signed before work begins.
• Analytics data: Retained by Google Analytics for 26 months (standard retention period). We do not retain raw analytics data ourselves.

7. Data Security

We store personal data on password-protected systems. Enquiry data submitted through this website is transmitted over HTTPS. Physical documents handled during engagements are kept in locked storage and returned or destroyed as agreed. We conduct an annual review of our data handling practices.

In the event of a data breach affecting your personal data, we will notify you within 72 hours of becoming aware of the breach, as required under the PDPA.

8. Cookies

This website uses essential cookies required for basic site operation and, with your consent, analytics cookies to understand how the site is used. For full details, see our Cookie Policy.

9. Your Rights Under the PDPA

Under Malaysia's Personal Data Protection Act 2010, you have the right to:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate or incomplete personal data
• Withdrawal of consent: Withdraw consent to processing at any time (this does not affect lawfulness of processing based on consent before its withdrawal)
• Limit processing: Request that we limit processing of your personal data in certain circumstances
• Complaint: Lodge a complaint with the Department of Personal Data Protection Malaysia if you believe your rights have been infringed

To exercise any of these rights, write to [email protected]. We will respond within 21 days.

10. Children's Privacy

Our services are directed at adults. We do not knowingly collect personal data from individuals under the age of 18. If we become aware that personal data belonging to a minor has been submitted through this website, we will delete it promptly.

11. External Links

This website may contain links to external organisations and resources, including the professional directory provided to orientation clients. We are not responsible for the privacy practices of those organisations. We recommend reading the privacy policy of any external site you visit.

12. Changes to This Policy

We may update this privacy policy from time to time. Changes will be posted on this page with an updated "Last Updated" date. If changes are material, we will notify current engagement clients directly by email.

13. Contact for Privacy Matters

For any questions about this policy or about how we handle personal data, please write to: