Privacy Policy

1. Personal Data We Collect

When you interact with Tenang Path — whether through our website, contact form, phone, email, or in person — we may collect the following categories of personal data:

• Identity data: Full name, preferred name
• Contact data: Email address, phone number, residential area
• Enquiry data: Content of your messages and programme interests
• Payment data: Bank transfer references, payment confirmation records (we do not store card numbers)
• Programme participation data: Attendance records, session notes, feedback responses
• Technical data: IP address, browser type, cookies (see our Cookie Policy)

We collect this data when you complete our contact form, call or email us, register for a programme, or participate in a session. We do not collect sensitive personal data (such as financial account details, health information, or NRIC numbers) as part of our standard operations.

2. Legal Basis for Processing

We process your personal data on the following grounds under the PDPA 2010:

• Consent: You have given us clear consent for a specific purpose (e.g., receiving programme information)
• Contractual necessity: Processing is necessary to fulfil a programme enrolment or service agreement with you
• Legitimate interests: Processing is necessary for our legitimate business interests, where these are not overridden by your rights (e.g., responding to enquiries, improving our services)
• Legal obligation: Where we are required to retain data to comply with Malaysian law

3. How We Use Your Personal Data

We use your personal data only for purposes that are relevant to your interaction with us. These include:

• Responding to enquiries and scheduling programme sessions
• Processing programme enrolments and payments
• Delivering and improving our educational programmes
• Sending programme reminders, session materials, and follow-up communications
• Maintaining records required for our operations and compliance
• Analysing programme effectiveness to improve future delivery

We will not use your data for direct marketing communications without your explicit consent. We will not sell, rent, or share your personal data with third parties for their own marketing purposes.

4. Data Sharing and Third Parties

We share personal data only where necessary and only with trusted service providers who support our operations:

• Email and communication tools: Used to send session confirmations and materials
• Payment processors: To process programme fees securely
• Analytics services: Aggregated, anonymised website usage data only

All third-party processors are bound by confidentiality obligations and are only authorised to use data to provide services on our behalf. We do not transfer personal data outside Malaysia except where the receiving jurisdiction provides an adequate level of protection.

5. Data Retention

We retain personal data only for as long as it is reasonably necessary for the purposes for which it was collected:

• Enquiry data: 12 months from last contact if enrolment does not proceed
• Programme participant records: 7 years following programme completion, in line with standard Malaysian business record requirements
• Payment records: 7 years as required under Malaysia's Income Tax Act 1967
• Marketing consent records: Until consent is withdrawn

When data is no longer required, it is securely deleted or anonymised.

6. Data Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These include:

• Encrypted storage and transmission of personal data
• Access controls limiting data access to those with a genuine need
• Regular review of data handling practices
• Secure deletion of data when retention periods expire

If we become aware of a data breach that is likely to result in a risk to your rights or freedoms, we will notify the relevant authorities and affected individuals in accordance with our legal obligations.

7. Cookies and Website Analytics

Our website uses cookies to understand how visitors engage with our content and to improve site performance. We use only essential cookies by default. Analytics and preference cookies are only activated if you provide consent through our cookie banner. For full details, please read our Cookie Policy.

8. Your Rights Under PDPA 2010

Under Malaysia's Personal Data Protection Act 2010, you have the following rights:

• Right to access: Request a copy of the personal data we hold about you
• Right to correction: Request that inaccurate or incomplete data be corrected
• Right to withdraw consent: Withdraw consent for processing based on your consent, at any time
• Right to prevent processing: Request that we stop processing your data for direct marketing purposes
• Right to data portability: Receive your data in a structured, commonly used format where technically feasible

To exercise any of these rights, please write to us at privacy@{{DOMAIN}}. We will respond within 21 days. Where a request is complex, we may take up to 60 days but will inform you of this.

9. Third-Party Links

Our website may occasionally link to external resources. We are not responsible for the privacy practices or content of those external sites. We encourage you to review the privacy policies of any website you visit outside of our own.

10. Participants Under 18

Tenang Path programmes are designed for adults aged 40 and above. We do not knowingly collect personal data from individuals under the age of 18. If we become aware that a minor has submitted personal data to us, we will delete it promptly. If you have concerns about data submitted by a minor, please contact us at privacy@{{DOMAIN}}.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. When we do, we will update the "Last Updated" date at the top of this page. We encourage you to review this policy periodically. Continued use of our website or services after changes are made constitutes acceptance of the updated policy.