Privacy Policy

1. Introduction

Threadstone ("we", "us", "our") is committed to handling personal data responsibly. This policy describes what data we collect, why we collect it, how we protect it and what rights you have over it. It applies to all individuals who contact us, enquire about our services or engage us for estate records work.

If you have questions about this policy, contact us at [email protected].

2. Data we collect

2.1 Information you provide

• Name, email address and phone number provided through our contact form or by direct communication
• Information about the records situation you describe in enquiry messages
• Personal data of estate parties that arises in the course of a records engagement (names, identification numbers, property details)

2.2 Information collected automatically

• Website analytics data (pages visited, session duration, browser type) via cookies — only where consent has been given
• IP address and device information collected by the web server

3. How we use your data

• Enquiry handling: to respond to messages and discuss the scope of potential engagements
• Engagement delivery: to carry out the clerical and organisational work described in a signed scope document
• Correspondence: to send fortnightly status notes and other written communications described in the engagement
• Legal and administrative compliance: to meet obligations under Malaysian law including the Personal Data Protection Act 2010

We do not use your data for unsolicited marketing. We do not sell or rent personal data to third parties.

4. Legal basis for processing

We process personal data on the following bases under the Personal Data Protection Act 2010 (Malaysia):

• Consent: for optional analytics cookies and where you have provided information voluntarily through our contact form
• Contractual necessity: for data processed in the course of carrying out a signed engagement
• Legitimate interests: for general business administration and security

5. Data retention

• Enquiry data for which no engagement follows: retained for up to 6 months, then deleted
• Engagement records: retained for 7 years after the closing file date to meet standard business record-keeping requirements, then securely deleted
• Analytics data: retained as configured by the analytics provider, typically up to 26 months
• Copies of client documents held during an engagement: returned or deleted at the end of the engagement unless a separate arrangement is agreed in writing

6. Data protection measures

• Access to client files is restricted to team members directly involved in the relevant engagement
• Digital files are stored on encrypted drives. Physical files are kept in a secure, locked environment
• Third-party service access (such as website hosting) is limited to what is necessary for their function
• In the event of a data breach affecting personal data, affected individuals will be notified as required by applicable law

7. Cookies

Our website uses essential cookies for basic functionality and, where you consent, analytics cookies to understand how the site is used. Full details are available in our Cookie Policy.

8. Third-party links

Our website may contain links to external sites. We are not responsible for the privacy practices of those sites and recommend reviewing their policies separately.

9. Your rights under Malaysian PDPA

Under the Personal Data Protection Act 2010, you have the following rights in relation to personal data we hold about you:

• Right to access your personal data
• Right to correct inaccurate data
• Right to withdraw consent at any time (where processing is based on consent)
• Right to request that we stop using your data for direct marketing
• Right to make a complaint to the Personal Data Protection Commissioner of Malaysia

To exercise any of these rights, contact us at [email protected]. We will respond within 21 days.

10. Children's data

Our services are intended for adults. We do not knowingly collect personal data from individuals under the age of 18. If you believe we have received data from a minor, contact us and we will delete it promptly.

11. Changes to this policy

We may update this policy from time to time. The "last updated" date at the top of the page reflects when changes were last made. Continued use of our services after a change constitutes acceptance of the updated policy.

12. Contact

Data controller: Threadstone
Address: 54 Jalan Bunga Raya, 75100 Melaka, Malaysia
Email: [email protected]
Phone: +60 6-317 4082