Privacy Policy — Cahayacis

1. Introduction

Cahayacis ("we", "us", "our") is a business consulting practice located at Jalan Gurney, 10250 George Town, Pulau Pinang, Malaysia. We provide communication and collaboration tools consulting services for small businesses.

This Privacy Policy describes how we collect and handle personal data when you visit our website or contact us for services. It applies to data collected through our website at cahayacis.pro and through direct enquiries.

We operate in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA). If you have questions about this policy, please write to [email protected].

2. What Personal Data We Collect

We collect personal data only when you choose to provide it. This may include:

Contact details — your name, email address, and phone number when you submit our contact form or contact us directly.
Business information — your company name and the nature of your enquiry, to help us understand how we can be useful.
Website usage data — anonymised information about how you navigate the site (pages visited, time spent), collected through analytics cookies if you have consented.
Communication records — emails, notes from calls, and correspondence related to your enquiry or engagement.

We do not collect payment card details, sensitive personal data, or data from individuals below the age of 18.

3. How We Use Your Data

Personal data is used solely for the purposes it was provided. Specifically:

To respond to enquiries and arrange consultations.
To deliver agreed consulting services and send relevant progress updates.
To send occasional service updates or information about our work, where you have agreed to receive them.
To improve the quality and relevance of our website based on aggregated, anonymised usage patterns.
To comply with applicable legal obligations under Malaysian law.

We do not sell, rent, or trade personal data to third parties for marketing purposes.

4. Legal Basis for Processing

Under Malaysia's PDPA 2010, we process personal data on the following grounds:

Consent — where you have clearly agreed, such as by submitting a contact form.
Contractual necessity — where data is needed to deliver services you have engaged us for.
Legitimate interest — such as keeping basic records of business communications, where this does not override your interests or rights.
Legal obligation — where required by Malaysian law or a regulatory authority.

5. Data Retention

We keep personal data only for as long as it is needed:

Enquiry data (no engagement follows) — retained for up to 12 months, then securely deleted.
Client records — retained for 7 years from the end of the engagement, in line with standard Malaysian business record-keeping practice.
Analytics data — aggregated and anonymised; individual identifiers are not retained beyond 26 months.

After the applicable retention period, data is securely deleted or anonymised.

6. Data Sharing

We share personal data only in limited circumstances:

Service providers — trusted tools we use for email hosting, website analytics, and calendar scheduling. These processors handle data on our behalf and are contractually bound to protect it.
Professional advisers — legal or accounting professionals who provide advice to us, bound by confidentiality obligations.
Authorities — where required by Malaysian law, a court order, or a regulatory body.

We do not transfer personal data outside Malaysia unless adequate protections are in place.

7. Cookies

Our website uses cookies to support basic functionality and, where consented, to understand how visitors use the site. Cookie categories include:

Essential cookies — necessary for the site to function. These cannot be declined.
Analytics cookies — used to understand visitor behaviour in aggregate form (optional).
Preference cookies — used to remember your choices on this site (optional).

You can manage your cookie preferences at any time via our Cookie Policy page.

8. Data Protection Measures

We take practical steps to keep personal data secure:

Data is transmitted over encrypted connections (HTTPS).
Access to personal data is limited to the individuals who need it to carry out their work.
We review our data practices periodically and update procedures as needed.
In the unlikely event of a data breach that poses a risk to individuals, we will notify those affected and the relevant authority without undue delay.

9. Your Rights

Under Malaysia's PDPA 2010, you have the right to:

Access your personal data that we hold.
Correct inaccurate or incomplete data.
Withdraw consent at any time, without affecting the lawfulness of earlier processing.
Object to the use of your data for direct marketing.
Request deletion of your data, subject to any legal retention obligations.

To exercise any of these rights, please write to [email protected]. We will respond within 21 days.

10. Third-Party Links

Our website may include links to external websites. We are not responsible for the privacy practices of those sites and encourage you to read their privacy policies before sharing any personal data with them.

11. Children's Privacy

Our services are intended for business owners and professionals aged 18 and above. We do not knowingly collect personal data from anyone under 18. If you believe a minor has contacted us, please notify us at [email protected] and we will promptly delete the data.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, the "Last Updated" date at the top of the page will be revised. Continued use of the website after changes are posted indicates your acceptance of the updated policy.

13. Contact for Privacy Matters

If you have questions, concerns, or requests related to your personal data, please contact us:

Cahayacis
Jalan Gurney, 10250 George Town, Pulau Pinang, Malaysia
Email: [email protected]
Phone: +60 4-381 7264