Privacy Policy

1. Introduction

Brightspire ("we", "us", "our") is committed to handling your personal data with care, honesty and in full compliance with Malaysia's Personal Data Protection Act 2010 (PDPA). This Privacy Policy explains what data we collect, why we collect it, how we use it and what your rights are.

This policy applies to all visitors to our website and to all individuals who contact us, request information or enter into an engagement with us. If you have any questions about this policy, please write to us at privacy@{{DOMAIN}}.

2. Data We Collect

We collect personal data only where there is a clear purpose for doing so. The categories of data we may collect are:

• Identity data: full name, job title, organisation name
• Contact data: email address, telephone number, business address
• Enquiry data: the content of messages or questions you submit through our contact form
• Technical data: IP address, browser type, pages visited, session duration — collected via analytics cookies where consent is given
• Engagement data: notes, documents and communications related to advisory work conducted under contract

We do not collect sensitive personal data (such as data about health, religion, race or political opinion) in the normal course of our business. If any sensitive data is shared with us incidentally, we delete it promptly unless retention is required for a specific, agreed purpose.

3. How We Collect Data

• Through the enquiry form on our website
• Through direct email or telephone communication
• Through cookies and analytics tools on our website (with consent)
• In the course of delivering advisory engagements

4. Legal Basis for Processing

Under the PDPA 2010, we process your personal data on the following lawful bases:

• Consent: where you have given us permission, such as submitting our contact form or accepting analytics cookies
• Contract performance: to fulfil the terms of an advisory engagement you have entered into with us
• Legitimate interests: to respond to general enquiries and manage our business operations, where those interests do not override your rights
• Legal obligation: where we are required to retain data under applicable Malaysian law

5. How We Use Your Data

• To respond to your enquiries and provide information about our services
• To deliver and manage advisory engagements you have contracted with us
• To send occasional service-related updates where you are an existing client
• To improve our website through aggregated, anonymised analytics data
• To comply with our legal and regulatory obligations in Malaysia

We do not use your personal data for automated decision-making or profiling.

6. Data Retention

We retain personal data only for as long as necessary:

• Enquiry data: up to 12 months from the date of the enquiry, unless you become a client
• Engagement data: 5 years from the end of the engagement, to meet business record-keeping requirements
• Analytics data: as set by the analytics provider, typically 14–26 months

After the relevant retention period, data is securely deleted or anonymised.

7. Data Sharing

We do not sell, rent or trade your personal data. We may share data in limited circumstances:

• Service providers: such as cloud storage providers, email platforms and analytics tools, under appropriate data processing agreements
• Legal obligations: where required by Malaysian law, court order or regulatory authority

Any third-party service provider we engage is contractually bound to process data only for the specific purpose we have authorised and in compliance with applicable data protection law.

8. Data Protection Measures

• Data is stored on secure, access-controlled systems
• Electronic data in transit is protected using SSL/TLS encryption
• Access to client data is restricted to those directly involved in the relevant engagement
• In the event of a data breach that may affect your rights, we will notify you and the relevant authority within the timeframe required under Malaysian law

9. Cookies

Our website uses cookies. For a full explanation of the types of cookies we use and how to manage your preferences, please read our Cookie Policy.

10. Your Rights

Under the PDPA 2010 and applicable Malaysian data protection principles, you have the following rights:

• The right to access the personal data we hold about you
• The right to request correction of inaccurate or incomplete data
• The right to withdraw consent at any time, where consent is the basis for processing
• The right to request that we cease processing your data for direct marketing purposes
• The right to request deletion of data we are not legally required to retain

To exercise any of these rights, please contact us at privacy@{{DOMAIN}}. We will respond within 21 days of receiving your request.

11. Third-Party Links

Our website may contain links to external websites. We are not responsible for the privacy practices of those sites and encourage you to review their privacy policies before providing any personal data.

12. Children's Privacy

Our services are intended for business organisations and individuals aged 18 and above. We do not knowingly collect data from anyone under the age of 18. If you believe we have inadvertently collected data from a minor, please contact us and we will delete it promptly.

13. Changes to This Policy

We may update this policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. For significant changes, we will notify active clients directly. Continued use of our website following an update constitutes acceptance of the revised policy.