Privacy Policy
Hearthford collects a small amount of personal information from families who enquire about or participate in our household communication workshops and records organisation programmes. This policy describes what we collect, why we hold it, how we store it, and what rights you have regarding the information you share with us. We have written it in plain language — if any part is unclear, you are welcome to write to us directly.
1. Data Controller
The data controller for all personal information collected through this website and through Hearthford's programmes is:
Hearthford
31 Persiaran Bukit Bandaraya, Bukit Bandaraya, 59100 Kuala Lumpur, Malaysia
Email: [email protected]
Phone: +60 3 2538 7194
Our activities are conducted within Malaysia and are subject to the Personal Data Protection Act 2010 (PDPA), which governs the collection, processing, and use of personal data in commercial transactions.
2. What We Collect
We collect only the information we need to deliver our programmes and communicate with households that have enquired about them.
Information you provide directly
- Contact details — name, email address, and telephone number submitted through our enquiry form or provided during a session booking.
- Enquiry content — the message or question you submit through the website contact form.
- Programme records — attendance, programme choice, and payment records relevant to the session or programme you have enrolled in.
Information collected automatically
- Website usage data — pages visited, time on page, referral source, and browser type, collected through analytics tools on an aggregated and anonymised basis where possible.
- Cookie data — small text files stored in your browser that help the website function and record your consent preferences. See Section 7 for further detail.
3. How We Use Your Information
We use personal data for the following purposes:
- Responding to enquiries — to contact you in response to a message submitted through our website or by telephone.
- Programme delivery — to organise and schedule workshops and programme sessions, and to send you relevant preparation materials and confirmations.
- Payment processing — to issue invoices and record payments for enrolled programmes.
- Service improvement — to understand how the website is used and to make improvements that help families find information more easily.
- Compliance and record-keeping — to meet legal obligations and to maintain records of completed sessions where required.
We do not use personal data for automated decision-making or profiling. We do not sell personal data to any third party.
4. Legal Basis for Processing
Under the Personal Data Protection Act 2010 (Malaysia), we process personal data on the following bases:
Consent
When you submit an enquiry form, you provide consent for us to contact you in response. You may withdraw consent at any time by writing to [email protected].
Contractual necessity
When you enrol in a programme, we process your contact and payment information as necessary to deliver the sessions and complete the arrangement.
Legitimate interests
We may process anonymised website usage data to improve the website and understand how families navigate it. This does not involve individual-level tracking.
5. How Long We Hold Your Information
We keep personal data only for as long as necessary for the purpose it was collected:
| Data Type | Retention Period |
|---|---|
| Enquiry form submissions (no programme enrolled) | 12 months from submission date |
| Programme enrolment and attendance records | 7 years from programme completion (financial record requirements) |
| Payment and invoicing records | 7 years (Malaysian tax and accounting obligations) |
| Anonymised website analytics | 26 months (rolling) |
At the end of the applicable period, data is deleted securely or anonymised for aggregate reporting.
6. Security Measures
We take reasonable precautions to protect personal data from unauthorised access, disclosure, or loss. Our approach includes:
- Website served over HTTPS with TLS encryption for all data transmitted between your browser and our server.
- Access to stored records restricted to Hearthford staff who need it to carry out their work.
- Programme session notes and household records stored in password-protected systems and not shared with any external party without your explicit agreement.
- Physical documents containing personal information stored in locked premises and disposed of by secure shredding.
In the event of a data breach that poses a risk to your rights, we will notify the relevant authorities and affected individuals in accordance with applicable Malaysian law.
8. Third Parties
We do not sell your personal data. We may share information with a limited number of service providers who support our operations:
- Web hosting and email providers — to operate the website and send email communications.
- Payment processing — if payment is made online, your payment details are handled directly by the payment provider and are not stored by Hearthford.
- Analytics tools — we may use services such as Google Analytics to understand aggregate website usage. Data is processed under data processing agreements and, where possible, with IP anonymisation enabled.
All third-party providers used by Hearthford are required to handle your data only for the specific purpose for which it is shared, and are bound by appropriate data protection agreements.
9. Your Rights
Under the Personal Data Protection Act 2010 (Malaysia), you have the following rights regarding your personal data:
Request a copy of the personal information we hold about you.
Ask us to correct any information that is inaccurate or incomplete.
Withdraw consent for processing at any time where consent is the legal basis.
Request that we stop processing your data for direct marketing purposes.
To exercise any of these rights, write to us at [email protected]. We aim to respond within 21 days. We may ask you to confirm your identity before acting on a request.
If you have a concern about how we handle your personal data, you may raise a complaint with the Department of Personal Data Protection (JPDP), the supervisory authority for data protection in Malaysia.
10. Children's Privacy
Our website and online enquiry forms are directed at adults aged 18 and over. We do not knowingly collect personal data from anyone under 18 through this website. Hearthford's programmes are contracted with the adult members of a household. If you believe a minor has submitted personal data through our website, please contact us at [email protected] and we will remove it promptly.
11. External Links
Our website may contain links to external websites — for example, to resource organisations or reference materials. We are not responsible for the privacy practices of those sites. We encourage you to read the privacy policies of any external site you visit through a link from this website.
12. Policy Changes
We may update this policy from time to time to reflect changes in how we work or to meet updated legal requirements. When we do, the revised version will be published on this page with a new "Last Updated" date.
If changes are material, we will notify active programme participants by email at least 14 days before the changes take effect. Continued use of our website or services after changes are published indicates your acknowledgement of the updated policy.
13. Contact Us About Privacy
For any questions about this policy, to request access to your data, or to report a concern, contact us by any of the following means:
Phone
+60 3 2538 7194Post
Hearthford, 31 Persiaran Bukit Bandaraya, Bukit Bandaraya, 59100 Kuala Lumpur, Malaysia