LEGAL

Privacy Policy

Last updated: 15 April 2025  |  Effective: 15 April 2025

1. Introduction

Quipu & Co ("we", "us", "our") is committed to handling personal data with care and transparency. This policy explains what personal data we collect, how we use it, and what rights you have in relation to it. It applies to participants in our programmes, visitors to this website, and anyone who contacts us by phone or email.

Our registered address is: No. 27A George Town Heritage Row, Lebuh Pantai, 10300 George Town, Penang, Malaysia. For privacy-related enquiries, please write to: privacy@quipuand.

2. Data We Collect

Information you provide directly

• Name and contact details (email address, phone number) when you use our enquiry form or contact us
• Financial figures and documents you choose to share during an engagement — these are used solely within the scope of that engagement
• Feedback and survey responses provided at the end of a programme

Information collected automatically

• Standard website log data (IP address, browser type, pages visited) for security and performance purposes
• Cookie data, as described in our Cookie Policy

Data we do not collect

We do not collect bank account numbers, identity card numbers, passport numbers, or payment card details. Programme fees are paid by bank transfer; we do not process card payments on this site.

3. How We Use Personal Data

• To respond to enquiries — when you write to us or call, we use your contact details to reply
• To administer programmes — scheduling, session notes, and materials delivery
• To improve our programmes — anonymised feedback is used to review and update content
• To comply with legal obligations — Malaysian law may require us to retain certain records

We do not use personal data for marketing to third parties, and we do not sell data to anyone.

Legal basis for processing: consent (for optional cookies and feedback), legitimate interests (for programme administration and security), and legal obligation (for record-keeping requirements).

4. Data Retention

• Enquiry contact details: retained for up to 12 months from last contact, unless a programme begins
• Programme participant records: retained for 3 years from the end of the engagement, then deleted
• Financial figures and documents shared within an engagement: deleted or returned at the end of the engagement unless you request otherwise
• Website log data: retained for 90 days

5. Data Protection Measures

We store electronic records in password-protected systems with access limited to the facilitator and programme coordinator involved in your engagement. Physical documents shared during sessions are stored securely and not removed from our premises without your consent. We conduct an annual review of our data handling practices.

In the event of a data breach that is likely to affect your rights, we will notify you and the relevant authority within the timeframes required under Malaysian personal data protection law.

6. Sharing with Third Parties

We do not share personal data with third parties for commercial purposes. We may share data with:

• Service providers who support our website (hosting, analytics) — subject to data processing agreements
• Authorities if required by Malaysian law

We do not use advertising networks or social media tracking pixels.

7. Cookies

This website uses cookies as described in our Cookie Policy. You can manage your preferences through the cookie settings on this site.

8. Your Rights

Under the Personal Data Protection Act 2010 (PDPA) of Malaysia, you have the right to:

• Request access to personal data we hold about you
• Request correction of inaccurate data
• Withdraw consent for processing where consent is the legal basis
• Request that we limit or cease processing in certain circumstances
• Raise a complaint with the Department of Personal Data Protection Malaysia

To exercise any of these rights, please write to privacy@quipuand. We will respond within 21 working days.

9. Third-Party Links

This website may contain links to external resources. We are not responsible for the privacy practices of those sites and encourage you to read their policies before sharing any personal data with them.

10. Children

Our programmes are intended for adults aged 18 and above. We do not knowingly collect personal data from individuals under 18. If you believe we have inadvertently done so, please contact us and we will delete the data promptly.

11. Changes to This Policy

We may update this policy when our practices change or when required by law. The date at the top of this page reflects the most recent revision. Continued use of this site after a revision indicates acceptance of the updated policy.

12. Contact

For any privacy-related questions or requests:

• Email: privacy@quipuand
• Address: No. 27A George Town Heritage Row, Lebuh Pantai, 10300 George Town, Penang, Malaysia
• Phone: +60 4-263 7185