Privacy Policy

SECTION 1

What personal data we collect

We collect only the information needed to respond to enquiries and deliver our services. This includes:

• Name and contact details (email address, telephone number) provided through our contact form or by correspondence
• Postal address, if provided for correspondence or service delivery
• Details of your enquiry or the nature of your situation, as you describe it
• For course participants: audio recordings and transcriptions produced during the oral history course, held only with your written consent
• For association clients: organisational contact details and records inventories compiled during the consulting engagement
• Website usage data collected via cookies (see Section 5)

We do not collect sensitive personal data, financial information, or identity document numbers through our website or service processes.

SECTION 2

How we use personal data

Personal data is used for the following purposes:

• Responding to enquiries and communicating with you about services
• Delivering and administering the services you have engaged us for
• Issuing invoices and managing payments
• Maintaining records of engagements for operational and legal compliance purposes
• Improving our website and understanding how it is used (analytics only, no personal targeting)

We do not use personal data for direct marketing without your explicit consent, and we do not sell or share personal data with third parties for marketing purposes.

Legal basis for processing: consent (for optional data and cookies), contract performance (for service delivery), and legitimate interest (for responding to enquiries and operating the business).

SECTION 3

Data retention

We retain personal data for the following periods:

• Enquiry correspondence not resulting in an engagement: 12 months from last contact
• Engagement records (invoices, scope documents, reports): 7 years from completion, in line with Malaysian commercial record-keeping requirements
• Oral history course participant records: held for the duration of the course plus 12 months, then deleted unless you request otherwise
• Website analytics data: as configured in the analytics service used; typically up to 14 months

After the relevant retention period, personal data is deleted or anonymised.

SECTION 4

Data protection measures

We use reasonable technical and organisational measures to protect personal data, including:

• Encrypted email and file transfer where personal data is shared digitally
• Password-protected storage for digital engagement records
• Access limited to team members who need the data to deliver the relevant service
• Physical records stored in a secure, locked environment at our George Town premises

In the event of a data breach affecting your personal information, we will notify you and, where required, the relevant authority under the PDPA, without undue delay.

SECTION 5

Cookies

Our website uses cookies to remember your preferences and understand how visitors use the site. Essential cookies are necessary for the site to function. Optional cookies (analytics, preferences) are placed only with your consent, managed through the cookie banner on the homepage. You can review and change your preferences at any time via our Cookie Policy.

SECTION 6

Your rights

Under the PDPA and as a matter of our practice, you have the following rights in relation to your personal data:

• Access: You may request a copy of the personal data we hold about you.
• Correction: You may ask us to correct inaccurate or incomplete data.
• Withdrawal of consent: Where processing is based on consent, you may withdraw it at any time. This does not affect processing carried out before withdrawal.
• Deletion: You may ask us to delete personal data we no longer have a lawful basis to hold, subject to our legal retention obligations.
• Objection: You may object to processing based on legitimate interest where you have grounds relating to your particular situation.

To exercise any of these rights, write to [email protected]. We will respond within 21 days. If you are not satisfied with our response, you may contact the Personal Data Protection Commissioner of Malaysia (pdp.gov.my).

SECTION 7

Third-party links

Our website may contain links to external websites, including referral resources. We are not responsible for the privacy practices of those sites. We recommend reviewing the privacy policy of any external site you visit through a link on our pages.

SECTION 8

Children's privacy

Our services are directed at adults. We do not knowingly collect personal data from individuals under the age of 18 without the consent of a parent or guardian. If you believe we have inadvertently collected data from a minor, please contact us at [email protected] and we will delete it.

SECTION 9

Changes to this policy

We may update this policy from time to time. The updated version will be published on this page with a revised Last Updated date. For material changes, we will notify clients by email where we hold a current email address. Continued use of the website after changes are published constitutes acceptance of the updated policy.

SECTION 10

Contact for data matters

Data controller: Waris Archive
Address: 23 Lebuh Acheh, 10200 George Town, Pulau Pinang, Malaysia
Email: [email protected]
Telephone: +60 4 371 9825