Privacy Policy

1. Introduction

Orenda Works ("we", "us", "our") is committed to handling personal data responsibly and in accordance with the Personal Data Protection Act 2010 (PDPA) of Malaysia. This Privacy Policy describes how we collect, use, store, and protect personal information when you engage with our website or advisory services. By using our website or submitting an enquiry, you acknowledge that you have read and understood this policy.

This policy applies to all personal data collected by Orenda Works in the course of our business operations, including our website at orenday.blog and all three of our advisory service engagements.

2. Data We Collect

We collect personal information that you provide directly to us, including:

• Full name
• Email address
• Phone number (if provided)
• Organisation name and your role within it
• The content of any message or enquiry you submit
• Notes taken during working sessions and advisory engagements, which may include information about third parties within your organisation

We also collect non-personal technical data through our website, including IP address, browser type, pages visited, and session duration. This is collected via cookies and analytics tools where consent has been given.

3. Legal Basis for Processing

Under the PDPA 2010, we process personal data on the following grounds:

• Consent: Where you have given us clear consent to process your data for a specific purpose (e.g. submitting the contact form).
• Contract performance: Where processing is necessary to carry out an advisory engagement you have agreed to.
• Legitimate interest: Where we have a legitimate business reason to process data, such as responding to enquiries or maintaining records of completed work.

4. How We Use Your Data

We use personal data for the following purposes:

• Responding to your enquiries and scheduling initial conversations
• Delivering advisory services and producing written deliverables under contract
• Communicating with you during and after an engagement
• Sending information about our services where you have opted in
• Improving our website and service delivery using anonymised analytics data
• Maintaining accurate business records as required

We do not use personal data for automated decision-making or profiling.

5. Data Sharing

Orenda Works does not sell personal data to third parties. We may share data with:

• Service providers: Third-party software tools (e.g. email, document storage) used in the delivery of our services. These providers are bound by appropriate data processing agreements.
• Analytics providers: Anonymised usage data may be shared with web analytics tools where consent has been given.
• Legal and regulatory authorities: Where required by Malaysian law or court order.

Any information shared during an advisory engagement is treated as confidential and is not shared with other clients or used in case studies without explicit written permission.

6. Data Retention

We retain personal data for as long as reasonably necessary for the purposes set out in this policy:

• Enquiry data (no engagement): retained for 12 months, then deleted.
• Engagement records and deliverables: retained for 5 years from the close of the engagement.
• Invoicing and financial records: retained for 7 years as required under Malaysian tax and company law.
• Website analytics data: retained for up to 26 months in anonymised form.

7. Data Protection Measures

We take reasonable and appropriate steps to protect personal data from unauthorised access, disclosure, alteration, or destruction:

• All documents and deliverables containing personal data are stored in password-protected cloud storage with access restricted to the delivering advisor.
• Communications containing sensitive information are sent through encrypted channels.
• Internal access to client data is limited to the advisor directly responsible for the engagement.
• In the event of a data breach affecting your personal data, we will notify you without undue delay and in compliance with our obligations under the PDPA 2010.

8. Cookies

Our website uses cookies to support basic functionality and, where consent is given, to collect analytics data. There are four categories of cookies we may use: essential, analytics, marketing, and preference cookies. For full details of the cookies in use and how to manage your preferences, please see our Cookie Policy.

9. Your Rights Under PDPA 2010

As a data subject under Malaysian law, you have the following rights:

• Right of access: You may request a copy of the personal data we hold about you.
• Right of correction: You may request that inaccurate or incomplete data be corrected.
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting prior processing.
• Right to prevent processing: You may request that we stop processing your data for direct marketing purposes.

To exercise any of these rights, contact us at [email protected]. We will respond within 21 days. We may need to verify your identity before processing a request.

If you have concerns about how we handle your personal data, you may direct a complaint to the Personal Data Protection Department of Malaysia (Jabatan Perlindungan Data Peribadi), which operates under the Ministry of Communications and Digital.

10. Third-Party Links

Our website may contain links to external websites and services. Orenda Works is not responsible for the privacy practices or content of those sites. We encourage you to review the privacy policies of any third-party sites you visit through links on our website.

11. Children's Privacy

Our services are intended for use by organisations and individuals aged 18 and over. We do not knowingly collect personal data from persons under 18. If we become aware that we have collected personal data from a minor, we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last Updated" date at the top of this page. For material changes, we will provide notice via email to active clients or by a visible notice on our website. Continued use of our website after any changes constitutes acceptance of the updated policy.

13. Contact

For any privacy-related questions, requests, or concerns, please contact us:

Orenda Works
Level 13, Menara Symphony, Jalan Prof Khoo Kay Kim, 46050 Petaling Jaya, Selangor
Email: [email protected]
Phone: +60 3-7956 2840