Privacy Policy

Who we are

A3M Concept Sdn Bhd (registration no. 201901011262 / 1320590-P), 15781 Jalan Camar 10, Bandar Putra, 81000 Kulai, Johor, Malaysia. For privacy matters, email a3mcsb@gmail.com. [TODO:CLIENT — move to a role address once a domain mailbox exists; Data Protection Officer, if appointed under PDPA 2024.]

What we collect

• Enquiry form: your name, company, email, optional phone, project location, your message, and branch-specific project details; your consent choices.
• Booking: whatever the third-party scheduler collects (name, email, timeslot) — only if you choose to load and use it.
• Technical: aggregate, non-identifying usage statistics (page, referring site) via Cloudflare Web Analytics; short-lived server logs used only for security and abuse prevention.

Why we use it (and our legal basis)

• To respond to your enquiry and take steps toward a possible contract.
• To keep the site secure and prevent abuse (our legitimate interests).
• For analytics and any marketing updates (only with your consent).
• To meet legal obligations.

What we don't do

We don't sell personal data, use it for automated decisions with legal effect, or collect sensitive personal data through this site.

Who we share it with

Service providers acting on our instructions: Cloudflare (hosting, security, analytics), [TODO:CLIENT email provider] (enquiry delivery), [TODO:CLIENT scheduler] (bookings), and — from a later phase — Supabase (secure storage). Each only receives what it needs.

Where it's stored

[TODO:CLIENT/legal — processor regions and the cross-border transfer safeguard relied upon under the PDPA.]

How long we keep it

Enquiry data: [TODO:CLIENT/legal, e.g. 24 months] after our last contact, then deleted or anonymised. Server logs: about 30 days. Consent records: as long as needed to evidence compliance.

Your rights

Under the PDPA you can ask to access or correct your data, withdraw consent, limit processing, or request portability, and you may complain to the Personal Data Protection Commissioner. Contact us and we'll respond within the statutory timeframe.

Security

Data is encrypted in transit, access is restricted, and we collect only what we need. See our security practices summary for more.

Children

This site is not directed at children and we do not knowingly collect their data.

Changes

We'll update the date above when this policy changes and, for material changes, prompt you again for consent where required.